Privacy Policy

MaxMyMarket (“we”, “us”, “our”) is an AI marketing assistant for small businesses, operated by Ameveo Limited, a company registered in England and Wales (company no. 14276820) with its registered office at Mansion House, Manchester Road, Altrincham, Cheshire, WA14 4RW, United Kingdom.

For questions, requests, or complaints about your data, contact us at support@vitellian.com or write to us at Mansion House, Manchester Road, Altrincham, Cheshire, WA14 4RW, United Kingdom.

This matters, because it decides who is answerable for what.

• We are the controller for data about you, our customer: your account, your business profile, the content you give us and we generate for you, your billing records, your support messages, and our security logs. The rest of this policy explains how we handle it.
• We are a processor acting for you for data about other people that reaches us through your use of the service: people who comment on your posts, people who submit your website’s contact or enquiry forms, customers who order through your website, and people who book places or tickets through it. For that data you are the controller. We process it only to run the service for you, on the terms in Annex A of our Terms. You are responsible for having a lawful basis for it and for telling those people about it in your own privacy notice.

Research about your business. When we research your business (section 3), we are the controller for what we gather about it from public sources. For the people named or pictured on your own website and posts (your team, say), we act as your processor, as for the people listed above: we record their names, roles and images only so the assistant can recognise them, on the terms in Annex A of our Terms. Section 13 explains how anyone named can ask for their entry to be removed.

If you are a member of the public and want to know why a business holds your data, contact that business. If you cannot reach them, contact us and we will pass your request on.

We only collect what we need to run the service:

• Account details - the email address and password you sign up with, and your sign-in history. Passwords are handled by our authentication provider and stored only in hashed form; we never see your plain password.
• Business profile - information you give us, or that we gather from publicly available sources such as your existing website, so we can write about your business accurately: name, website, description, locations, opening hours, products and services, brand voice, goals, and the things you want to promote.
• Research about your business - so the assistant knows your business without you typing it all in, we read publicly available information about it: the pages of your website and your linked presence (its subdomains, your link-in-bio page, and your own shop or booking pages); public registers and listings, such as Companies House, your food hygiene rating and, only if you have no website, your Google Maps listing; public articles and pages that mention your business; and, before you connect Instagram, the public text of your Instagram business profile. Once you connect a social account, we also read your own posts, captions and images there. We show you what we found so you can confirm, correct or remove it. Our crawler identifies itself when it reads a website, and this page explains what it reads and how a site owner can opt out.
• People named or pictured on your pages - the names, roles and images of people who appear on your own website and posts (your team, say, or a partner you work with), recorded so the assistant recognises them. We name people only from what your pages say about them, never by recognising faces.
• Content - images and short video clips you upload, and the posts, images, videos and website copy the assistant generates for you.
• Connected social accounts - when you connect Facebook or Instagram we store the access tokens and account identifiers Meta returns (for example your Page and Instagram Business account, and its profile picture). Tokens are encrypted at rest. We never receive or store your social-network password. Section 6 lists exactly what those permissions let us do.
• Engagement data - to run the comment inbox and show your results, we read comments on your posts (including the commenter’s public name, platform ID and message), keep a record of the replies we post and of any comment you hide, and read engagement counts such as views, likes, comments and shares.
• Website enquiries - where we host a website for you, the name, email address and message of anyone who submits its contact or enquiry form, so we can save it for you and email you about it.
• Orders - where your website sells, the record of each completed sale: items, amounts, the customer’s email address, and any name and delivery address collected at checkout. Card details go to Stripe and never reach us.
• Bookings - where your website takes bookings for your events, classes or sessions, the record of each booking: the date, the number of places, the name and email address or phone number given (whether the person booked on the site or you recorded them yourself), answers to any questions your booking form asks, payment and refund status, whether they were checked in on the day, any note you add against the booking, and any message you send them through the service. If you open a door list for a date and share its link, anyone holding that link sees the names and party sizes on it until the link expires or you withdraw it.
• Domain registration details - if you buy a domain through us, the registration details required by the registrar and registry.
• Notifications - if you enable push notifications, the subscription details your browser provides so we can send approval prompts and reminders.
• Billing - your plan, subscription status, add-ons and usage counts. Payments are processed by Stripe; we do not store your card details.
• Support messages - anything you send us through the support form or by email.
• Technical data - server and error logs, and abuse-prevention records. For anonymous actions such as the public support form we record a hashed version of the IP address, so we can rate-limit abuse without keeping the address itself.

