Privacy policy
Your data, cookies, privacy rights and service providers.
Last updated 29 October 2026
Who this notice is for
This Privacy Policy explains how MapBulk handles personal information about website visitors, account holders, people who contact us and individuals identified in business records processed through the service. Business contact details and sole-trader listings can be personal information even when publicly available.
MapBulk provides a Chrome Extension, cloud searches, website enrichment, a Dashboard, REST API, MCP and CLI. These services use the same account, credits and permissions. In the EEA, the UK and Switzerland, acknowledging this policy or agreeing to the Terms does not give permission for optional analytics, advertising or session replay.
MapBulk is operated by Strejaru Mihai PFA, CUI 51163290. Address: Str. Nucilor, nr. 18A. Privacy and service enquiries: support@mapbulk.com.
Our role and your customer’s role
MapBulk acts as controller for account administration, support, service security and its own website operations. For collection, imports, enrichment and storage carried out on a customer’s documented instructions, MapBulk acts as processor or subprocessor under the Data Processing Addendum. The customer acts as controller or as an authorized processor for its own client.
The role depends on who determines the purpose and means of the processing. MapBulk does not reuse customer lead records for an unrelated database, advertising audience or model training. Any new independent use requires its own lawful basis and privacy information.
Information involved
| Information | Sources and examples | Purpose |
|---|---|---|
| Account details | Name, email address, account identifier and sign-in information provided by you or your chosen sign-in provider. | Account access, administration and support. |
| Search instructions and business records | Your searches and imports, and public business names, contact details, websites, addresses, identifiers and available profile information from requested sources. | Carry out the requested collection, enrichment and export. |
| Website enrichment | Publicly listed emails, source links, supporting excerpts, capture details, mail-routing checks, website-supported context and relevant social links. | Document the information found and its source. |
| Usage and security records | Operation status, errors, access information, credit reservations and consumption, and necessary connection information. | Operate and protect the service, prevent abuse and reconcile usage. |
| Payments and subscriptions | Plan, order and subscription identifiers, payment status, amount and currency, credit allocations and expiry. Checkout information is supplied to Shopify and its payment services. | Confirm purchases, manage subscriptions and access, resolve billing issues and meet accounting obligations. MapBulk does not require full card numbers or security codes. |
| Correspondence | Messages and attachments sent to support, and information needed to verify a privacy or legal request. | Respond to enquiries and handle privacy, security and legal matters. |
| Optional measurement | Browser and device information, page interactions and advertising conversion information, as described below. | Public website analytics and advertising measurement, subject to the relevant choices. |
MapBulk is designed for ordinary business research. Sensitive personal information, children’s information and unrelated private material are outside its intended use. MapBulk is a business tool and is not intended for children under 16. If we learn that a child has created an account, we delete it. MapBulk does not provide email outreach, mailbox verification, social-network crawling or access to private content behind a login. Copies of website pages are not offered as an output or maintained as a dataset.
Local collection and cloud processing
Extension business records stay on your device while campaign sync is off. Signing in does not, by itself, upload those records. Google Maps and other sources visited through the Extension process information under their own privacy practices.
Enabling Paid sync sends the campaign’s business records to MapBulk’s cloud service. Hosted searches and submitted imports are also processed in the cloud. Where enrichment is requested, eligible public websites are checked for published emails and supporting information. Context is produced only when an email is accepted; unavailable information is not replaced with a guessed fact.
Clearing browser storage, removing a profile or uninstalling the Extension can remove local records. Account deletion does not remove files already downloaded by you or another authorized recipient.
AI search planning
Chat uses AI to prepare search settings for your review. Your instruction, the recent conversation (up to about 100 KB per request; each message is at most 20,000 characters) and current search settings are sent to OpenRouter. This can include business categories, locations, requested result counts, credit limits and relevant public catalog terms. Saved lead lists, export files and wallet balances are not included in the AI planning request.
