Privacy Policy

1. Introduction

This Privacy Policy explains how Agile OCM Corp.("LaunchMap," "we," "our," or "us"), the operator of the LaunchMap AI-powered change management platform (the "Service"), collects, uses, shares, and protects your information. It applies to our marketing website, our web application, and any related services that link to this policy.

We act as a data controller for information about our account holders and website visitors. Where an organization uses LaunchMap to manage its own change initiatives, we act as a data processor for the plan and stakeholder content that organization uploads, and that organization is the controller of that content. Enterprise customers may enter into a separate Data Processing Agreement that governs our processing on their behalf.

By using LaunchMap you acknowledge the practices described here. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

Account Information

When you create an account or use the Service, we collect information you provide directly:

• Name and email address
• Organization name and your role
• Profile information and preferences
• Billing contact and subscription details (payment card data is handled solely by our payment processor and never touches our servers)
• Support requests and other communications you send us

Authentication and passwords are managed by our identity provider (Clerk). LaunchMap does not create, store, or have access to your account password.

Usage and Device Data

We automatically collect certain technical information when you use the Service:

• Device information (browser type, operating system)
• IP address and approximate location derived from it
• Pages visited, features used, and interactions within the app
• Time and date of access, and referring website addresses
• Error and diagnostic data when something goes wrong

Plan, Activity, and Uploaded Content

To provide the Service, we store the content you and your collaborators create or upload:

• Change management plans, activities, and timelines
• Stakeholder impact assessments and impact ratings
• Comments, mentions, and collaboration data
• Documents you upload to ground AI recommendations (e.g. project briefs, spreadsheets)
• AI-generated recommendations, chat messages, and insights

You should avoid entering special-category personal data (such as health information) or other sensitive information into plans, documents, or AI chat unless it is necessary for your change initiative and permitted by your organization.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and manage subscriptions
• Generate AI-powered recommendations, plan drafts, and chat responses at your request
• Send administrative and service communications
• Respond to support requests
• Understand aggregate usage patterns to improve the product experience
• Detect, prevent, and address security incidents, fraud, or abuse
• Comply with legal obligations and enforce our agreements

We do notuse your plan content, uploaded documents, or chat messages to train our own or any third party's AI models.

4. AI Processing and Sub-processors

LaunchMap uses third-party large language model (LLM) providers to deliver AI features such as plan generation, activity recommendations, and the OCM chat assistant. It is important you understand what this means for your data:

• When you use an AI feature, the relevant plan content, stakeholder context, uploaded document text, and the messages you send are transmitted to our LLM sub-processors to generate a response. Depending on configuration and availability, these providers include Anthropic, OpenAI, and OpenRouter (which routes requests to models such as DeepSeek).
• We route the same prompts and completions through LangFuse, our AI observability provider, so we can monitor quality, debug failures, and manage cost. This means your AI prompts and the AI's responses are also processed by LangFuse.
• AI processing is gated by your consent. If you decline AI processing, AI features either fall back to deterministic, non-AI behavior or are unavailable, and no plan content is sent to the LLM providers for those features.
• Before content is sent to AI providers we apply automated redaction to remove common categories of directly identifying data (such as email addresses, phone numbers, and payment-card-like numbers) where feasible, and we minimize the context sent to what the feature needs.
• Our AI sub-processors act as processors under contract and are not permitted to use your content to train their models.

We rely on the following sub-processors to operate the Service. Each is bound by a data processing agreement and appropriate transfer safeguards.

We may update this list as our infrastructure evolves. Material additions of new sub-processors that process personal data will be reflected here.

5. How We Share Information

We share your information only in the following circumstances:

• Within your organization: plan content is shared with the collaborators and organization members you grant access to, according to your permission settings.
• Via share links: if you create a share link for a plan, anyone with that link can view the shared content according to the access level you choose. You control whether a share link exists and can revoke it at any time.
• Sub-processors: the third-party providers listed in Section 4, who process data on our behalf under contract.
• Legal requirements: when required by law, legal process, or to protect the rights, safety, and security of LaunchMap, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

6. Data Security

We take reasonable and appropriate technical and organizational measures to protect your data, including:

• Encryption of data in transit (TLS) and at rest
• Delegated authentication and session management through our identity provider
• Role-based access controls and organization-level data isolation
• Plan-level collaborator permissions
• Audit logging of security-relevant actions
• Ongoing security review of our systems and dependencies

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security.

7. Data Retention and Deletion

We retain your information for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

• Account and plan content: when you request account deletion, a 90-day grace period begins during which you can cancel the request. After the grace period, we anonymize or delete your personal data and your identities are removed from our identity, analytics, and payment providers. Plans you own are transferred to another organization administrator where one exists, or otherwise scrubbed of your personal data and soft-deleted.
• Consent records: retained in anonymized form for up to 5 years after deletion, as proof of consent required by law.
• Billing records: retained for up to 7 years to meet tax and accounting obligations.
• Audit logs: retained for security and compliance for a limited period, then archived or deleted.

You can request deletion at any time from your account settings or by contacting us at privacy@launchmap.ai.

8. Your Rights (Global Baseline)

Regardless of where you live, we offer all users the following controls:

• Access and portability:download a copy of your personal data from Settings → Privacy & Data, or by request.
• Correction: update your profile and account information in-app, or ask us to correct inaccurate data.
• Deletion: request deletion of your account and personal data.
• Consent management: grant or withdraw consent for AI processing and analytics cookies at any time.

To exercise any right, contact us at privacy@launchmap.ai. We will respond within the time required by applicable law.

9. European Economic Area, United Kingdom, and Switzerland (GDPR)

If you are located in the EEA, the UK, or Switzerland, you have the following rights under the GDPR and equivalent laws: access, rectification, erasure, restriction of processing, objection to processing, data portability, and the right not to be subject to solely automated decisions with legal or similarly significant effects.

Our legal bases for processing are: performance of our contract with you (providing the Service), your consent (AI processing, analytics cookies, and marketing), compliance with legal obligations, and our legitimate interests in securing and improving the Service.

Where we transfer personal data outside the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum.

You have the right to lodge a complaint with your local supervisory authority. Our lead supervisory authority is determined by our place of establishment in Toronto, Ontario, Canada.

10. California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use and share it, to request access to and deletion of your personal information, to correct inaccurate information, and to be free from discrimination for exercising these rights.

We do not sell your personal information and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We do not knowingly process the sensitive personal information of California residents for purposes that require a right to limit.

To exercise your California rights, contact us at privacy@launchmap.ai. You may use an authorized agent to submit a request on your behalf, subject to verification.

11. Cookies and Tracking

We use strictly necessary cookies to run the Service and, only with your consent, analytics cookies to understand how the Service is used. Analytics do not run until you accept them, and you can change your choice at any time.

For full details, see our Cookie Policy.

12. International Data Transfers

LaunchMap and its sub-processors operate primarily in the United States. Your information may be transferred to and processed in countries other than your own, which may have different data protection laws. Where required, we put in place appropriate safeguards such as Standard Contractual Clauses to protect your information during such transfers.

13. Children's Privacy

LaunchMap is a workplace tool intended for users 18 years of age or older. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the "Last updated" date. If changes are material, we will provide additional notice and, where required, request renewed consent. Your continued use of the Service after an update constitutes acceptance of the revised policy.

15. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us: