Privacy Policy

Effective: 27 October 2026

This policy explains how we handle your personal data. We believe in plain language - this is written to be understood, not to obscure.

Maxiful AB (company number 559606-5135) ("we", "us", "our") is the data controller for the personal data described in this policy. We are a Swedish limited company with our registered office in Lidingö, Sweden; our full registered address is in our legal notice at maxiful.ai/imprint. We comply with both the UK GDPR and the EU General Data Protection Regulation (EU GDPR).

For any privacy-related questions or to exercise your rights, contact us at [email protected].

Data we process on our servers

We keep server-side data to a minimum. Here is exactly what we store:

Data that stays on your computer

Your agent runs locally on your computer. The following data is stored only on your computer; we do not keep a copy of it on our servers:

• Email content (accessed via the Gmail API, stored on your machine)
• Calendar events (accessed via the Google Calendar API, stored on your machine)
• Files in your documents and folders
• Conversation history with your agent (local database)
• Agent memory: things your agent remembers (local database)

Keeping this data local is a core design principle. There are three important exceptions you should know about: when your agent uses cloud AI reasoning, the parts of this data it includes in a request are transmitted through our model proxy (see the next section); when your agent acts in an app you connected under More work apps, what that action sends and returns passes through our connection partner, Composio, which holds that app's sign-in for us and keeps each action for up to a year, in the United States (see Our sub-processors); and if you opt in to a remote support session, our staff can access your machine for the duration of that session with your consent. Third-party marketplace agents you install also run on your machine under your control, and their data handling is described by their publisher.

Cloud AI reasoning (prompt content in transit)

When your agent needs cloud AI reasoning, it sends a request through our model proxy to the AI model provider handling that call. The request content can include excerpts of the data listed above, for example, an email your agent is drafting a reply to, or parts of a file it is working on, as well as, at times, other people's personal data contained in that material.

We process this content transiently to route the request and do not store its content or use it to train models. For up to 7 days we keep usage metadata about each call, linked to your account: the model name, the provider that served the call, the token counts, the cost and the time of the call, your plan tier at the time of the call, and technical fingerprints of the call. The fingerprints are the identifier the AI service gave the request, how its cost and cached input were counted, and a short digest of each earlier message in the conversation. A digest cannot be turned back into the message. We keep this metadata so your usage dashboard works and so we can tell whether a call could reuse the provider's cache. A separate record enforces your plan's daily and weekly AI budget: it holds your account's AI spend so far today, this week and this month, and the credit left on your AI key, with no detail of individual calls and no content, and it is kept for up to 3 hours after it was last updated. The table above lists both records. The legal basis is performance of our contract with you (Art. 6(1)(b)).

By default we select model providers whose terms prohibit training on customer content and limit retention to short-term operational and abuse-monitoring windows, unless the workspace owner allows providers that may train, which Maxiful holds off once a Google account has been connected. These providers are described in the sub-processors and international-transfers sections below.

A voice note sent to your agents that your computer's own speech recognition cannot make out is sent through our model proxy to the AI model provider to be written out, unless you turn off Transcribe voice notes or turn on Keep conversations on this computer in the app. We process the audio transiently, as we do prompt content, and do not store it.

Who is responsible for your data

For the data we process on our servers (listed in the first section) and for prompt content while it is in transit through our model proxy, we are the data controller.

For the personal data your agent processes locally on your computer, you are the data controller. We do not determine the purposes or means of that local processing, and we act neither as controller nor as processor for it. If you use the service in the course of a business, for example, processing your clients' or contacts' personal data, you are responsible for having a lawful basis for that processing and for meeting your own obligations as a controller.

Our sub-processors

These third parties process data on our behalf to help us deliver Maxiful:

Third-party services you connect

Your agent can connect to services that you authorise. These providers process your data as your own service providers, under their own privacy policies; they do not process it on our behalf. We do not keep the content they hold. When you ask an assistant to work on it, the parts the answer needs pass through our model proxy and OpenRouter to the AI model provider that writes the answer, as described in "Cloud AI reasoning" above and, for Google, in the Google account data sections below.

• Google: email, calendar and file access via OAuth that you authorise (policies.google.com/privacy).
• Telegram: your chosen messaging channel with your agent (telegram.org/privacy).

If you install third-party marketplace agents, they run on your machine under your control and any data handling they perform is governed by their publisher, not by us.