OpenRouter routes these requests to Microsoft Azure, DeepInfra or InferenceNet for processing. The provider register identifies these services. Their processing and retention are separate from MapBulk’s retention of planning records.
Chat proposes a search; starting it requires a separate confirmation. Chat is intended for search instructions, not contact records, credentials or unrelated sensitive information. Automated checks do not detect every form of personal information. Manual search setup remains available as an alternative.
Extension data and limited use
Extension data is used for its stated collection, review, export and explicit-sync functions. Extension user data and browsing activity are not used for personalized advertising or unrelated monetization. Transfers are limited to the permitted service, security, legal and business-transfer purposes.
Access by authorized personnel is limited to permitted purposes and subject to appropriate safeguards. Handling beyond the stated functions is subject to applicable disclosure and consent requirements. Extension permissions remain limited to its stated functions.
Purposes and legal bases
Where GDPR or similar requirements apply, MapBulk processes account information to provide the requested service under a contract where the individual is the contracting party. Administration of an organization’s users may rely on legitimate interests. Service security, abuse prevention and legal claims may rely on legitimate interests, subject to the applicable balancing of rights, or on a specific legal obligation. Required accounting records are retained to meet legal obligations.
In the EEA, the UK and Switzerland, optional analytics, advertising and session replay rely on consent given in Cookie preferences. Elsewhere they rely on legitimate interests, are on by default and can be turned off there. They are not required to use MapBulk. Agreement to the Terms and acknowledgement of this policy are separate from tracking choices. A cookie choice is not permission to send marketing email.
Customers determine the lawful purpose and basis for business records processed on their instructions. They are responsible for required notices and objections. MapBulk remains responsible for its own obligations; a contractual allocation of responsibilities does not remove them.
Recipients and service providers
Information is shared with authorized personnel and service providers where needed to operate, secure and support MapBulk or deliver a requested service. The provider register identifies their functions and the information involved.
Results are returned to the customer and its authorized recipients. A customer-selected AI or MCP client receives information under that client’s own terms. Exports and copies placed in another application are outside MapBulk’s direct control.
Information may also be disclosed where required by a lawful request, to protect rights or address abuse, or as part of a business reorganization subject to applicable safeguards and notice.
Analytics, advertising and replay
With the relevant permission, Meta Pixel and Conversions API measure page views, confirmed registrations and subscription payments. PostHog measures visits to the public website. In the EEA, the UK and Switzerland, public-page session replay requires a separate choice; elsewhere it is on by default and can be turned off in Cookie preferences. Google Analytics and custom audience uploads are disabled.
Lead records, imports, email evidence, credentials and API keys are not sent to these measurement services. Public-page replay masks everything typed into fields and excludes forms and lead previews. Replay is not enabled on the authenticated Dashboard. Network bodies, headers and console recording are disabled. Hashed identifiers are not automatically anonymous. Choices and withdrawal are explained in Cookie preferences.
