1. Introduction
MapleHearth, LLC (“MapleHearth,” “we,” “us,” or “our”) is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website at maplehearth.ai or use our products — ArcAI and Marina Pro.
By accessing our website or using our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please discontinue use of our services and contact us to request deletion of any data we hold.
The short version: We collect only what we need to operate and improve our services. We do not sell your personal data. All payment processing is handled by Stripe (PCI DSS Level 1 certified) — we never see or store your raw card details.
2. Information We Collect
Account & Contact Information
When you register for an account, request a demo, or contact us, we may collect: full name, business email address, company name, phone number, and job title. This information is used to provision your account and communicate with you.
Usage & Technical Data
We automatically collect certain information when you interact with our services, including: IP address, browser type and version, operating system, pages visited and time spent, referring URL, device type, and feature usage patterns. This data is collected via server logs and, where consented, analytics tooling.
Payment Information
All payment processing is handled entirely by Stripe, Inc. MapleHearth does not store, process, or transmit raw credit card numbers, CVV codes, or full bank account details on our servers. Stripe is certified to PCI DSS Level 1 — the highest level of payment security certification. When you provide payment information, it goes directly to Stripe’s secure infrastructure. For more information, see Stripe’s Privacy Policy.
Customer Data (ArcAI & Marina Pro)
If you use our SaaS products, you may upload documents, files, and business data (collectively, “Customer Data”). This includes documents indexed by ArcAI for search and Q&A, and marina resident records, booking data, contracts, and transaction history in Marina Pro. Customer Data belongs entirely to you. We process it solely to deliver the services you have subscribed to and do not use it to train third-party AI models or share it with unauthorized parties.
Communications
If you contact us by email, phone, or via our contact form, we retain the content of those communications and your contact details in order to respond and to improve our support quality.
3. How We Use Your Information
We use the information we collect for the following purposes:
- Service Delivery: To provision, operate, and maintain ArcAI and Marina Pro on your behalf
- Billing & Payments: To process subscription fees, invoices, and refunds through Stripe
- Communications: To send service notifications, security alerts, product updates, and responses to your inquiries
- Support: To diagnose issues, provide technical assistance, and improve service quality
- Product Improvement: To understand usage patterns and improve the performance, features, and usability of our products
- Security: To detect, investigate, and prevent fraudulent transactions, unauthorized access, and other security incidents
- Legal Compliance: To comply with applicable laws, regulations, legal processes, and enforceable government requests
We do not use your personal information to build advertising profiles, sell targeted advertising, or share data for third-party marketing purposes.
4. Data Sharing & Third Parties
We share data only to the extent necessary to provide our services. We do not sell, rent, or trade your personal information with third parties for their own commercial purposes.
Service Providers We Use
- Stripe, Inc. — Payment processing and subscription billing. Stripe maintains PCI DSS Level 1 certification independently.
- Microsoft Azure — Cloud infrastructure, compute, and data storage. All data is hosted in Microsoft-operated data centers subject to Microsoft’s enterprise security and compliance commitments.
- Microsoft Entra ID — Identity and access management, single sign-on, and multi-factor authentication services.
- Twilio SendGrid — Transactional email delivery (account confirmations, invoices, system alerts).
- Twilio — SMS notification delivery for service alerts and two-factor authentication codes.
- Microsoft Application Insights — Application performance monitoring and error logging (telemetry is anonymized where possible).
All service providers are contractually bound to use your data solely to provide services to MapleHearth and are prohibited from using it for their own commercial purposes.
Legal Requirements
We may disclose your information if required to do so by law, court order, or government authority, or when we believe disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a valid legal process.
Business Transfers
In the event of a merger, acquisition, or sale of all or a portion of our assets, personal information may be transferred as part of that transaction. We will notify you via email and a prominent notice on our website prior to any such transfer, and will ensure the receiving party is bound by privacy protections at least as strong as those in this policy.
5. Data Retention
We retain personal data for as long as your account is active or as needed to provide our services. Specific retention periods:
- Active accounts: Data is retained for the full duration of your subscription
- After account termination: Account data is retained for 90 days to allow for reactivation or data export, then securely deleted or anonymized
- Financial & billing records: Transaction logs and invoices are retained for up to 7 years to comply with applicable financial and tax regulations
- Security & audit logs: Access and activity logs are retained for up to 2 years for security monitoring and incident investigation purposes
- Marketing & contact form submissions: Retained for up to 2 years to support follow-up communications and improve our outreach
You may request earlier deletion of your personal data by contacting us at privacy@maplehearth.ai, subject to our legal retention obligations. We will respond to deletion requests within 30 days.
