← Back to map

Privacy Policy / 개인정보 처리방침

Version 1.2 · Effective 2026-08-10

A Piece of Map Inc. operates the APiM Galaxy connector and website. This policy explains what we collect, why, who else sees it, and what you can do about it.

  • Data Protection Officer / 개인정보 보호책임자: Bo Kyung Choi (최보경), navigate@apieceofmap.com
  • Address: 4,5F 117 Bundangnaegok-ro, Bundang-gu, Seongnam-si, Gyeonggi-do 13529, Republic of Korea

1. What we collect

You give us:

DataWhy
Email addressAccount identity, service email, billing
NameYour profile, and how we address you
Company namePersonalizing your results
Your saved profile (Pro)The company you sell for, what you are trying to sell and to whom, what makes you different, the customers you name as references, deal size, timeline, constraints, and who decides. We keep it so your reports do not start from zero. It may therefore contain information about other companies and the people who work at them.
Your saved reports (Pro)The reports you choose to save — target companies, cited sources, and the approach routes we suggest. Your own AI assistant writes these reports, so they may also mention other companies and the people who work at them.
Your free-report request (no account needed)Your name, email, company name, website, your question, and the report language. We use them to generate and deliver the report you asked for, and to keep the same email address from requesting one repeatedly.
Free report generationWe run APiM Galaxy ourselves on the information you provide, and deliver the finished report. It may mention third parties, such as other companies and their personnel.
The link to your free reportYour report opens from its link alone, with no sign-in. The link address is a long randomly generated string — it cannot be found by search or guessed, and it contains no name, email, or company information. Anyone who has the link can view the report. The link expires 14 days after the report is generated, and the report stored with us is deleted at the same time.
Brand logo and colours (Pro)Applied to the reports you generate. Your logo file is served from a public URL with an unguessable address, so that anyone you share a web report with can see it in the report. It is not listed or browsable — the address cannot be discovered or guessed, and it does not contain your account identifier. Anyone you give a report link to can view that logo image. We delete the file when you delete your account or when your Pro access ends.

We automatically collect: your IP address, browser and device type, pages visited, and product-usage events (which connector tool ran, when, and from which AI host). We do not record your questions, your prompts, or the arguments you pass to our tools. The one exception is our free-report form: the question you type there is what your report answers, so we keep it, and we delete it on the schedule in §5.

When you sign in with Google we receive your name, email address and profile picture. We never receive your password and do not touch your contacts, files, or calendar.

We do not collect: sensitive data (such as race, religion, health, or sexual orientation), biometric data, or card details. We do not track you across other websites.

2. Why we use it, and on what basis

PurposeBasis
Provide and maintain the ServicePerformance of the contract (GDPR Art. 6(1)(b))
Process subscription paymentsPerformance of the contract
Service and account emailPerformance of the contract
Security and abuse preventionLegitimate interest (Art. 6(1)(f))
Product analytics — understanding which features are usedLegitimate interest (Art. 6(1)(f)). You may object at any time: navigate@apieceofmap.com
Generating and sending your free reportPerformance of the service you requested (GDPR Art. 6(1)(b))
Marketing email and newsletterMarketing email and the newsletter are sent with your consent. You can withdraw it at any time in Account settings, or from the unsubscribe link at the foot of any newsletter.

You can object to marketing at any time — in Account settings, or by replying to any email. We stop immediately. You can also object to our product analytics, and the rest of the Service keeps working.

We never sell your personal data, use it to train AI models, share it with advertisers, or build advertising profiles.

3. Who else sees it

WhoWhat reaches them
The AI assistant you connect (e.g. Anthropic's Claude, OpenAI's ChatGPT)Everything you type there, and the tool results we return. That assistant is not ours: its own privacy policy governs it. Connect the one you already trust.
Paddle (Paddle.com Market Ltd (UK), Paddle.com Inc. (US), Paddle Payments Ltd (Ireland), Paddle.com Canada Ltd)Payment and billing. Paddle is the Merchant of Record and an independent controller of the card and billing data it collects from you directly; Paddle's privacy policy applies to that data in addition to this one.
SupabaseOur database, authentication, and file storage (Seoul region)
Google CloudOur backend hosting and server logs
VercelOur website hosting
Google (Gemini / Vertex AI)Content generation for our Galaxy web product and our data pipeline. Your data is contractually excluded from model training.
Anthropic (Claude API)We use Anthropic to generate the free report you asked for. Your data is contractually excluded from model training.
Google (reCAPTCHA)Abuse protection on our contact and sign-up forms
PostHog (EU-hosted, eu.i.posthog.com)Product analytics
ResendOur service email
GhostOur newsletter — only if you have consented
The websites we citeTo check a relationship against its source, our server fetches the cited page. Those publishers see our server's request, not you.

We do not share your data with anyone else — no advertising networks, no data brokers.