Retention and deletion
| Information | Retention |
|---|---|
| Local Extension records | Kept on your device until removed through product or browser controls. Downloaded files remain under your control. |
| Cloud campaigns and leads | Kept for the requested service and account lifecycle, subject to lawful deletion requests and justified retention. The relevant criteria are whether the account and campaigns remain active, deletion instructions and any legal obligation requiring particular records. |
| Cloud export files | Export artifacts expire after 24 hours. This does not delete the underlying campaign or lead records. |
| Contact-form protection records | Request and IP hashes, submission status and delivery identifiers become eligible for deletion after seven days and are removed by routine cleanup. These records do not store the message body. Delivered support messages follow the correspondence criteria below. |
| Account, support and security records | Kept for the operational or legal purpose requiring them. Retention depends on the account relationship, support matter, security investigation or applicable legal obligation. |
| Welcome-credit record | A keyed hash of the verified email address is kept, including after account deletion, only to prevent a second welcome-credit grant for the same address. It is not used for any other purpose. |
| Billing and legal records | Kept for the period required by the law applicable to the operator and transaction. Retention of an invoice does not justify keeping unrelated lead records. |
| Optional analytics and replay | Kept by the selected provider under its configured retention settings. Details and privacy requests are available through support@mapbulk.com. |
| AI planning proposals | Search settings and assistant responses, which may repeat parts of your instructions, become eligible for deletion seven days after request admission and are removed by routine cleanup. These server planning records do not keep separate copies of your original messages or submitted conversation history, or the AI provider’s unprocessed response. |
| AI planning request records | Account-linked request hashes, request and conversation identifiers, status and request times remain while your account exists to prevent repeat requests and abuse. Routine cleanup removes them after account deletion. These records are not anonymous. Provider retention is separate. |
Information is deleted or irreversibly anonymized when its retention is no longer justified. Backup copies are subject to restricted access and the applicable backup schedule. Deletion from backups follows their rotation, and required deletion restrictions apply to any restoration. Retained backups are not used to return deleted records to ordinary service.
International processing
Some providers, support activities and customer-selected recipients may process information internationally. A hosting location does not describe every processing location. Where required, transfers are subject to a valid mechanism and appropriate safeguards for the recipient and processing involved; a published privacy policy does not itself establish those safeguards.
Information about relevant processing locations and transfer safeguards is available from support@mapbulk.com.
Your rights
Depending on the applicable law and circumstances, you may request access, correction, deletion, restriction or portability of personal information; object to processing; and withdraw consent. Withdrawal does not affect processing lawfully carried out before it. Some rights are subject to legal conditions or exceptions, which we explain where applicable.
Where the GDPR applies, we respond to privacy requests without undue delay and within one month of receiving them, subject to permitted extensions and necessary identity verification. An applicable objection to direct marketing is respected. Where a customer controls a business record, we coordinate the request with that customer as appropriate; requests sent to MapBulk are not ignored.
Requests can be sent to support@mapbulk.com without purchasing a plan or opening an account. The privacy request guide explains the information needed. You may also complain to the competent supervisory authority.
California and other regional rights
Where applicable California or other US state privacy laws cover the processing, rights may include correction, an authorized representative, appeal of a refusal and opting out of sale, sharing for cross-context behavioral advertising or certain profiling. Protected rights may be exercised without unlawful discrimination.
Advertising disclosures can qualify as sharing even without payment. Global Privacy Control disables marketing and session replay, even after an earlier permission. Outside the EEA, the UK and Switzerland, analytics, marketing and replay are on by default and can be turned off in Cookie preferences. Applicable opt-out, deletion and registration obligations continue to apply.
Changes and contact
This policy carries its last-updated date above. Material changes are communicated with the notice required by applicable law. A policy update does not provide consent for a new tracking purpose.
Privacy enquiries and requests can be sent to support@mapbulk.com or to the operator at the address in Who this notice is for.
Cookies & tracking technologies
Cookies and browser storage
Cookie preferences lets you accept, reject or separately enable analytics, marketing and session replay. In the EEA, the UK and Switzerland, optional measurement begins only after its purpose is enabled. Elsewhere it is on by default until you turn it off. Storage needed for sign-in, security and requested product functions is separate from those choices.
Open cookie preferences on mapbulk.com
In the EEA, the UK and Switzerland, accepting the Terms, acknowledging this policy, signing in or continuing to browse does not give permission for optional tracking.
Cookies and similar technologies
MapBulk uses cookies, local and session storage, pixels and related identifiers for the purposes described here. Server-side measurement can also involve personal information. Hashing or the absence of a cookie does not, by itself, make information anonymous.
