Privacy notice

Draft updated 19 October 2026

This notice explains how this version of Mapped Steps handles personal information when you use an account, create a workflow, contribute steps, request an email export, or generate an AI procedure draft. Some features work only after the operator connects the relevant services.

Read this with our Terms of use, Data processing terms, and Browser storage notice. A privacy notice does not take away your legal rights.

1. Who is responsible for your information?

For account administration, running and protecting the service, handling enquiries, and managing its own product-update preferences, the service operator generally decides why and how personal information is used. Where data protection law applies, that normally makes the operator a controller.

When a business uses Mapped Steps to collect or record information about its staff, customers, or other people, that business normally decides the purpose and content of its workflows and step requests. It is normally the controller of that content, and the service operator processes it on the business’s instructions. The exact roles depend on the actual use and the applicable law; the Data processing terms explain the proposed customer-content arrangements.

2. Information we receive and where it comes from

• Account information: your account identifier, verified email address, and profile information returned through the Microsoft, Google or Apple sign-in you choose, or your email/password registration. An Apple email address may be a private relay address. We use Supabase Auth to manage sign-in. We do not receive your Microsoft, Google or Apple password. For email/password accounts, the browser sends your password directly to Supabase Auth; it is not stored in application profiles or workflows. Supabase also handles confirmation and password-reset messages through its configured email provider.
• Workspace information: the display name and workspace names you enter, workspace memberships and permission levels, invitation email addresses and their creation, expiry, acceptance or revocation records, your product-update choice, and records of changes to that choice.
• Workflow content: titles, actions, systems, people or roles, decision routes, SOP text, archive status, saved versions, and related timestamps. This comes from you, backups you import, invited contributors, or drafts you choose to generate. Content can contain information about other people.
• Guest contributions: the contributor name entered on the form, their steps, associated request and submission identifiers, submission time, and whether a piece is pending, placed, or dismissed. Guest contributors do not create an account or supply an email address through this form.
• Email export information: the email address you enter, verification and delivery records, your product-update choice, and the workflow you ask to send.
• Security and technical information: network and request information needed by hosting, authentication, and verification services. The application stores keyed hashes derived from network addresses to limit repeated email and AI requests, plus request counts, times, and verification-attempt records. These identifiers are pseudonymous; hashing does not make all related information anonymous.
• Enquiries: information you provide when you contact the operator or ask to exercise a right.

Provide only the information needed to describe the process. Use job roles instead of people’s full names where possible. Do not enter passwords, access tokens, payment-card details, or sensitive personal information into workflows or contribution forms. The suitability of this service for higher-risk or regulated information has not been established.

3. Why information is used

Information is used to create and authenticate accounts; save, restore, display, and delete workflows; collect and place submitted steps; provide the exports and optional drafting tools you request; manage preferences and enquiries; and limit misuse of the service.

Where UK or EU data protection law applies and the operator acts as controller, account and requested service processing may be necessary to perform a contract with you, or to take steps at your request before one. Necessary security, abuse prevention, and service administration may rely on legitimate interests, subject to an appropriate assessment and your rights. Processing required by law relies on the relevant legal obligation. Optional product marketing relies on an affirmative choice where consent is required. The operator must confirm and record the applicable lawful basis for each purpose before public launch.

For customer-controlled workflow content, the customer must identify its own lawful basis, give any required notices, and issue lawful processing instructions. Providing the service does not mean every person named in a workflow has consented to it.

Account sign-in and saving require the account information described above. The sample workspace can be used without creating an account. Email exports require access to the destination inbox; AI drafting is optional. If you do not provide a required field, the corresponding feature may not work.

4. Steps collected through a link

Anyone holding a valid contribution link can see the workflow title, request label, and instructions, and can submit steps. Share links only with intended contributors, and keep confidential information out of the title and brief. A link is not proof of a contributor’s identity.

The link does not give access to the master workflow or other submissions. Members of the requesting workspace can see the contributor name and submitted steps. Owners, admins and editors can decide where to place them; members can export the resulting workflow. The token is placed in the link’s fragment and sent by the form to the account database; only its hash is stored in the request record.

Owners can revoke a link, and links expire. Revocation or expiry stops further access through that link; it does not erase information already submitted. Placing or dismissing a piece changes its status and does not delete its source record. Contact the requesting owner first about the use, correction, or removal of your contribution. If necessary, the service operator can assist the customer with an appropriate request.

