Privacy Policy

MaxMyMarket(“we”, “us”, “our”) is an AI marketing assistant for small businesses, operated by Ameveo Limited, a company registered in England and Wales (company no. 14276820) with its registered office at Mansion House, Manchester Road, Altrincham, Cheshire, WA14 4RW, United Kingdom.

For questions, requests, or complaints about your data, contact us at support@vitellian.com or write to us at Mansion House, Manchester Road, Altrincham, Cheshire, WA14 4RW, United Kingdom.

This matters, because it decides who is answerable for what.

• We are the controller for data about you, our customer: your account, your business profile, the content you give us and we generate for you, your billing records, your support messages, and our security logs. The rest of this policy explains how we handle it.
• We are a processor acting for you for data about other peoplethat reaches us through your use of the service: people who comment on your posts, people who submit your website’s contact or enquiry forms, and customers who order through your website. For that data you are the controller. We process it only to run the service for you, on the terms in Annex A of our Terms. You are responsible for having a lawful basis for it and for telling those people about it in your own privacy notice.

If you are a member of the public and want to know why a business holds your data, contact that business. If you cannot reach them, contact us and we will pass your request on.

We only collect what we need to run the service:

• Account details - the email address and password you sign up with, and your sign-in history. Passwords are handled by our authentication provider and stored only in hashed form; we never see your plain password.
• Business profile - information you give us, or that we gather from publicly available sources such as your existing website, so we can write about your business accurately: name, website, description, locations, opening hours, products and services, brand voice, goals, and the things you want to promote.
• Content - images and short video clips you upload, and the posts, images, videos and website copy the assistant generates for you.
• Connected social accounts - when you connect Facebook or Instagram we store the access tokens and account identifiers Meta returns (for example your Page and Instagram Business account, and its profile picture). Tokens are encrypted at rest. We never receive or store your social-network password.
• Engagement data- to run the comment inbox and show your results, we read comments on your posts (including the commenter’s public name, platform ID and message) and engagement counts such as views, likes, comments and shares.
• Website enquiries - where we host a website for you, the name, email address and message of anyone who submits its contact or enquiry form, so we can save it for you and email you about it.
• Orders- where your website sells, the record of each completed sale: items, amounts, the customer’s email address, and any name and delivery address collected at checkout. Card details go to Stripe and never reach us.
• Domain registration details - if you buy a domain through us, the registration details required by the registrar and registry.
• Notifications - if you enable push notifications, the subscription details your browser provides so we can send approval prompts and reminders.
• Billing - your plan, subscription status, add-ons and usage counts. Payments are processed by Stripe; we do not store your card details.
• Support messages - anything you send us through the support form or by email.
• Technical data - server and error logs, and abuse-prevention records. For anonymous actions such as the public support form we record a hashed version of the IP address, so we can rate-limit abuse without keeping the address itself.

Where we are the controller, we rely on the bases below. “Contract” means the processing is necessary to deliver the service you signed up for; “legitimate interests” means we have weighed our interest against your rights and consider it fair and expected.

• Creating, scheduling and publishing your content - to the accounts you connect and the website we host for you. Basis: contract.
• Reading, classifying and (on eligible plans) replying to comments on your posts, and flagging the ones that need your decision. Basis: contract with you; you are the controller for the commenter’s data.
• Showing your post history, engagement and website activity. Basis: contract.
• Running your account, subscription, add-ons and support. Basis: contract, and legal obligation for accounting records.
• Service messages - approval prompts, publishing failures, billing notices, and (where your plan includes it) a monthly summary of your results. Basis: contract.
• Occasional reminders if your account goes quiet, asking whether anything is worth posting about. Basis: legitimate interests in helping you get value from a service you pay for. You can opt out at any time — see section 10.
• Push notifications, where you enable them. Basis: consent, which you can withdraw in the app or your browser.
• Keeping the service secure, preventing abuse and fraud, enforcing usage limits, and preventing repeat free trials. Basis: legitimate interests in protecting the service.
• Improving the service - diagnosing faults, and analysing anonymised, aggregated usage that does not identify you. Basis: legitimate interests.
• Complying with the law and establishing or defending legal claims. Basis: legal obligation and legitimate interests.

We do not sell your personal data, we do not use it for advertising or profiling, and we do not make decisions about you by purely automated means that produce legal or similarly significant effects.

To write and tailor your content we send the relevant business information - and, for comment replies, the comment text - to our AI provider, Anthropic (the maker of Claude), which processes it on our behalf to generate the result. Where images are generated or edited, the prompt and any reference photo you supply go to our image provider for the same purpose. Video rendering, where you use it, runs on our cloud infrastructure.

When it sets you up, builds your website, or advises on it, the assistant may also search the public web to learn about your business, which means a search provider receives the search terms.

These providers act as our processors. They do not use your data to train their models, and we do not use your data, or your customers’ data, to train any AI model of our own. AI output can be wrong; our Terms explain that you stay responsible for what is published.