6. Security
We implement industry-standard technical and organizational security measures to protect your personal information from unauthorized access, disclosure, alteration, and destruction. Key security measures include:
- TLS 1.3 encryption for all data in transit between your browser and our servers
- AES-256 encryption for all data stored at rest
- Multi-tenant data isolation with tenant-scoped query filtering to prevent cross-tenant data access
- Role-based access controls (RBAC) with least-privilege principles for all system access
- Multi-factor authentication (MFA) required for all administrative and privileged access
- Regular vulnerability assessments and third-party penetration testing
- Immutable audit logs for all data access, modifications, and configuration changes
While we employ rigorous security practices, no method of transmission over the Internet or electronic storage is 100% secure. We continuously monitor for threats and will notify you promptly in the event of a breach affecting your data, in accordance with applicable laws. For a detailed description of our security architecture, visit our Security & Compliance page.
7. Your Rights
Depending on your location and applicable data protection laws, you may have the following rights regarding your personal information:
- Right to Access: Request a copy of the personal data we hold about you
- Right to Correction: Request that we correct inaccurate or incomplete personal data
- Right to Deletion: Request deletion of your personal data, subject to our legal retention obligations
- Right to Portability: Request your data in a structured, commonly used, machine-readable format
- Right to Object: Object to our processing of your personal data in certain circumstances
- Right to Restrict Processing: Request that we limit how we use your data in certain circumstances
GDPR — EU / EEA Residents
If you are located in the European Union or European Economic Area, you have rights under Articles 15–22 of the General Data Protection Regulation (GDPR). You also have the right to lodge a complaint with your local supervisory authority. Our lawful bases for processing include: contract performance, legitimate interests, legal obligation, and consent (where required).
CCPA — California Residents
California residents have the right to know what personal information we collect, how it is used, and with whom it is shared. You also have the right to request deletion of your personal information and to opt out of the “sale” of your information. We do not sell personal information. To submit a California privacy request, contact us at privacy@maplehearth.ai with “CCPA Request” in the subject line.
To exercise any of your privacy rights, contact us at privacy@maplehearth.ai. We will verify your identity and respond within 30 calendar days. We will not discriminate against you for exercising these rights.
8. Cookies
Our website uses cookies and similar tracking technologies to provide and improve our services. We use three categories of cookies:
- Essential Cookies: Required for basic website functionality such as session management and security. These cannot be disabled without significantly impacting your ability to use our site.
- Analytics Cookies: Help us understand how visitors interact with our website so we can improve content, navigation, and performance. These are only placed with your consent.
- Preference Cookies: Remember your settings and preferences (such as language or display options) between visits to provide a more personalized experience.
We do not use advertising cookies, behavioral tracking cookies, or third-party marketing cookies. You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our services. To opt out of analytics tracking, you may also use standard browser Do Not Track signals.
9. International Data Transfers
MapleHearth operates in the United States, and our services are hosted primarily on Microsoft Azure infrastructure in US-based data centers. If you are accessing our services from outside the United States, please be aware that your personal information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.
For transfers of personal data from the EU/EEA to the United States, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) as approved by the European Commission, where required. By using our services, you consent to the transfer of your information to countries outside your country of residence.
10. Children’s Privacy
Our services are enterprise software platforms designed exclusively for use by businesses and their adult employees and contractors. Our services are not directed to, and we do not knowingly collect personal information from, individuals under the age of 16.
If we become aware that we have inadvertently collected personal information from a child under 16 without verifiable parental consent, we will take prompt steps to delete that information from our systems. If you believe we may have collected information from a minor, please contact us immediately at privacy@maplehearth.ai.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our data practices, technology, legal requirements, or business operations. When we make material changes, we will:
- Update the “Last Updated” date at the top of this page
- Send an email notification to all registered account holders
- Display a prominent notice on our website for a reasonable period prior to the changes taking effect
We encourage you to review this policy periodically. Your continued use of our services after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. If you do not agree to the changes, you may discontinue use and contact us to request deletion of your data.
12. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out:
- Privacy requests: privacy@maplehearth.ai
- General inquiries: sales@maplehearth.ai
- Security concerns: security@maplehearth.ai
- Contact form: maplehearth.ai/contact
We aim to respond to all privacy-related inquiries within 5 business days and to fulfill data subject rights requests within 30 calendar days.