How Qmo handles your data.
The full Qmo AI & Data Use Policy, followed by the security measures from our Data Processing Addendum.
Contents
Effective date: [TBD] · Map2Close Inc. · legal@map2close.com
Qmo is trained on the data our customers put into it. Your team's calls, transcripts, notes, cards and feedback make Qmo better for your team, and a de-identified version of what we learn about good selling makes Qmo better for every customer. We never sell your data, never show your raw data to another customer, and never use sensitive personal information for training.
This policy is part of the Qmo Terms of Service. If it conflicts with the Data Processing Addendum on how Personal Data is handled, the Data Processing Addendum controls.
1. The short version
- Your data stays yours. You own your Customer Data and the outputs Qmo generates for you.
- Qmo learns for your team. It uses your data to tune cards, scripts, coaching and scoring for your workspace.
- Qmo learns for everyone, without identifying anyone. We strip out people, companies, contact details and deal figures, then use what is left (sales technique, structure, and what works) to improve Qmo for all customers. We call this Network Insights, and Map2Close owns it.
- It is on by default. You can opt out of Network Insights by writing to legal@map2close.com.
- We never sell your data, share it raw with other customers, let outside AI providers train on it, build voiceprints, or train on sensitive personal information.
- You handle consent on your calls. You are responsible for telling the people on your calls that they are being recorded and analyzed, and for getting consent where the law requires it.
2. What data Qmo uses
| Category | Examples |
|---|---|
| Call content | Live and recorded call audio, transcripts, call summaries, objections raised, talk ratios |
| CRM and connected data | Contacts, companies, deals, stages, activities and notes pulled from connected tools such as your CRM or dialer |
| Coaching content | Cards, scripts, playbooks, "Teach Qmo" inputs, and edits your team makes to them |
| Feedback | Card ratings, grades, accepted or rejected suggestions, rep and manager comments |
| Usage data | Which features are used, when, by which user, and device and log information |
3. Three ways your data is used
| Layer | What it is | Data used | Who benefits | Can you turn it off? |
|---|---|---|---|---|
| Running the service | Transcribing calls, showing live cards, grading calls, syncing your CRM | Full Customer Data | Your team | No; Qmo cannot work without it |
| Workspace learning | Tuning cards, scripts, scoring and prompts to how your team sells | Full Customer Data, kept inside your workspace | Your team only | No; it is part of the service. Deleting data removes it from future workspace learning |
| Network Insights | Learning which techniques, structures and phrasing work, across all customers | De-identified, aggregated data only | All Qmo customers | Yes, by written request (Section 7) |
4. How Network Insights are made
Before any Customer Data is used for Network Insights, it goes through a de-identification step that:
- Removes or replaces names of people and companies, email addresses, phone numbers, street addresses, URLs, account and deal identifiers, and deal values and other financial figures.
- Excludes Sensitive Data (Section 6) and any content flagged as Sensitive Data.
- Combines what remains with data from other customers, so that patterns are learned across many conversations rather than from any single one.
What Network Insights look like in practice: "openers that ask permission before pitching keep prospects on the line longer," "this objection is most often resolved by a question about current process," or a refined version of a card that performed well across many teams. They describe technique, not who said what to whom.
Network Insights do not identify you, your users, or the people on your calls, and they are not your Confidential Information. Map2Close owns them and may use them to build and improve Qmo and Map2Close's other products and services. We do not sell Network Insights as a dataset, and we will not attempt to re-identify anyone from them.
5. What we never do
- Sell Customer Data or Personal Data, or share it for cross-context behavioural advertising.
- Show one customer's raw Customer Data, or anything that identifies them, to another customer.
- Allow our AI model, transcription or infrastructure providers to train their own models on your data. Our contracts and account settings with them prohibit it.
- Create voiceprints, speaker biometrics or other biometric identifiers from call audio.
- Use Sensitive Data to train or improve any model.
- Use your data to train models we provide to third parties outside of Map2Close's own products and services.
6. Sensitive data
Sales calls are unscripted, so sensitive information can come up. "Sensitive Data" means health and medical information, government identifiers, payment card and bank account numbers, passwords, biometric data, precise geolocation, information about children, and information about racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, sex life or sexual orientation, and criminal history.