When you connect Facebook or Instagram, our use of the data and permissions Meta grants us is limited to providing the features you ask for: publishing your posts, reading and replying to comments, and reporting your engagement. We comply with the Meta Platform Terms and Developer Policies. We do not sell this data, use it for advertising or profiling, or share it with anyone except the processors listed in section 8 who help us run the service. You can disconnect an account at any time in your settings, which deletes the stored tokens and revokes our access going forward. Section 11 explains how to have the data deleted.

Access is limited to the people who need it to run and support the service, under a duty of confidentiality. Our staff may access your account data to investigate a support request, to diagnose a fault, or to check that generated content and websites meet our standards. We log administrative access.

We do not sell your personal data. We share it only with service providers (“processors”, or “sub-processors” where we act for you), and only as needed:

• Supabase - database, authentication, and file storage hosting.
• Vercel - application hosting.
• Anthropic - AI text generation (Claude).
• Replicate - AI image generation and editing, where used.
• Amazon Web Services - video rendering, where you use the video feature.
• Stripe - subscription payments, and payments made to you through your website.
• Resend - sending support, notification and service emails.
• Cloudflare - content delivery, custom-domain routing for hosted websites, and bot/abuse protection on our sign-in forms, where enabled.
• Name.com - domain registration, where you buy a domain through us.
• The social networks you connect (Facebook, Instagram) - we send your posts and replies to them at your direction.

We may also disclose data where required by law or a valid legal request, to enforce our terms, or to protect our rights and the safety of others. If our business is reorganised, merged or sold, data may transfer to the acquirer under this policy.

This list is the sub-processor list referred to in Annex A of our Terms. We will give notice before adding a new one.

Some of our providers are based outside the UK and the EEA, principally in the United States. Where personal data is transferred internationally we rely on an adequacy decision where one applies, and otherwise on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or the Clauses themselves), together with any additional safeguards the transfer requires. You can ask us for details of the safeguards used for a particular provider.

Cookies. We use only cookies that are strictly necessary to run the service: keeping you signed in, remembering your chosen interface language, carrying you back to the right page after connecting a social account, and authorising a private preview of an unpublished website. We do not use advertising or third-party analytics cookies, so we do not show a cookie banner. Websites we build for you are served without tracking cookies unless you add something that sets them - if you do, getting the necessary consent is your responsibility.

Emails and push. Service messages (approval prompts, failures, billing) are part of the service and cannot be switched off while your account is open. Monthly summaries and quiet-account reminders can be stopped at any time by emailing support@vitellian.com. Push notifications can be turned off in the app or in your browser settings.

We keep data no longer than we need it:

• Account, business profile, content, enquiries and orders - for as long as your account is open. Deleting your account deletes them.
• Social access tokens - deleted as soon as you disconnect the account or delete your account.
• Uploaded and generated media - deleted from our storage when you delete your account.
• Billing and transaction records - kept for six years after the end of the relevant accounting period, because UK tax and company law requires it. These are held largely by Stripe.
• Support correspondence - up to two years, so we can follow up on an issue.
• Security and abuse-prevention logs - up to 12 months.
• Anything already published to a social platform or sent to your own customers is outside our control and is not deleted by deleting your account.

We protect your data with measures appropriate to the risk, including encryption in transit, encryption at rest for sensitive items such as your social access tokens, database row-level security so one customer’s data cannot be read by another, least-privilege access for our own staff, rate limiting, and logging. No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to you, we will tell you and the regulator as the law requires.

You have the right to access your personal data, to have it corrected, to have it deleted, to receive a copy in a portable format, to restrict or object to certain processing, and to withdraw consent where we rely on it. Exercising these rights is free and we will respond within one month.

To exercise any of them, email support@vitellian.com. We may need to verify your identity first.

You can also complain to a data protection authority. In the UK that is the Information Commissioner’s Office (ico.org.uk, helpline 0303 123 1113); in the EEA it is the supervisory authority where you live. We would rather you told us first, so we can put it right.

You can delete your account and your data at any time. There are two ways:

• In the app (immediate) - go to Account → Delete account and confirm. This permanently deletes your account, your business profile, your posts and media, any website we host for you, your saved enquiries and orders, and all data obtained through Facebook or Instagram (including access tokens and stored comments). It also cancels your subscriptions. It cannot be undone.
• By email - send a request to support@vitellian.comfrom the email address on your account, with the subject “Data deletion request”.
• Disconnecting only - if you want to keep your account but revoke our access to a social account, disconnect it in your settings. This deletes the stored tokens for it.

An emailed request is actioned within 30 days, and we will confirm by email once it is done. The only things we keep are the billing and transaction records that tax and company law requires us to retain (section 11).

MaxMyMarket is a tool for businesses and is not directed to children. Our Terms require account holders to be at least 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it. You must not use the service to process children’s data.

We may update this policy. We will post the new version here and update the date above, and we will notify you of significant changes by email or in the service before they take effect.

Questions, requests, or concerns? Email support@vitellian.com, or write to Ameveo Limited, Mansion House, Manchester Road, Altrincham, Cheshire, WA14 4RW, United Kingdom.