Your choices
| Category | Purpose | Control |
|---|---|---|
| Necessary | Sign-in, security and requested product functions. | Used where needed for the requested function. |
| Analytics | PostHog measurement of public website visits. | EEA, UK and Switzerland: off until analytics consent. Elsewhere: on by default. Google Analytics is disabled. |
| Marketing | Meta Pixel and server-side advertising measurement. | EEA, UK and Switzerland: off until marketing consent. Elsewhere: on by default. Global Privacy Control disables this purpose. |
| Session replay | Masked recordings of public-page interactions. | EEA, UK and Switzerland: off until separate replay consent; analytics consent is also required. Elsewhere: on by default. Global Privacy Control disables this purpose. |
Rejecting optional tracking turns these purposes off. Save choices applies the selected purposes. Consent can be withdrawn through Cookie preferences.
Storage and duration
| Storage | Purpose | Duration and control |
|---|---|---|
| Anonymous homepage sample | A browser identifier links the requested preview to the three-sample allowance and carries a selected list through signup. | The allowance does not reset daily. Clearing browser storage does not delete server records or guarantee a new allowance. |
| Authentication | Restores the account session and supports sign-in. | Sign-out clears the local session. Access tokens expire and may be renewed while the session remains valid. |
| Extension records | Stores local campaigns, results, progress and pending sync acknowledgements. | Persists across browser restarts until removed through product or browser controls. Downloaded exports are separate. |
| Chat recovery | May hold search instructions, conversation history and reviewed search settings in this browser so you can continue after a reload. | This local session storage is separate from server planning receipts. Clearing browser storage removes the local copy. |
| Cookie preferences | Stores the chosen optional purposes across MapBulk subdomains. | Up to 180 days; browser settings may shorten this period. |
PostHog browser persistence is configured for up to 180 days. Meta manages its advertising cookies. Provider-side event retention is separate from browser storage.
Measurement safeguards
Optional measurement can involve public page paths, browser and device information, IP addresses and cookie or event identifiers. Confirmed subscription conversions can include amount and currency. Card details, lead records, imports, email evidence, credentials and API keys are not included. Replay masks typed input and excludes forms and lead previews; custom audience uploads are disabled.
Browser controls and privacy requests
Removing cookies or browser storage may sign you out or remove local Extension work and pending recovery data. It does not delete server-held account or campaign records. Account controls and support@mapbulk.com are available for those requests.
Privacy signals and withdrawal
Global Privacy Control disables marketing and session replay. Analytics follows its separate choice. Withdrawal stops future optional capture in this browser. Account-wide requests and requests concerning information already sent can be directed to support@mapbulk.com.
Making a privacy request
Contact
Send a privacy request to support@mapbulk.com or through the Contact form. Include enough information to identify the account, business record or processing concerned.
Account information
Account controls support sign-out and deletion. Access, correction, a copy of qualifying personal information, restriction and other applicable rights can also be requested through support. A product export is different from a statutory privacy request.
Deletion removes access and service data under the applicable lifecycle. Records required for legal obligations or claims may remain. It does not erase browser files or exports already held by you.
Information in a business record
No account or purchase is required to raise a concern about a business record. Identify the business or website, the personal field concerned, its source if known, and the correction or action requested.
For records controlled by a customer, MapBulk assists and coordinates with that customer. For processing controlled by MapBulk, we assess the request directly. Request handling protects other individuals’ information and confidential customer records.
Website and other rights
Reports concerning website content, copyright, database rights or a source restriction can be sent to support@mapbulk.com. Identify the affected material, the rights or authority relied on and the requested action. The response depends on the activity, our role and applicable law.
Information needed
- A contact method and whether you act for yourself or an authorized representative.
- An account reference or public business or website identifier.
- The information or activity concerned and the requested action.
- Enough detail to locate the issue without sending unrelated personal records.
Verification is limited to information reasonably needed to confirm identity or authority. Passwords, API keys and full card details are not required. Government identification is requested only where necessary through an appropriate secure channel.