Where we are the controller, we rely on the bases below. “Contract” means the processing is necessary to deliver the service you signed up for; “legitimate interests” means we have weighed our interest against your rights and consider it fair and expected.

• Creating, scheduling and publishing your content - to the accounts you connect and the website we host for you. Basis: contract.
• Reading, classifying and (on eligible plans) replying to comments on your posts, flagging the ones that need your decision, and hiding, unhiding, editing or deleting comments and replies when you ask. Basis: contract with you; you are the controller for the commenter’s data.
• Showing your post history, engagement and website activity. Basis: contract.
• Taking and managing bookings on your website - counting places, confirming bookings by email, sending payment links, refunding through Stripe when a booking or a date is cancelled, running the door list, and sending attendees the messages you write, in your business’s name. Basis: contract with you; you are the controller for the attendee’s data.
• Researching public information about your business, so the assistant can provide the service you asked for without making you type it all in (section 3). Basis: legitimate interests in providing that service. Anyone named in what we find, or named or pictured on your own pages, can object by emailing us, and we remove their entry (section 13).
• Running your account, subscription, add-ons and support. Basis: contract, and legal obligation for accounting records.
• Service messages - approval prompts, publishing failures, billing notices, and (where your plan includes it) a monthly summary of your results. Basis: contract.
• Occasional reminders if your account goes quiet, asking whether anything is worth posting about. Basis: legitimate interests in helping you get value from a service you pay for. You can opt out at any time: see section 10.
• Push notifications, where you enable them. Basis: consent, which you can withdraw in the app or your browser.
• Keeping the service secure, preventing abuse and fraud, enforcing usage limits, and preventing repeat free trials. Basis: legitimate interests in protecting the service.
• Improving the service - diagnosing faults, and analysing anonymised, aggregated usage that does not identify you. Basis: legitimate interests.
• Complying with the law and establishing or defending legal claims. Basis: legal obligation and legitimate interests.

We do not sell your personal data, we do not use it for advertising or profiling, and we do not make decisions about you by purely automated means that produce legal or similarly significant effects.

To write and tailor your content we send the relevant business information - and, for comment replies, the comment text - to our AI provider, Anthropic (the maker of Claude), which processes it on our behalf to generate the result. Where images are generated or edited, the prompt and any reference photo you supply go to our image provider for the same purpose. Video rendering, where you use it, runs on our cloud infrastructure.

When it sets you up, builds your website, or advises on it, the assistant may also search the public web to learn about your business, which means a search provider receives the search terms. Researching your business also means that:

• a translation provider receives the text of facts about your business when you use the app in a different language from the one they were recorded in, so they can be shown to you in yours;
• Google Maps Platform receives your business name and area, only if you have no website, so we can find your Google Maps listing;
• public registers (such as Companies House and the food hygiene rating scheme) receive your business name when we look you up.

These providers act as our processors. They do not use your data to train their models, and we do not use your data, or your customers’ data, to train any AI model of our own. AI output can be wrong; our Terms explain that you stay responsible for what is published.

