Privacy

What Map MGT holds about the people who use it. Compiled from the application source; every statement below is verifiable in the code.

Map MGT is an internal team platform, not a consumer product. Accounts are created by staff and must be approved by an administrator before they can sign in. There is no public sign-up that grants access.

What is stored about your account

When you register, the application stores:

Field	Notes
username, email	As you entered them. The email is lower-cased and must be unique.
password_hash, password_salt	Your password is never stored. Only a PBKDF2-HMAC-SHA256 hash with a per-user random salt and 200,000 iterations is kept.
role, status	Your permission level, and whether the account is pending, active or rejected.
session_token	A random token matching the sign-in cookie. Cleared when you sign out.
created_at, approved_at, approved_by, last_login	When the account was made, who approved it, and when you last signed in.
theme	Your light/dark choice, so it follows you between devices.

Activity log

Administrative actions are recorded to an append-only log capped at the most recent 2,000 entries. Each entry holds a timestamp, the acting account, the action, the target and a short detail string. Sign-ins, sign-outs, sign-ups, approvals, role changes and deletions appear here.

Operational data

Beyond accounts, Map MGT holds the business data staff enter or generate: creator and social-account records, tracker statistics, chatting sales and shift records, payroll and financial figures, and the images and videos produced by the generation tools. This is business data rather than data about you as a user, but it is stored on the same server.

Services data is sent to

Map MGT calls these external services to do its work. Content you submit to a tool is sent to the provider behind it:

Google (Gemini / Vertex AI) — image generation prompts and reference images.
RunningHub and WaveSpeed — images, video and audio submitted for generation.
RapidAPI — public Instagram, TikTok and X account statistics are fetched through it.
FansMetrics — creator earnings figures are pulled from it.
Discord — scheduled reports are posted to webhooks, where configured.

No analytics or advertising service receives anything. See Cookies and browser storage for what is kept in your browser.

Access

Access is controlled by role. Administrators can view the member list and activity log; the financial reports are restricted further, to named accounts only. Chatters see only their own pay and timesheet records.

Security

All traffic is served over HTTPS; plain HTTP is redirected.
Session cookies are HttpOnly and SameSite=Lax.
Passwords are salted and hashed as described above, and are not recoverable.
Signing out revokes the session token on the server, not just in your browser.

To be completed by Map MGT

The sections above state only what the application does. A complete privacy notice also needs the following, which cannot be read from the code and have deliberately not been invented:

Data controller — the legal entity operating Map MGT, its registered address and a contact email.
Jurisdiction — which country's data-protection law applies, and whether GDPR, UK GDPR or another regime governs this.
Legal basis — the lawful basis for processing staff data (likely contract or legitimate interests, but this is your determination to make).
Retention — how long accounts, the activity log, generated media and financial records are kept after someone leaves.
Data subject rights — how a staff member requests access, correction, export or deletion, and who handles it.
Processors — the providers listed above act as processors; each needs a data-processing agreement, and any transfer outside your jurisdiction needs a documented basis.
Sub-hosting — the server's hosting provider and physical location.
Breach procedure — who is notified, and within what period.

Have these reviewed by someone qualified before treating this page as a published privacy notice.

Cookies · Back to Map MGT