Stop chasing clients. Try OnboardMap free.
Demo

Privacy Policy

Last updated: May 4, 2026

DiscoveryMark LLC ("OnboardMap," "we," "us," or "our") operates the website onboardmap.com and the OnboardMap web application (together, the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, how long we keep it, and the rights you have over it.

Information We Collect

We collect only the information needed to provide the Service:

  • Account information — name, email address, and password hash when you create an account or sign up for early access.
  • Business information — company name, branding (logo, color), and team member emails you add to your workspace.
  • Customer and onboarding data — information you and your clients enter into the Service, including client contact details, files uploaded by clients, form responses, and onboarding progress.
  • Billing information — if you subscribe to a paid plan, your payment details are collected and processed by our payment processor (Paddle); we do not store full card numbers on our servers.
  • Usage data — pages visited, time on site, referring URLs, and interactions with our website. Collected via Google Analytics (see Cookies and Analytics below).
  • Device data — IP address, browser type, and operating system, automatically logged by our infrastructure for security and abuse prevention.

How We Use Your Information

  • To provide, operate, and maintain the Service
  • To authenticate you and secure your account
  • To process payments and manage subscriptions
  • To send transactional emails (account verification, password resets, onboarding notifications, billing receipts)
  • To send product updates, tips, and occasional marketing emails — you can opt out at any time from within Settings or via the unsubscribe link in any marketing email
  • To understand how the Service is used and improve it
  • To comply with legal obligations and enforce our Terms

We will never sell or rent your personal information to third parties.

Subprocessors

We use the following third-party service providers to operate the Service. Each is contractually bound to handle your data in accordance with applicable privacy laws:

  • Amazon Web Services (AWS) — cloud infrastructure, data storage (DynamoDB, S3), authentication (Cognito), and transactional email delivery. Data is stored in the United States. AWS Privacy Notice.
  • Google LLC (Google Analytics) — website usage analytics for the marketing site. Google Privacy Policy.
  • Paddle.com Market Limited — Merchant of Record for paid subscriptions; handles payment processing, billing, and applicable sales tax/VAT. Paddle Privacy Policy.

If we add or change subprocessors, we will update this list.

Cookies and Analytics

Our website uses cookies and similar technologies. The first time you visit the site you will see a cookie notice. You can choose to Accept or Block; your choice is stored in your browser's local storage so the notice will not appear again on the same device.

  • Strictly necessary — used to keep you signed in to the application and remember your preferences. These are required for the Service to function.
  • Analytics — Google Analytics sets cookies (e.g., _ga) to distinguish unique visitors and measure aggregate traffic. If you click Block, Google Analytics will be disabled on subsequent visits from that browser.

We do not use cookies for advertising or cross-site retargeting. You can also opt out of Google Analytics at any time using the Google Analytics Opt-out Browser Add-on.

Data Retention

We retain your personal information for as long as your account is active and as needed to provide the Service. If you delete your account, your account data and associated workspace data are permanently deleted from our active systems within 30 days. Backups are rotated out within 90 days. We may retain limited records for longer where required by law (e.g., tax records).

Your Privacy Rights

You have the following rights regarding your personal information. To exercise any of them, you can use the in-app tools in Settings or contact us at austin@onboardmap.com.

  • Access — request a copy of the personal information we hold about you. Paid users can self-serve via the Export All Data button in Settings.
  • Correction — update inaccurate information directly in your account, or contact us.
  • Deletion — delete your account and all associated data. Free-plan users and users with a cancelled paid subscription can self-serve via the Delete Account button in Settings; paid users should cancel first or contact us.
  • Marketing opt-out — opt out of marketing emails via the link in Settings or the unsubscribe link in any marketing email. Transactional emails (account, billing, onboarding) will continue.
  • Portability — receive your data in a portable format. Our Export All Data tool provides this.
  • Object / restrict processing — ask us to stop or limit how we use your data. Contact us to make this request.
  • Lodge a complaint — if you are in the EU/UK, you have the right to complain to your local data protection authority.

We will respond to verifiable requests within 30 days (GDPR) or 45 days (CCPA), as applicable. We will not discriminate against you for exercising any of these rights.

GDPR (EU and UK Users)

If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR apply. Our legal bases for processing your personal information are:

  • Contract — to provide the Service you have signed up for
  • Legitimate interests — to secure, improve, and market the Service in a way that is balanced against your rights
  • Consent — for analytics cookies after the first visit (where required) and for marketing emails
  • Legal obligation — for tax records and responses to lawful requests

Data is processed and stored in the United States by AWS. Where we transfer data out of the EU/UK, we rely on Standard Contractual Clauses or equivalent safeguards.

The data controller is DiscoveryMark LLC, contactable at austin@onboardmap.com.

CCPA (California Users)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you the rights described in Your Privacy Rights above, plus:

  • Right to know — what categories of personal information we collect, the sources, the purposes, and the categories of third parties we share it with (all disclosed in this Policy).
  • Right to opt out of "sale" or "sharing" — we do not sell your personal information and we do not share it for cross-context behavioral advertising. There is therefore nothing to opt out of, but you can confirm this status with us at any time.
  • Right to limit use of sensitive personal information — we do not collect sensitive personal information beyond what is needed to provide the Service.
  • Right to non-discrimination — we will not deny you service, charge different prices, or provide a different level of service because you exercised your CCPA rights.

To submit a CCPA request, email austin@onboardmap.com with the subject line "CCPA Request." We may need to verify your identity before fulfilling the request. You may designate an authorized agent to make a request on your behalf.

Children's Privacy

OnboardMap is not directed at children under 16. We do not knowingly collect information from children under 16. If you believe we have, contact us and we will delete it.

Data Security

We take reasonable technical and organizational measures to protect your information. All data transmitted to and from the Service is encrypted in transit using TLS (HTTPS). Data at rest is encrypted using AES-256. Access to production systems is limited to authorized personnel and protected by multi-factor authentication. Despite our efforts, no system is 100% secure; in the event of a data breach affecting your personal information, we will notify you in accordance with applicable law.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date at the top of this page and, where required, notify you by email or in-app notice. Continued use of the Service after changes constitutes acceptance of the updated policy.

Contact Us

DiscoveryMark LLC
Austin, TX, USA
Email: austin@onboardmap.com

If you have questions about this Privacy Policy or want to exercise your data rights, please reach out — we typically respond within a few business days.