5. Email exports

When you ask to email a workflow to yourself, we send a verification code to the address you enter. After successful verification, the application sends the address and workflow to Resend for delivery. The message includes workflow text, an SVG diagram, an editable JSON backup, and an SOP attachment if the workflow contains one. Cloudflare processes the request and stores verification, contact, and preference records; the application does not store workflow content in its email-record database.

Anyone with access to the receiving inbox or a forwarded or downloaded copy may be able to read the content. Deleting it from Mapped Steps does not recall delivered messages or remove copies held by recipients, their email services, or other people. Check the recipient address and the content before sending.

6. Optional AI procedure drafts

Choosing AI generation sends the workflow title and steps, including people or roles, systems, sequence, and decision routes, to Cloudflare Workers AI. The configured model generates a draft procedure. The default application configuration uses a Meta Llama model through Cloudflare; the operator can change the configured model.

The application does not send a workflow for AI generation until you request it. The structured draft option works without AI. Generated text is editable and is saved with your workflow in the browser and, when account synchronisation is enabled, in your account library. The application’s AI rate-limit records contain request identifiers, times, and a keyed network-address hash, rather than the prompt or generated procedure.

The operator has not yet confirmed the production AI agreement, processing locations, provider logging, retention, or any model-training restrictions. No promise about those arrangements is made in this draft. Do not send confidential or personal information for AI processing unless your organisation has authorised that use and the required provider arrangements have been verified. Drafts require human review; the service does not use them to make decisions about people automatically.

7. Service providers and other recipients

• Cloudflare: application hosting and network security; its D1 database for email and AI request records; Turnstile verification for public email and AI forms; and Workers AI when AI generation is requested. Turnstile receives verification information, including the network address supplied with the server-side check.
• Supabase: account authentication, provider identities, account profiles, workflows, saved versions, requests, and contributions.
• Microsoft, Google or Apple: the identity provider you select for sign-in, under its own account and privacy arrangements. Supabase’s configured email service also processes confirmation and password-reset emails for email accounts.
• Resend and the receiving email services: email delivery and the content you ask to send.
• The requesting workspace’s authorised members and export recipients: the content submitted or sent to them as described above.

If you access the private preview through ChatGPT/Sites, the platform also handles access and hosting-related information under its own privacy arrangements. This is separate from a deployment in the operator’s Cloudflare account.

Fonts are served from the application’s own origin; the application does not automatically connect to Google Fonts. Authorised operator personnel may need access to administer the service, investigate an issue, or respond to a lawful request. Information may also need to be disclosed to professional advisers, regulators, or public authorities where necessary and lawful. This version contains no advertising, audience-analytics, or marketing-campaign delivery integration.

Providers may keep operational, security, delivery, and backup records under their applicable arrangements. The absence of application-level content logging is not a promise that providers keep no logs. The final provider and subprocessor list, agreements, and access arrangements must be checked before public launch.

8. Storage, access, and international processing

Account content is stored in the configured Supabase project. The application applies workspace membership and permission controls. All members of a workspace can read its documents, saved versions and submitted steps and can export content. Owners and admins manage permitted team access, and editors can change content. Viewers cannot edit. There are no separate per-document permissions within a workspace. Removing a member stops further database access but cannot recall copies they already received. Access controls do not exclude necessary processing by authorised service administrators and providers.

The application is not end-to-end encrypted. It keeps workflow content in browser storage to preserve device copies and unsent changes. These caches are separated by account and workspace identifiers but are not encrypted by the application and currently remain on the device after sign-out. Someone with access to your browser profile or device may be able to read them. Avoid using a shared browser for confidential work, and read the Browser storage notice before clearing site data.

The connected Supabase project is configured in eu-west-1 (Ireland). Other provider processing locations, international support access, and transfer arrangements have not been confirmed. Do not assume that all information stays in your country. Where UK or EU rules restrict international transfers, the operator and customer must confirm an applicable adequacy decision or appropriate safeguards, such as the relevant contractual terms, and any required assessments or additional measures before processing starts. The final notice must identify the applicable arrangements and explain how to obtain information about them.

