Privacy Policy
Last updated: 30 September 2026
1. Who we are
Northmap is operated by Northmap SAS ("we", "us"), a société par actions simplifiée registered under RCS Lyon 109 480 525, head office at 12 rue de la Part-Dieu, 69003 Lyon, France. This policy explains how we process personal data on our website northmap.ai and in the Northmap service at app.ilyas.ai.
Contact for any privacy question or request: contact@northmap.ai.
2. Our two roles
As controller, we decide how personal data is used for our website, for managing user accounts, and for our relationship with customers and prospects. This policy covers that data.
As processor, we process the content our customers put into Northmap (for example requirements, evaluations, documents, meeting notes and vendor correspondence) only on their instructions. That processing is governed by our Data Processing Agreement, and the customer's own privacy notice applies to it. If your data is in a customer's workspace, contact that customer first; we will help them answer your request.
3. The data we collect
- Account data: name, business email, organisation, role, and authentication and session data.
- Usage and technical data: IP address, browser and device type, pages and features used, and audit records of actions in the service (user identifier, action, timestamp).
- Website analytics: pages visited, referring page and approximate location derived from the IP address.
- Communications: the content of emails, meeting bookings, support requests and feedback you send us.
We do not ask for special categories of personal data.
4. Why we use it and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and managing accounts, providing the service, support | Performance of a contract |
| Security, fraud prevention and audit records | Legitimate interests (protecting the service and our customers) |
| Measuring website audience and improving the service | Legitimate interests |
| Replying to prospects and sending product updates to business contacts | Legitimate interests. You can opt out at any time. |
| Invoicing, accounting and responding to authorities | Legal obligation |
We do not sell personal data and we do not use it for advertising.
5. AI features
Northmap uses AI models on Google Vertex AI, hosted in the European Union (Belgium, europe-west1), to draft, score, summarise and search content. We do not use customer content or personal data to train AI models, and under Google Cloud's terms Google does not use it to train its models either. If your organisation connects its own AI provider, content is sent to that provider under your organisation's agreement with it.
6. Who we share data with
- Service providers that host and run Northmap, such as cloud hosting, authentication and email delivery.
- An EU-hosted analytics provider, for website audience measurement.
- Our scheduling tool, when you book a meeting with us.
- Professional advisers and authorities, when the law requires it or to defend our rights.
- A buyer or successor, if all or part of our business is sold or merged, under the same protections.
7. Where the data is stored
The Northmap service and its data are hosted in the European Union. Some of our service providers are based in the United States and may process data there. For those transfers we rely on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
8. How long we keep it
- Account data: while the account is active, then deleted or anonymised, unless the law requires us to keep it.
- Customer content: as instructed by the customer, under the Data Processing Agreement.
- Prospect data: up to 3 years after our last contact.
- Invoices and accounting records: 10 years, as required by the French Commercial Code.
- Security logs and analytics data: only as long as needed for those purposes.
9. Cookies
On app.ilyas.ai we use only strictly necessary cookies, for sign-in and security. On northmap.ai we measure audience without cookies: nothing is stored on your device, so we cannot recognise you across visits. We do not use advertising cookies. If you block cookies in your browser, the website still works, but you cannot sign in to the service.
10. Security
We protect personal data with encryption in transit and at rest, tenant isolation, access control and logging. See our Security page for details.
11. Your rights
Under the GDPR you can ask to access, correct or delete your personal data, restrict or object to its processing, and receive it in a portable format. Write to contact@northmap.ai; we reply within one month. You can also complain to the French data protection authority, the CNIL (3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr).
12. Children
Northmap is a service for businesses and is not directed at children.
13. Changes
We may update this policy. We publish every change on this page with a new date, and we notify customer account administrators by email of material changes.