When you connect Facebook or Instagram you are asked to grant our app a set of permissions. We ask only for the ones the features need, and we use each for one purpose:

• Listing your Pages (pages_show_list, business_management) - to find the Facebook Page you manage and the Instagram professional account linked to it, so we connect the right one. We store the Page and Instagram account identifiers and the access token for that Page.
• Publishing (pages_manage_posts, instagram_content_publish, instagram_basic) - to publish the posts you approve (or, in automatic mode, the posts the service generates) to your Page and Instagram account, and to fetch your Instagram account’s basic profile and profile picture so the app can show your posts as they will appear.
• Reading comments (pages_read_user_content, instagram_manage_comments) - to bring the comments on the posts we published into your inbox: the commenter’s public name, platform ID, message and time.
• Replying to and moderating comments (pages_manage_engagement, instagram_manage_comments) - to post the replies you approve (or, on plans with automatic replies, the replies the service drafts), to edit or delete a reply we posted, and to hide or unhide a comment when you ask.
• Engagement figures (pages_read_engagement, instagram_manage_insights) - to read the views, likes, comments and shares on the posts we published, so your dashboard and monthly summary can show how they did. We read figures for our own posts only.

That is the whole list. We do not read your private messages, your friends or followers, your ads, or posts we did not publish; we do not post anything you have not authorised through your chosen settings; and we do not sell Meta data, use it for advertising or profiling, or share it with anyone except the processors in section 8 who help us run the service. We comply with the Meta Platform Terms and Developer Policies. You can disconnect an account at any time in your settings, which deletes the stored tokens and revokes our access going forward; you can also remove the app under your Facebook or Instagram settings. Section 14 explains how to have the data deleted.

Access is limited to the people who need it to run and support the service, under a duty of confidentiality. Our staff may access your account data to investigate a support request, to diagnose a fault, or to check that generated content and websites meet our standards. We log administrative access.

We do not sell your personal data. We share it only with service providers (“processors”, or “sub-processors” where we act for you), and only as needed:

• Supabase - database, authentication, and file storage hosting.
• Vercel - application hosting.
• Anthropic - AI text generation (Claude).
• Brave Search API (Brave Software) - searching the public web for information about your business. It receives the search terms (such as your business name and town), never your account details.
• Azure AI Translator (Microsoft) - showing facts about your business in the language you use the app in, when they were written in another. It receives the text of those facts, never your account details, and does not keep it.
• Google Maps Platform (Google, the Places API) - finding your Google Maps listing, only if you have no website. It receives your business name and town. We keep only the listing’s place ID.
• Companies House and the Food Standards Agency (UK public registers) - looking up your company record and food hygiene rating. They receive your business name and town or postcode.
• Meta Platforms (the Instagram Graph API), where used - reading the public bio and captions of your business’s own Instagram account before you connect it. It receives your Instagram username.
• Hosted browser service, where used - reading website pages that only display in a full browser.
• Replicate - AI image generation and editing, where used.
• Amazon Web Services - video rendering, where you use the video feature.
• Stripe - subscription payments, and payments made to you through your website.
• Resend - sending support, notification and service emails, and the enquiry replies, booking confirmations and attendee messages your website sends in your name.
• Cloudflare - content delivery, custom-domain routing for hosted websites, and bot/abuse protection on our sign-in forms, where enabled.
• Name.com - domain registration, where you buy a domain through us.
• The social networks you connect (Facebook, Instagram) - we send your posts and replies to them at your direction.

We may also disclose data where required by law or a valid legal request, to enforce our terms, or to protect our rights and the safety of others. If our business is reorganised, merged or sold, data may transfer to the acquirer under this policy.

This list is the sub-processor list referred to in Annex A of our Terms. We will give notice before adding a new one.

Some of our providers are based outside the UK and the EEA, principally in the United States. Where personal data is transferred internationally we rely on an adequacy decision where one applies, and otherwise on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or the Clauses themselves), together with any additional safeguards the transfer requires. You can ask us for details of the safeguards used for a particular provider.

Cookies. We use only cookies that are strictly necessary to run the service: keeping you signed in, remembering your chosen interface language, carrying you back to the right page after connecting a social account, and authorising a private preview of an unpublished website. We do not use advertising or third-party analytics cookies, so we do not show a cookie banner. Websites we build for you are served without tracking cookies unless you add something that sets them - if you do, getting the necessary consent is your responsibility.