Legal basis for processing

We process the data we are responsible for under the following legal bases:

• Contract performance (Art. 6(1)(b)): your account data, service delivery, and prompt content routed through our model proxy. We need this to provide the service you signed up for.
• Legal obligation (Art. 6(1)(c)): billing records (the Swedish Bookkeeping Act, bokföringslagen, requires 7 years) and consent records.
• Legitimate interest (Art. 6(1)(f)): telemetry and setup diagnostics (skill names, uptime, error counts, installation events) for service reliability. This contains no message or file content.
• Consent (Art. 6(1)(a)): where we specifically ask for it, such as file uploads during onboarding. When you connect a third-party service such as Google, you authorise that provider directly; the resulting data is processed on your machine, and you act as its controller.

Data retention

We don't keep data longer than necessary:

• Account data (name, email, tier): duration of subscription + 6 months, then deleted.
• Billing records: 7 years (required by the Swedish Bookkeeping Act, bokföringslagen), then deleted.
• Telemetry and setup diagnostics: rolling windows (telemetry 90 days; setup diagnostics up to 12 months). Older records are purged automatically.
• Consent records: subscription duration + 6 years (legal obligation).
• Demo questionnaire answers: the stored answers are deleted automatically after 12 months. A copy is also sent to our mailbox to prepare the demo; we keep it while we are in contact with you about it, delete it on request, and delete it within 12 months if no agreement follows.
• Design-partner applications: the stored answers are deleted automatically after 12 months. A copy is also sent to our mailbox. We read and assess each application at Maxiful AB with our own Maxiful assistant, whose AI models are reached through OpenRouter (listed above), and a person at Maxiful AB decides every invitation. We delete the copy on request, and within 12 months if no agreement follows. We keep the company's name and company number, and whether it had a free month, so that each company has one free month only.
• Prospect contact details: deleted 90 days after our last email if there is no reply. When someone asks us to stop, we delete their details the same day and keep only a suppression entry (email address, firm, date and reason), solely so that we never write to them again.
• Single sign-on records: kept and deleted with the account data of the organisation or person they belong to. A sign-in's hashed address is deleted when the sign-in finishes, otherwise when a later sign-in starts more than an hour after it.

When you cancel, we delete your account data within 6 months, except records we are legally required to keep, such as invoices for tax law, which we keep for the statutory period and then delete. Data on your computer remains yours; we claim no ownership of it and keep no copy of it on our servers.

Your rights

Under UK GDPR and EU GDPR, you have the right to:

• Access - request a copy of all personal data we hold about you.
• Rectification - correct inaccurate data.
• Erasure - request deletion of your data (subject to legal retention requirements for billing).
• Portability - receive your data in a machine-readable format.
• Objection - object to processing based on legitimate interest.
• Restriction - request that we limit how we process your data.

To exercise any of these rights, email [email protected]. We will respond within one month.

Right to complain

If you are not satisfied with how we handle your data, you have the right to complain to a supervisory authority:

Sweden, our lead supervisory authority: Integritetsskyddsmyndigheten (IMY), imy.se

If you are in the United Kingdom: Information Commissioner's Office (ICO), ico.org.uk | 0303 123 1113

EU: You may also contact the data protection authority in your EU/EEA member state.

US residents

We do not sell your personal information as defined under the California Consumer Privacy Act (CCPA/CPRA) or any other US state privacy law.

If you are a California resident, you have the right to: know what personal information we collect and how it is used; request deletion of your personal information; opt out of the sale of personal information (we do not sell it); and not be discriminated against for exercising your rights.

To exercise any of these rights, contact us at [email protected].

Canadian residents

If you are a Canadian resident, your personal information is handled in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA).

You have the right to: access your personal information held by us; challenge the accuracy and completeness of your information; and withdraw consent to the collection, use or disclosure of your information.

Our privacy officer can be reached at [email protected]. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.

Cookies

We use minimal cookies and local storage:

• Authentication session cookie - required to keep you signed in.
• Theme preference - stored in your browser's localStorage (light/dark mode).
• Language preference - stored in your browser's localStorage.
• Homepage version cookie (mx_v) - set only on the homepage. It remembers which version of the homepage you saw (a single letter, A to F) for 30 days, so Maxiful can learn which version helps people sign up. It contains nothing else. If you sign up, that letter is recorded with your sign-up.
• Films from YouTube - the First Day films on our homepage play in YouTube's privacy-enhanced mode (youtube-nocookie.com). The first loads with the homepage and plays muted; the others load when you scroll to them. If your device asks for reduced motion, none loads until you press play. YouTube may store information in your browser under the Google Privacy Policy (https://policies.google.com/privacy).

Apart from mx_v, which is our own and is never shared with advertisers or other websites, we do not use cookies to measure visits, and we use no third-party advertising cookies. For site traffic insight, we use Cloudflare Web Analytics: cookieless and privacy-preserving, with no cross-site tracking. We do not use Google Analytics.