9. How long information is kept

• Accounts, profiles, and active or archived workflows: no automatic age-based deletion is implemented. They remain until deleted through an available control or by the operator. The operator must set a justified retention and inactive-account plan before public launch; this is not a promise to retain information indefinitely.
• Workflow history: the latest 50 saved versions per workflow are retained. Older revisions are removed as new ones are saved. Archiving does not delete a workflow or its history.
• Workspace memberships and invitations: memberships remain until removal or workspace/account deletion. Invitations expire after seven days and can be revoked or accepted once using the invited verified email address. Expiry or revocation does not delete the invitation record; there is no age-based cleanup yet. Only a hash of the invitation token is stored in the database.
• Requests and guest contributions: there is no automatic age-based cleanup. Link expiry, revocation, placement, and dismissal do not delete existing records. Deleting the workflow removes its database request and contribution records as well as its saved history.
• Email verification: codes are valid for 15 minutes. Records become eligible for application cleanup 24 hours after expiry. With the configured daily task running, removal normally occurs 24–48 hours after expiry; deployment or maintenance failures can delay it.
• AI request-limit records: records become eligible for cleanup 48 hours after creation. With the daily task running, removal normally occurs after 48–72 hours; failures can delay it.
• Verified email contacts and consent histories: no automatic age-based deletion is implemented. Records currently remain until the operator removes them. A proportionate retention plan, including any limited records needed to honour an objection or demonstrate consent, still needs to be agreed.
• Browser copies: no automatic expiry is implemented for workflow caches. They remain until removed or overwritten, or until the browser clears site data. View-only sessions do not write a new persistent workflow cache. Previously cached copies from editing sessions may remain. The sample workspace is stored on the device and is copied to an account only if you choose to import it.
• Provider logs, backups, support records, and delivered email: the production retention and deletion arrangements are not yet confirmed. These can have separate deletion cycles; a database deletion does not establish immediate removal from every backup or recipient system.

10. Product updates and your choices

Product updates are optional and the sign-up and email-export checkboxes are off by default. You can create a workspace or request a transactional export without agreeing to marketing. This application does not currently send marketing campaigns.

The account preference and verified-export email preference are currently separate records. Changing the preference in your account changes the account record only. The unsubscribe link in an export email changes the email-export contact record only. They are not synchronised, so neither control should be treated as a universal preference across both records. Until a combined suppression process is implemented, contact the operator to apply an objection across all records. Withdrawing a choice does not affect processing that was lawful before withdrawal, or necessary service messages.

11. Access, correction, deletion, and other rights

Depending on the law that applies and the circumstances, you may have rights to information, access, correction, erasure, restriction, portability, objection, and withdrawal of consent. Some requests are subject to legal exceptions. Where UK or EU data protection law applies and we rely on legitimate interests, you can object on grounds relating to your situation; the applicable legal exceptions may affect the outcome. You can always object to direct marketing.

Members can export a workflow as JSON. Workspace owners and admins can delete an individual workflow through Workflow settings. Deleting a workflow removes its live account record, saved versions, requests, and contributions. Removing a step from the current workflow alone does not remove previous saved versions or the original contribution record.

Account deletion is currently handled by the operator rather than a self-service button. Deleting an authentication user removes their linked application profile, memberships and account-consent history. It also deletes every workspace they own and its workflows, versions, requests and contributions, including content shared with colleagues. Deleting a non-owner member does not delete the workspace’s shared documents. The operator must assess the customer’s instructions and other members’ needs before deleting an owner account. Email-export records, provider-held records, backups, other browser copies, and delivered exports need to be considered separately. Clearing browser data does not delete a cloud account. Other open or offline tabs may still hold copies of work.

For customer-controlled information, ask the business or workflow owner responsible for it first. The operator should assist that customer with an appropriate request. For the operator’s own processing, use the monitored privacy contact that must be added above. A proportionate identity check may be needed, and you should not send unnecessary identity documents or sensitive information.

Where UK law applies, requests normally require a response within one month, subject to permitted extensions and applicable exceptions. You can complain to the Information Commissioner’s Office. Where EU law applies, you can complain to the relevant supervisory authority, including in the country where you live or work or where the alleged infringement occurred. Other local complaint and privacy rights may also apply. Contacting us first does not remove your right to complain.

Where UK law applies, you can raise a data-protection complaint using the operator contact above once it is supplied. The operator must acknowledge it within 30 days, investigate appropriately, keep you informed and provide an outcome without undue delay. That complaint process is separate from the usual time limit for a rights request and does not prevent you contacting the ICO.

12. Changes and public-launch status

This draft must be completed against the actual operator, users, locations, provider contracts, and production configuration. Material changes to purposes, providers, or data handling should be explained before they take effect, with a new choice obtained where the law requires it. A dated notice alone does not authorise a new use of information.

Guidance: ICO guidance on privacy information · ICO complaints.