4. Sending data abroad

Some of the services above are outside Korea. 개인정보 보호법 제28조의8 requires us to tell you five things about that, so here they are:

What we transferYour account data (email, name, company), what you save (your profile, reports, and logo), usage events, and server logs are transferred. If you use the free-report form, your name, email, company name, website, and question are transferred as well.
Where, when, and howData is transferred to the United States (Google Cloud, Google LLC, Anthropic PBC, Resend, and Paddle's US entities) and to the EEA and the United Kingdom (PostHog, and Paddle's UK and Ireland entities), continuously and over an encrypted network connection as you use the Service. Free-report request data goes only to Google Cloud, Anthropic PBC, and Resend (all in the US) among these.
Who receives itThe companies named in §3, at the contact details published in their own privacy policies
Why they have it, and for how longOnly to provide the part of the Service they run for us — hosting, payment, email, analytics — and only for as long as we keep the data under §5
How to refuse, and what happensEmail navigate@apieceofmap.com. We cannot run the Service without hosting and payment, so refusing those means closing your account; you can refuse analytics and marketing on their own, and the rest of the Service keeps working

Transfers to the EEA rely on the European Commission's adequacy decision for the Republic of Korea of 17 December 2021. Transfers to Google LLC and Anthropic PBC (US) rely on Standard Contractual Clauses.

5. How long we keep it

DataKept
Your account and profileWhile the account exists. Deleted immediately when you delete your account.
Your saved profile, saved reports, and uploaded brand logo (Pro)While you have Pro access. Permanently deleted when your Pro access ends — whether your subscription ends, or a complimentary Pro grant expires. If a payment fails, we keep them while our payment provider retries the payment, so you do not lose your work over a card that needs updating; if every retry fails, they are permanently deleted (Terms §4.6).
Free-trial record — a one-way keyed hash of the email address of anyone who has started a free trial. No name, no profile.For as long as the one-trial-per-account rule applies
Usage events — which tool ran, and when. Never the content of your work.Kept as long-term product metrics. When you delete your account we overwrite the account identifier on these records with a random value, so they can no longer be traced back to you.
Subscription and purchase records — the customer and transaction identifiers our payment provider gives us, the plan or item purchased, and your subscription status and dates. No card details. No invoices, no amounts, no tax records. We keep these to know what you are entitled to, and so a repeated webhook does not charge or credit you twice.5 years from the transaction. Korean law requires a business to preserve records of payment and of the supply of goods or services for 5 years (Act on Consumer Protection in Electronic Commerce, Article 6 and its Enforcement Decree, Article 6). This is the one thing that outlives your account: when you delete your account we detach these records from your profile and keep only the identifiers and dates, so that a payment dispute can still be resolved. They are deleted at the end of the 5 years.
Server logs90 days
Your free-report request — name, email, company name, website, question, and report languageWe keep it for 90 days from submission, then delete it. It is kept for technical support and to tell which channel the request came from. The report generation record is deleted at the same time.
The free report we generate for youThe free PDF report is yours to download and keep. The report stored with us, and its web link, are deleted 14 days after it is generated.
Free-report record — a one-way keyed hash of the email. It contains no name, question, or report.We keep it for as long as the one-free-report-per-email rule applies.
Payment records (card details, invoices, amounts, tax records)Held by Paddle, our Merchant of Record and an independent controller. We never see or store your card details. Paddle keeps transaction and tax records under its own obligations, and deleting your APiM Galaxy account does not delete them.

When a retention period ends or its purpose is met, we destroy the data without undue delay: electronic files are deleted by means that prevent recovery; paper is shredded.

6. Your rights

RightGDPRPIPAHow
AccessArt. 15제35조Account settings shows your account and your saved profile at any time. For a copy of anything else we hold — including your saved reports — email navigate@apieceofmap.com. We reply within 10 days.
RectificationArt. 16제36조navigate@apieceofmap.com
ErasureArt. 17제36조Delete your account in Account settings — immediate. Or email navigate@apieceofmap.com and we act without undue delay.
PortabilityArt. 20— (see note)navigate@apieceofmap.com — we send your data in a structured, machine-readable file
ObjectArt. 21—navigate@apieceofmap.com — for anything we do on legitimate interest, including analytics
Withdraw consentArt. 7(3)제37조Account settings, or email us

A note on data portability under PIPA. Korea's right to require transmission of personal data (제35조의2) is owed only by a controller that the Presidential Decree designates. The Decree (Enforcement Decree, Article 42-2) designates healthcare, telecommunications and energy bodies — a national disease-control agency, health-insurance bodies, tertiary hospitals, licensed mobile carriers and common telecommunications operators, electricity retailers and city-gas suppliers. We are in none of those sectors, so 제35조의2 does not apply to us. We honour portability requests anyway — under GDPR Art. 20 where it applies, and as a matter of policy for everyone else.

To file a complaint: contact your local Data Protection Authority in the EEA, or the Personal Information Protection Commission (pipc.go.kr) in Korea.

7. Cookies

We use cookies only to keep you signed in and to keep the Service secure. Our product analytics does not place a cookie or any other persistent identifier on your device. We never use cookies for cross-site advertising.

8. Changes

We will post updates here and refresh the effective date. For material changes, we will email registered users, and the changes will take effect 14 days later.