Privacy Policy

MaxMyMarket (“we”, “us”, “our”) is an AI marketing assistant for small businesses, operated by Ameveo Limited, a company registered in England and Wales (company no. 14276820) with its registered office at Mansion House, Manchester Road, Altrincham, Cheshire, WA14 4RW. We are the data controller for the personal data described in this policy.

If you have any questions about this policy or your data, contact us at support@vitellian.com.

We only collect what we need to run the service for you:

• Account details - the email address and password you sign up with. Passwords are handled by our authentication provider and stored only in hashed form; we never see your plain password.
• Business profile - information you give us or we gather about your business to write your marketing: name, website, description, locations, products and services, and brand voice.
• Content - images and short video clips you upload, and the posts and videos the assistant generates for you.
• Connected social accounts - when you connect Facebook or Instagram, we store the access tokens and account identifiers Meta returns (e.g. your Page and Instagram Business account). Tokens are encrypted at rest. We never receive or store your social-network password.
• Engagement data- to run the comment inbox and show your results, we read comments on your posts (including the commenter’s public name and message) and engagement counts (views, likes, comments, shares) from the platforms you connect.
• Notifications - if you enable push notifications, the subscription details your browser provides so we can send approval prompts.
• Billing - your plan and usage counts. Payments are processed by Stripe; we do not store your card details.
• Support messages - anything you send us through the support form or by email.
• Technical data - standard logs and cookies needed to keep you signed in and operate the service securely.

• To create, schedule, and publish marketing content - posts, images, and videos - to the accounts you connect.
• To read and (on eligible plans) reply to comments on your posts, and to flag the ones that need your decision.
• To show you your post history and engagement results.
• To operate your account, process your subscription, and provide support.
• To keep the service secure and prevent abuse.

Our lawful bases for processing are the performance of our contract with you (running the service you signed up for), our legitimate interests in operating and securing the service, and your consent where required (for example, push notifications).

To write and tailor your content, we send the relevant business information (and, for comment replies, the comment text) to our AI provider, Anthropic (the maker of Claude), which processes it on our behalf to generate the result. Where you use AI image generation, the prompt is sent to our image provider for the same purpose. These providers act as our processors and do not use your data to train their models for this service. We do not use your data to train our own models.

When you connect Facebook or Instagram, our use of the data and permissions Meta grants us is limited to providing the features you ask for — publishing your posts, reading and replying to comments, and reporting your engagement. We comply with the Meta Platform Terms and Developer Policies. We do not sell this data, use it for advertising or profiling, or share it with any party except the processors listed below who help us run the service. You can disconnect an account at any time, which revokes our access going forward.

We do not sell your personal data. We share it only with service providers (“processors”) who help us operate, and only as needed:

• Supabase - database, authentication, and file storage hosting.
• Anthropic - AI text generation (Claude).
• Replicate - AI image generation, where used.
• Amazon Web Services - video rendering, where you use the video feature.
• Stripe - subscription payments.
• Resend - sending support and service emails.
• Vercel - application hosting.
• Cloudflare - content delivery and bot/abuse protection on our sign-in forms, where enabled.
• The social networks you connect (Facebook, Instagram) - we send your posts and replies to them at your direction.

We may also disclose data where required by law, or to protect our rights and the safety of others.

Some of our providers are based outside the UK/EEA. Where personal data is transferred internationally, we rely on appropriate safeguards (such as the providers’ standard contractual clauses or equivalent protections).

We keep your data for as long as your account is active. If you delete your account or ask us to erase your data, we remove it (or anonymise it) without undue delay, except where we must keep certain records to meet legal or accounting obligations. Disconnected social tokens are deleted when you disconnect an account.

We protect your data with industry-standard measures, including encryption in transit and encryption at rest for sensitive items such as your social access tokens. No system is perfectly secure, but we work to keep your data safe and to limit who can access it.

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to object to certain processing or withdraw consent. To exercise any of these, email support@vitellian.com. You also have the right to complain to your local data protection authority (in the UK, the Information Commissioner’s Office at ico.org.uk).

You can request deletion of your data and account at any time. There are two ways:

• In the app - disconnect your social accounts (this revokes our access and removes the stored tokens), and contact us to close your account.
• By email - send a deletion request to support@vitellian.com from the email address on your account, with the subject “Data deletion request”.

We will delete your personal data, including any data obtained through Facebook or Instagram, within 30 days, except where we are legally required to retain certain records. We will confirm by email once it’s done.

MaxMyMarket is a tool for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy from time to time. We’ll post the new version here and update the date above; significant changes will be notified to you where appropriate.

Questions, requests, or concerns? Email support@vitellian.com.