- Qmo is not built to process Sensitive Data, and the Acceptable Use Policy prohibits uploading it deliberately.
- We apply automated filtering to keep Sensitive Data out of Network Insights.
- No filter is perfect. If you see Sensitive Data in Qmo, tell us at legal@map2close.com and we will remove it.
7. Your choices
Opt out of Network Insights. An account administrator can email legal@map2close.com from the account's admin address, naming the workspace. We confirm in writing within 10 business days. From the confirmation date, Customer Data submitted by that workspace is no longer used for Network Insights. Network Insights created before then cannot be withdrawn, because they are de-identified and no longer linked to you. Opting out does not change the price or features of your plan.
Delete data. You can delete calls, transcripts and other content in Qmo, or ask us to delete your workspace. Deleted data is removed from active systems and from future workspace learning on the schedule in our Privacy Policy.
Individuals' rights. People whose information is in Qmo, including prospects on your calls, can exercise their privacy rights under applicable law, including the right to object to their information being used for Network Insights. Requests go to legal@map2close.com. Where we process data on your behalf, we will pass the request to you or help you answer it, as set out in the Data Processing Addendum.
8. People on your calls
The prospects and customers your team speaks with have not signed up for Qmo. You are responsible for:
- Telling them the call is being recorded, transcribed and analyzed by AI, and getting their consent wherever the law requires it. Some jurisdictions, including several U.S. states, require consent from everyone on the call.
- Honouring their requests to stop recording or to delete their information.
- Making sure you have a lawful basis to load their information into Qmo from your CRM and other tools.
Qmo may offer tools, such as a recording disclosure prompt, to help. Using them does not shift these responsibilities to Map2Close.
9. Outside AI providers
Qmo uses third-party providers for AI models, transcription, hosting and email. They process data only to deliver Qmo to you, under contracts that prohibit training on your data and limit how long they keep it. The current list is our Sub-processor List at heyqmo.com/subprocessors. We give 30 days' notice before adding a new sub-processor.
10. How long we keep data
| Data | Kept for |
|---|---|
| Call recordings | [TBD] |
| Transcripts, summaries and cards | Life of the account, unless you delete them sooner |
| Usage logs | [TBD] |
| After the account closes | Deleted within 30 days, apart from backups (rolled off within [TBD] days) and records we must keep by law |
| Network Insights | Kept indefinitely; they contain no Customer Data |
11. Changes to this policy
We will give at least 30 days' notice of material changes by email to account administrators and in the app. We will not use Customer Data you submitted before a change in a materially broader way than this policy allowed when you submitted it, unless you agree.
12. Contact
Map2Close Inc., 720 King St. W #161, Toronto, Ontario, Canada M5V 3S5 · legal@map2close.com
Security measures
Quoted from Annex 4 of the Data Processing Addendum.
- Governance: named personnel responsible for the information security program, and periodic risk assessment.
- Encryption: industry-standard encryption of Personal Data in transit over public networks and at rest.
- Logical segregation: logical separation of each customer's data within the Services.
- Access control: role-based access on a need-to-know and least-privilege basis, unique user IDs, multi-factor authentication for Provider staff accessing production systems, and prompt removal of access when roles change.
- Authentication: passwords for the Services stored using industry-standard hashing, with support for single sign-on through supported identity providers.
- Logging and monitoring: logging of administrative access and system activity, with monitoring for anomalies.
- Hosting: use of reputable cloud infrastructure providers that maintain physical and environmental security controls for their data centres, such as SOC 2 or ISO 27001 certified facilities.
- Secure development and change management: code review, testing and approval of changes to production systems.
- Vulnerability management: dependency and vulnerability scanning, and timely patching of identified vulnerabilities.
- Incident response: documented procedures to investigate, contain, mitigate and notify Information Security Incidents.
- Backup and recovery: regular backups and recovery procedures designed to restore availability after an incident.
- Personnel: confidentiality obligations and security awareness for staff and contractors with access to Personal Data.
- Data minimization in AI processing: de-identification before Network Insights, no training by AI Subprocessors, and limited retention of prompts and outputs by AI Subprocessors.
