Privacy policy
Last updated 13 October 2026
This policy covers the How2MapIt website (how2mapit.com), the How2MapIt web apps, the How2MapIt mobile app, and AI apps you connect to How2MapIt. How2MapIt is provided by castigroup pty ltd, Foyer 3, Colosseum Building, Century Way, Century City, Western Cape 7441, South Africa ("we"). Contact us, or our Information Officer, at info@castigroup.com.
Who is responsible
Companies ("your organisation") use How2MapIt to map and publish their operating processes for their teams. Your organisation decides who has an account, what each person can see, and what its processes contain. For that information your organisation is responsible, and we process it on its behalf to provide the service. For this website and its contact form, we are responsible.
What the apps use, and why
| Your name and work email address | To sign you in and show who you are. |
|---|---|
| Your sign-in session | To keep you signed in. On a phone the token is kept in secure storage; your password is never stored on the device. |
| Roles and departments your organisation gave you | To show the activities that are yours. |
| Your confirmations that you read an activity | So your organisation can see who is up to date with a process. |
| Feedback you send | So the team responsible for the process can act on it and reply. |
| Questions you ask | To answer them from your organisation's processes. We do not store the text of your questions. |
| The sources you open in an answer | To improve the answers. |
| Processes you mark as favourites | To show them first. |
The mobile app does not use your location, contacts, camera, microphone or photos. Processes you can see, and confirmations or feedback not yet sent, are kept inside the app so it works without a connection; they are deleted when you sign out or switch organisation.
On this website
- Contact form. Your name, email address, the company and phone number if you give them, the topic and your message, so we can reply to you. We keep a message for 180 days, then delete it. A check by Cloudflare Turnstile confirms the form was sent by a person.
- Analytics. Google Analytics counts visits to the public pages: the pages viewed, the kind of device and browser, and an approximate location. It is not used on the sign-in pages or inside the apps.
- Cookies and browser storage. A sign-in cookie keeps you signed in across the How2MapIt apps; Google Analytics sets its own cookies; and your browser keeps a note that you have signed in here before, so the site knows whether to check for a session. You can clear these in your browser settings.
Answers to questions
Questions are answered by AI services that work only from your organisation's published processes. We use Voyage AI to find the relevant processes and OpenAI to write the answers.
AI apps (Claude, ChatGPT)
You can connect an AI app, such as Claude or ChatGPT, to How2MapIt so it can answer questions from your organisation's processes and help you write new ones.
- Connecting is your choice. An app connects only after you sign in to How2MapIt and press Allow. Your organisation's admin can switch AI apps off for the whole company at any time.
- The app acts as you. It works in the one company you chose, and sees only what you can see there. If you lose access to something, the app loses it too.
- What it can read. Published processes and their activities, attachments, linked documents, controls and screenshots; roles and departments; the processes you take part in and what waits for your confirmation; the change history of processes you can read; and your own record of confirmations. If you allowed it to work on drafts, also the working copies of processes you can edit. If your licence includes personal processes, also your own personal processes and their files.
- Attestation records. If you can view attestation records in How2MapIt, an app can also read who has confirmed which process, but only if your organisation's admin has allowed AI apps to read attestation records (it is off until they do). We record each of these reads, including whose record was read.
- What it can change. Only if you allowed it to work on drafts: it can create draft processes and edit working copies of processes you can edit, saved under your name, and nothing goes live until someone reviews and publishes it. With a licence that includes personal processes, it can also keep your personal processes and attach a file you give it. An app cannot publish, submit for review, delete a process, or change who has access.
- What we receive. Only what the app sends when it uses How2MapIt: your search text, the items it opens, and the wording it saves. We do not receive your conversation with the app or its memory, and we receive a file only when you ask the app to attach it.
- Search. An app's search text is sent to Voyage AI to find and rank matching processes, as our service provider, the same way as questions asked in How2MapIt. We do not store it.
- The app's own provider. The company that runs the app (for example Anthropic for Claude, or OpenAI for ChatGPT) receives what How2MapIt returns to it, and handles your conversation under its own privacy policy.
| Your connection: which app, which company, what you allowed, when it was last used | So the app keeps working without asking you to sign in each time. Deleted 30 days after you disconnect it or your access ends. |
|---|---|
| Sign-in tokens the app holds | Access tokens last 60 minutes and are not stored. Refresh tokens are stored only as a one-way hash and stop working when you disconnect. |
| A record of what the app read for you | Which processes, activities, documents, changes or attestation records it opened, and when. Kept 90 days. |
| A record of each time an app read one of your personal processes | So your organisation can see which personal processes are used. Kept 90 days. |
| Drafts, changes and personal processes the app saved | Your work in How2MapIt, kept like anything else you write there. |
| Technical logs of each call | Which tool was used, whether it worked and how long it took, to keep the service running and secure. They never contain your search text, what the app read, or what it wrote. Kept up to 3 days. |
To disconnect an app, open How2MapIt, go to My profile, Connected apps, and choose Disconnect; it stops working straight away. Removing the connector in the AI app alone does not end our side of the connection. To get the record of what an app read for you, write to info@castigroup.com.
Service providers
- Microsoft Azure: hosting, storage, and reading the text of uploaded documents.
- Voyage AI: finding the processes that answer a question, and search, including search by AI apps you connect.
- OpenAI: writing answers to questions.
- Anthropic: AI features that help authors build and check processes. (Claude, when you connect it, is your own app, not our provider.)
- TypeSafe: checking the logic of processes, where your organisation uses it.
- Twilio SendGrid: sending email, such as invitations and notifications.
- Google Analytics: website visit statistics.
- Cloudflare Turnstile: telling people from bots on the contact form.
- Apple Push Notification service and Google Firebase: only if notifications are switched on.
Some of these providers process data outside South Africa, including in the United States. We share only what each needs to do its job.
Keeping it safe, and for how long
Data travels over encrypted connections (HTTPS). Each organisation's information is kept separate, and people see only what their access allows. We keep account data for as long as your organisation keeps your account, and after that as agreed with your organisation. Contact messages are kept for 180 days.
We do not sell personal information, show advertising, or track you across other apps or websites.
Your rights
Under the Protection of Personal Information Act (POPIA) and similar laws you can ask to see, correct or delete your personal information, and object to how it is used. Because your app account belongs to your organisation, ask your organisation's How2MapIt admin first; you can also write to us at info@castigroup.com. You may also complain to the Information Regulator (South Africa).
Children
How2MapIt is a workplace tool and is not meant for children. We do not knowingly collect information from anyone under 18; if you think we have, contact us and we will delete it.
Changes
We update this page when what we collect or how we use it changes, and change the date at the top.