Emails and push. Service messages (approval prompts, failures, billing) are part of the service and cannot be switched off while your account is open. Monthly summaries and quiet-account reminders can be stopped at any time by emailing support@vitellian.com. Push notifications can be turned off in the app or in your browser settings.

We keep data no longer than we need it:

• Account, business profile, content, enquiries, orders and bookings - for as long as your account is open. Deleting your account deletes them. A shared door-list link stops working six hours after the date starts, or as soon as you withdraw it.
• Research about your business - the website pages we read, the web mentions we found, our research records and the history of each fact about your business are kept for as long as your account is open, and deleted with it. A fact translated for display is kept until the fact changes. From Google Maps we keep only the listing’s place ID, never its other content. We may also process publicly available web pages to test and improve the service, and we keep what we use for that only briefly.
• Public facts about other organisations - facts about a third party found while researching you (a market you trade at, for example) may be kept in a shared record and reused for other businesses tied to it. It holds only public facts about that third party, never anything about you or anything you gave us.
• Social access tokens - deleted as soon as you disconnect the account or delete your account.
• Uploaded and generated media - deleted from our storage when you delete your account.
• Billing and transaction records - kept for six years after the end of the relevant accounting period, because UK tax and company law requires it. These are held largely by Stripe.
• Support correspondence - up to two years, so we can follow up on an issue.
• Security and abuse-prevention logs - up to 12 months.
• Anything already published to a social platform or sent to your own customers is outside our control and is not deleted by deleting your account.

We protect your data with measures appropriate to the risk, including encryption in transit, encryption at rest for sensitive items such as your social access tokens, database row-level security so one customer’s data cannot be read by another, least-privilege access for our own staff, rate limiting, and logging. No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to you, we will tell you and the regulator as the law requires.

You have the right to access your personal data, to have it corrected, to have it deleted, to receive a copy in a portable format, to restrict or object to certain processing, and to withdraw consent where we rely on it. Exercising these rights is free and we will respond within one month.

To exercise any of them, email support@vitellian.com. We may need to verify your identity first.

If you are named or pictured on a business’s pages and do not want us to hold your details, email support@vitellian.com with the business and what you want removed. We will remove your entry, or your photo, from what we hold for that business.

You can also complain to a data protection authority. In the UK that is the Information Commissioner’s Office (ico.org.uk, helpline 0303 123 1113); in the EEA it is the supervisory authority where you live. We would rather you told us first, so we can put it right.

You can delete your account and your data at any time. There are two ways:

• In the app (immediate) - go to Account → Delete account and confirm. This permanently deletes your account, your business profile, your posts and media, any website we host for you, your saved enquiries, orders and bookings, and all data obtained through Facebook or Instagram (including access tokens and stored comments). It also cancels your subscriptions, calls off and refunds any upcoming bookings (emailing the people affected), removes your custom domain from our hosting, and revokes the app’s access at Meta so it disappears from your Facebook settings. It cannot be undone.
• By email - send a request to support@vitellian.com from the email address on your account, with the subject “Data deletion request”.
• Disconnecting only - if you want to keep your account but revoke our access to a social account, disconnect it in your settings. This deletes the stored tokens for it.

An emailed request is actioned within 30 days, and we will confirm by email once it is done. The only things we keep are the billing and transaction records that tax and company law requires us to retain (section 11).

MaxMyMarket is a tool for businesses and is not directed to children. Our Terms require account holders to be at least 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it. You must not use the service to process children’s data.

We may update this policy. We will post the new version here and update the date above, and we will notify you of significant changes by email or in the service before they take effect.

Questions, requests, or concerns? Email support@vitellian.com, or write to Ameveo Limited, Mansion House, Manchester Road, Altrincham, Cheshire, WA14 4RW, United Kingdom.