Privacy Policy

1. Scope and Our Roles

WP FloorMap serves two groups of people, and our role differs for each:

• Subscribers — the property managers, owners and operators who license the Software. For their account, company and billing data, Foreword is the controller (business).
• Site visitors — people who use features such as “Schedule a Tour” on a website built with the Software. For that visitor data, the Subscriber is the controller and Foreword acts as its processor (service provider), handling the data only to provide the Service on the Subscriber’s behalf.

If you are a site visitor with questions about how a particular property uses your data, please contact that property operator directly. For questions about the Service itself, contact us at privacy@foreword.dev.

2. Personal Data We Collect

From site visitors:

• Tour bookings — full name, email and phone number, plus booking details (date, time, duration, tour type, unit or floor plan of interest and a confirmation code). Legal bases: performance of a contract (GDPR Art. 6(1)(b)) and, for SMS, consent (Art. 6(1)(a)).
• Contact forms — the name, email and message you submit, used to deliver your enquiry to the property team.
• Saved favorites — unit identifiers only, stored in your browser’s local storage. This stays on your device and is not sent to our servers.
• Map interactions — when an interactive map loads, your IP address is shared with our map provider to render the map (see Section 5).

From subscribers:

• Account and company details you enter in the Setup Wizard or settings (company name, address, contact email and phone, office hours and the marketing description you choose to provide), your website domain and your license key.
• Billing information processed by our payment provider (see Section 5). We do not store full card numbers.

The Software also reads property and unit data (floor plans, availability, pricing, amenities) from Engrain SightMap®. This is property data, not visitor personal data.

3. How We Use Data

• Tour booking management — scheduling, confirming, reminding and cancelling property tours.
• Notifications — sending confirmation and reminder emails and SMS about your tour, and delivering contact-form enquiries to the property.
• Calendar synchronisation — creating an event in the property manager’s Google or Outlook calendar so they can prepare for your visit.
• Maps and neighborhood — geocoding property and company addresses and rendering interactive maps.
• AI-assisted site copy — generating marketing copy, neighborhood descriptions and SEO text for the Subscriber’s own site from the company and property information the Subscriber provides (see Section 4).
• Running the Service — validating license keys, providing updates and support, processing subscriptions and protecting the security and integrity of the Service.

We do not sell or share personal information, and we do not use visitor data for cross-context behavioral advertising, profiling or automated decision-making. Visitor tour data is used only for correspondence about the tour you scheduled.

4. AI-Generated Content

When a Subscriber uses the Setup Wizard or copy tools, the company description and property details the Subscriber provides are sent to our AI provider (Anthropic) to generate marketing copy, neighborhood descriptions and SEO metadata for the Subscriber’s own website. This input is business and property information, not site-visitor personal data. Our AI provider processes the request to return the generated text and does not use data submitted through its API to train its models. Generated copy is returned to, and owned by, the Subscriber for use on its site.

5. Sub-Processors and Third-Party Services

To provide the Service we share data with the following providers, only as needed for the purpose shown:

• Anthropic (Anthropic PBC, USA) — subscriber-provided company and property text, to generate site copy. No visitor personal data. Not used for model training.
• Mapbox (Mapbox Inc., USA) — property and company addresses for geocoding, and visitor IP address when a map loads, to display interactive maps.
• Stripe (Stripe Inc., USA) — subscriber name, email and payment details, to process subscription billing. Subscriber data only.
• Twilio (Twilio Inc., USA) — visitor phone number and tour details, to deliver SMS reminders and notifications. Reply STOP to opt out.
• Amazon SES (Amazon Web Services Inc., USA) — visitor or subscriber name and email, to deliver transactional email.
• Google Calendar API (Google LLC, USA) — visitor name, email, phone and booking details, to create a calendar event — only if the property connected Google.
• Microsoft Graph API (Microsoft Corp., USA) — the same booking details as above for Outlook — only if the property connected Microsoft.
• Engrain SightMap (Engrain Inc., USA) — property and unit data for the interactive maps. No visitor personal data is sent by the booking system.
• WP Engine (WP Engine, Inc., USA) — managed WordPress hosting infrastructure. Applies only to subscribers who choose our optional managed-hosting add-on; for those sites, WP Engine stores the WordPress site and its data on our behalf.

Only one calendar provider (Google or Outlook) is active per property at a time, and visitor data is shared only with the provider the property connected.

6. Cookies, Local Storage and Consent

The WP FloorMap plugin does not set tracking or advertising cookies of its own. It uses your browser’s localStorage to remember your favorited units (unit identifiers only), which stays on your device.

The Software includes an optional cookie-consent tool that a Subscriber may enable and configure for its own site; the cookies governed by that tool are set by the Subscriber’s site, not by Foreword. Embedded maps from Engrain SightMap and Mapbox may set their own cookies — see Engrain’s Privacy Policy and Mapbox’s Privacy Policy.

7. ICS Calendar Feed

The Service offers an ICS calendar feed that a property manager can subscribe to from an external calendar app. The feed may contain booking details, including visitor names. Its URL is protected by a unique secret token and is intended only for the property manager.

8. Data Storage and Security

• Personal data handled by the hosted Service is stored in a secured database on servers managed by Foreword. Subscribers who use our optional managed-hosting add-on have their WordPress site hosted on WP Engine infrastructure (see Section 5).
• Traffic between the Software, our API and third-party services is encrypted in transit using TLS/HTTPS.
• Access is restricted to authorized personnel and authenticated API requests. OAuth tokens for calendar integrations are stored securely and do not contain visitor personal data.
• No method of transmission or storage is completely secure; we cannot guarantee absolute security.

9. Data Retention

• Active bookings: retained for the duration of the booking and a reasonable period afterward for record-keeping.
• Cancelled bookings: retained for up to 12 months, then deleted.
• Subscriber account and billing records: retained for the life of the Subscription and as required for tax, accounting and legal purposes.
• You may request earlier deletion at any time (see Section 10).

10. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights. To exercise a right as a site visitor, contact the property operator or email us at privacy@foreword.dev; we will help route or fulfil the request and respond within the time the law requires.

Under the GDPR/RGPD (EU/UK): access, rectification, erasure, restriction, data portability and the right to object to processing based on legitimate interest.

Under the CCPA/CPRA (California): the right to know what personal information we collect and how it is used, the right to access and delete it, the right to correct it and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information, and we do not discriminate against anyone for exercising these rights.

11. International Transfers

The Service and the providers listed in Section 5 are based in the United States, so personal data may be processed in the USA. Where data is transferred from the EU, UK or other regions, the transfer is protected by appropriate safeguards such as Standard Contractual Clauses or the EU-US Data Privacy Framework, as applicable to each provider.

12. Children’s Privacy

The Service is not directed to children and is not intended for individuals under 16. We do not knowingly collect personal data from children. If you believe a child has submitted data, contact us and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the most recent revision. Please review this page periodically.

14. Contact and Complaints

For questions about this Policy or to exercise your rights, contact:

Foreword Development LLC
Email: privacy@foreword.dev

If you are in the EU/UK, you may also lodge a complaint with your local data protection supervisory authority. If you are in California, you may contact the California Privacy Protection Agency or the State Attorney General.