Privacy Policy

1. Who we are

BisMaps is an online mind-mapping service. For the purposes of the EU/UK General Data Protection Regulation (GDPR) and similar laws, BisMaps is the data controller for the personal data described below.

Privacy questions and data requests: [email protected].

2. Data we collect

• Account data — name, email address, hashed password and email-verification status.
• Content you create — mind maps, nodes, notes, uploaded wallpaper images, chat messages with the AI assistant, and feedback you send us.
• Workspace data — members and invitations of the workspaces you belong to.
• Billing data — subscription plan, payment status and PayPal subscription identifiers. Full card details never reach our servers; they are handled by PayPal.
• Technical data — IP address, user agent and timestamps, recorded for security, rate limiting and error diagnosis.
• Site measurement — the pages you open, the country our network edge reports, the referring site, campaign tags in the link you arrived from, and how long, how far and where you interacted with a page. See section 8.
• Cookies — see section 7.

3. Why we use it

To provide and secure the service (contract performance), to process subscriptions and prevent fraud (contract and legitimate interests), to send transactional email such as address verification, password resets, workspace invitations and mention notifications, and to comply with tax and accounting obligations (legal obligation).

4. AI features

When you use an AI feature, the text you submit for that request is sent to our AI provider solely to generate the answer. AI features are only available on paid plans and consume plan credits. Do not submit sensitive personal data to AI features.

5. Sharing and transfers

We share personal data only with service providers that help us run BisMaps:

• Railway — application hosting and database.
• Cloudinary — storage and delivery of uploaded images.
• Resend — delivery of transactional email.
• PayPal — subscription checkout and payment processing.
• AI provider — processing of the AI prompts described in section 4.

Some of these providers are located in the United States. Where personal data leaves the EEA/UK we rely on the European Commission's Standard Contractual Clauses or an adequacy decision. We never sell personal data.

6. Retention

Account and content data are kept while your account exists. Deleting your account removes your profile and personal workspace data; residual copies may remain in backups for up to 30 days. Billing records are kept for the period required by tax law.

7. Cookies and local storage

We use cookies that are necessary to operate the service: a session cookie that keeps you signed in (named with the __Host- prefix in production), an XSRF-TOKEN cookie that protects forms against cross-site request forgery, and browser storage used by the editor to keep unsaved drafts. Signing out asks your browser to clear the cookies and storage belonging to your session.

We do not use advertising or cross-site tracking cookies, so no consent banner is required.

8. First-party measurement

To understand which pages are useful — and which advertisements bring people who actually use them — we record page views ourselves: the page you opened, the country our network edge reports, the site that referred you, any campaign tags in the link you arrived from, and, once your browser tells us, how long the page stayed on screen, how far you scrolled and which buttons or links you clicked.

This measurement sets no cookie, loads no third-party script, and never stores your IP address. Visits from the same device are grouped with a one-way hash of your IP address and browser string, salted with a secret key we can rotate. The hash cannot be turned back into an IP address, and rotating the key breaks every existing link between visits. We record the label of a control you click — never what you type: no keystrokes, no form contents, no cursor or pointer movement, and nothing you create or edit in a mind map.

These rows are used only to produce aggregate reports about how the site is found and used. They are not shared with advertising networks, not used to build a profile of you across other websites, and not sold. They are kept for up to two years and then deleted automatically.

9. Your rights

You may request access to, correction of, or deletion of your personal data, object to or restrict its processing, receive it in a portable format, and withdraw consent at any time. You can edit your profile and delete your account from the account settings; for anything else email [email protected]. You also have the right to lodge a complaint with your local supervisory authority.

10. Security

Data is transmitted over HTTPS (HTTP Strict Transport Security is enforced), passwords are stored with a modern one-way hash, access to workspaces is isolated per tenant, and administrative endpoints are restricted. No system is perfectly secure, so please use a unique password.

11. Changes

We may update this policy as the service evolves. Material changes will be announced on this page with a new "last updated" date.