Response and follow-up
Applicable law determines response periods and exceptions. Where the GDPR applies, we respond without undue delay and within one month of receiving the request. If a permitted extension is necessary, we explain the reasons within that month. Other jurisdictions may provide different response or appeal rules. We keep a record of the request and response and make recipient notifications where required.
Correction or deletion may require coordination with recipients. Where retention is legally required, we explain the basis and restrict other uses where required. Exported files outside our control may need to be addressed with the recipient.
Tracking choices and complaints
Cookie preferences controls future optional capture in this browser; it does not submit an account-wide deletion request. Privacy concerns may be raised with MapBulk or a competent supervisory authority. MapBulk is established in Romania; complaints may be made to ANSPDCP or another competent authority under the applicable law.
Providers & subprocessors
How providers are used
These providers support the functions described below. Their role depends on the service and information involved. Google sign-in and customer-selected AI or MCP clients can also process information under their own terms.
Service providers
| Provider | Function | Information involved |
|---|---|---|
| Netcup | Hosts cloud application services, campaigns and export files. | Customer-requested business records and application information. |
| Supabase | Account sign-in and authentication. | Account identity and sign-in information. |
| Cloudflare | Website delivery, protective networking and Turnstile verification. | Technical information needed for those functions. |
| OpenAI / ChatGPT Sites | Publishes and hosts the public MapBulk website. | Public website content and technical publishing and delivery information. |
| Webshare / network proxy services | Connectivity to requested public sources. | Information needed to connect to those sources. |
| Google sign-in and customer-selected AI/MCP clients | User-selected sign-in or external client services. | Information needed for the selected function. |
| Postmark | Delivers transactional emails, recovery and security messages, and contact-form requests. | Message content, recipient details and delivery information. |
| Contabo / Mailcow | Hosts support mailboxes and incoming mail. Mailcow is mail-server software. | Support correspondence and mailbox information. |
| Shopify / Shopify Payments | Checkout, payment processing and order records. | Account, purchase and subscription information. |
| Seal Subscriptions | Subscription contracts, billing schedules and the Shopify subscription portal. | Account, purchase and subscription information. |
| OpenRouter, Inc. | Routes Chat search-planning requests. | Search instructions, the recent conversation (up to about 100 KB per request), proposed search settings, relevant public catalog terms and technical request information. Provider privacy policy. |
| Microsoft Azure | Processes Chat search-planning requests routed by OpenRouter. | The planning information sent through OpenRouter, under the applicable service arrangements. Azure data privacy documentation. |
| DeepInfra | Processes Chat search-planning requests routed by OpenRouter. | The planning information sent through OpenRouter, under the applicable service arrangements. Provider privacy policy. |
| InferenceNet | Processes Chat search-planning requests routed by OpenRouter. | The planning information sent through OpenRouter, under the applicable service arrangements. Provider privacy policy. |
Optional measurement services
| Provider | Purpose | Status |
|---|---|---|
| Google Analytics | Website measurement. | Disabled; no analytics information is sent. |
| Meta Pixel | Advertising measurement. | EEA, UK and Switzerland: only after marketing consent. Elsewhere: on by default. |
| Meta Conversions API | Server-side advertising measurement. | Conversion events follow the marketing choice; custom audience uploads are disabled. |
| PostHog analytics | Public website analytics. | EEA, UK and Switzerland: only after analytics consent. Elsewhere: on by default. |
| PostHog session replay | Public-page usability measurement. | EEA, UK and Switzerland: separate replay consent. Elsewhere: on by default. Typed input masked, forms and lead previews excluded, autocapture disabled. |
These services are controlled by Cookie preferences. Refusing them does not prevent use of MapBulk.
Provider changes and transfers
MapBulk informs affected customers in advance of intended subprocessor additions or replacements and allows a reasonable opportunity to object on data-protection grounds. Objections can be sent to support@mapbulk.com.
Processing-location and transfer-safeguard information is available from support. The Data Processing Addendum governs customer-directed processing.
See also: Terms of Service