Mapify

GDPR overview

The privacy notice, last updated 24 January 2025, devotes a dedicated section to users in the EU and the UK and names the legal bases it relies on under the GDPR and UK GDPR: consent, legitimate interests, legal obligations and vital interests. It lists rights of access and copy, rectification, erasure, restriction, portability and objection, the right to withdraw consent, and the right to complain to a member state supervisory authority, the UK ICO or the Swiss federal commissioner. Concrete gaps remain: no Article 27 EU representative is designated, no data protection officer is named, hi@mapify.so is the only contact, and there is no DPA, no subprocessor list, no standard contractual clauses and no statement on international transfers. The pricing page claims ISO/IEC 27001:2022 certification. The site never uses the words GDPR compliant.

Who owns the data?

Under the Terms of Use, SUPERMIND PTE. LIMITED owns or licenses everything that makes up the service: source code, databases, designs, text, graphics, trademarks and logos. Anything you send the company as a question, suggestion, idea or piece of feedback, which the terms call a Submission, is assigned to it outright, for unrestricted use and without compensation. Content you post through the service, called a Contribution, carries a worldwide, perpetual, irrevocable, royalty-free and sublicensable licence extending to your name, image and voice. Section 19 keeps some transmitted data for performance management while leaving you solely responsible for it. Notably, the terms never state that you keep ownership of the files you upload or of the mind maps generated from them.

Reuse rights

The licence granted to you is narrow: non-exclusive, non-transferable and revocable, covering access to the service and the download or printing of portions of its content, solely for personal, non-commercial use. Anything beyond that, whether copying, reproducing, aggregating, republishing, publicly displaying, translating, distributing, selling or licensing any part of the service, its content or its marks, requires the express prior written permission of SUPERMIND PTE. LIMITED, and where permission is granted you must credit the company as owner or licensor and keep its copyright notice visible. Nothing in the terms restricts what you do with the mind maps you build from your own files: the product itself invites export to PDF, image, SVG, Markdown, XMind and slides, together with read-only link sharing.

Data retention & training

Hosting summary

Mapify publishes nothing about where user data is stored. Neither the privacy notice, nor the terms, nor the pricing page names a hosting country, a region or a cloud provider, and there is no trust or security page. The publisher, SUPERMIND PTE. LIMITED, gives Singapore as its postal contact, which places the controller under Singapore law but says nothing about where processing happens. Two processors are named in passing rather than in a formal list: Stripe holds all payment data, and OpenAI and Anthropic supply the language models used to deliver requested features. The privacy notice commits only to appropriate and reasonable technical and organisational measures, with the usual caveat that no transmission can be guaranteed secure, while the pricing page claims ISO/IEC 27001:2022 certification without naming a certification body. No data processing agreement, no subprocessor list, no standard contractual clauses and no international transfer statement are published. As a technical observation with no contractual value, the domain resolves to an Amazon Web Services node in Tokyo, Japan, which is an infrastructure fact rather than a residency commitment.