Marketplace purchases

If you buy a third-party Artifact from the marketplace, we process the purchase and entitlement so that you can access the Artifact and so that the Publisher can be paid. This is done on the basis of performing our contract with you.

We share with the Publisher the information needed to fulfil and account for the sale (for example, that a purchase was made and any information required for tax and payout purposes). We do not give Publishers access to the data your agent processes locally. Installed Artifacts run on your machine under your control, and their own data handling is described by their Publisher.

People we contact about Maxiful

We write to a small number of businesses, such as recruitment firms, to tell them about Maxiful. For each firm we hold one professional contact: the name and role of the person who would decide on Maxiful and the work email address the firm itself publishes (or the firm's general address), with public facts about the firm such as its company number, size, specialism and website. We take these from public sources only: public company registers, the firm's own website and public news.

We use these details only for outreach about Maxiful by our founder: at most three short emails. The first says where we found the address, and every email says how to stop further emails. Our legal basis is our legitimate interest in offering a relevant product to a business, reaching the person in their professional role (Art. 6(1)(f)). Our founder drafts the emails with the help of Claude, an AI assistant made by Anthropic in the United States, which processes these details to prepare the drafts. Our founder sends the emails from our Microsoft 365 mailbox.

If there is no reply, we delete a contact's details 90 days after our last email. If someone asks us to write again later, we keep their details until that follow-up and delete them if there is no answer. If someone replies and we start talking, we keep what that conversation needs while it lasts.

You can object at any time by replying to any of our emails ("no thanks" is enough) or by writing to [email protected], and we always honour an objection to this kind of email. We then stop writing and delete your details the same day, keeping only a suppression entry (your email address, your firm, the date and the reason) so that we never write to you again. You also have the rights described in "Your rights" above, and you can complain to Integritetsskyddsmyndigheten (IMY), imy.se.

International data transfers

Some of our sub-processors are based outside the EU/EEA. Where we transfer personal data outside the EU/EEA, we rely on the safeguards identified below:

• Cloud AI model providers - United States and EU. Prompt content is processed transiently for inference under Standard Contractual Clauses or an equivalent transfer mechanism; by default, providers' terms restrict training and limit retention, unless the workspace owner allows providers that may train, which Maxiful holds off once a Google account has been connected.
• Stripe - United States and EU, under Standard Contractual Clauses and/or EU-U.S. Data Privacy Framework certification.
• Cloudflare - global CDN, and storage of the records we keep on our servers (such as accounts and demo questionnaire answers).
• Resend - United States, under Standard Contractual Clauses and/or EU-U.S. Data Privacy Framework certification.
• Microsoft - United States and EU, under Standard Contractual Clauses and/or EU-U.S. Data Privacy Framework certification.
• OpenRouter - United States, for routing your assistants' requests from our model proxy to the AI model provider, for the one-time automated check of demo questionnaire answers and design-partner applications, and for our own Maxiful assistant's reading of design-partner applications.
• Composio (Sampark, Inc., a Delaware company with offices in San Francisco, California) - United States, under the Standard Contractual Clauses of its Data Processing Addendum, for the apps you connect under More work apps.

If you choose Telegram as your messaging channel or connect Google, your messages and content are handled by those providers under their own privacy policies, as services you connect at your own choice, rather than as transfers we make.

Google account data: what Maxiful can do and why

This section and the two after it apply when you connect a Google account to Maxiful, the app Maxiful AB publishes. They cover the data Maxiful receives from Google through that connection, and where they say more about Google data than the rest of this policy, they govern.

You give the access on Google's own consent page. Only your own assistants use it; colleagues you invite never get the connection. With it, your assistants can:

• read and search your Gmail, write drafts, organise your inbox (labels, read or unread, archive), send mail and move mail to the Trash. Maxiful never asks Google for the access that deletes mail for good;
• see the events in your Google calendars and the list of calendars you have, and add, change or delete events;
• find and read any of your Google Drive files, and create folders, upload files and update files, each of these changes waiting for your yes on a card;
• read and edit your Google Docs and Sheets;
• see your Google address, so Maxiful knows which account is connected.

Your assistants use Google data only to do what you ask of them in the app: answering your questions about your mail, calendar and files, preparing the briefings you ask for, and doing the work you give them. Reading and drafting happen on their own. Every send, new event, change, move or delete waits for your yes on a card first, unless you let an assistant do that kind of thing without asking in Settings, Approvals. You can make the connection read-only at any time in Settings, Access. We use Google data for nothing else.

Google account data: where it goes and how long it is kept

Your Google sign-in is kept on your computer: in the macOS Keychain, and in an encrypted file in Maxiful's own folder on Windows. It is never sent to our servers.

Google data is read on your computer. What an assistant reads can stay in that conversation and in the assistant's memory on your computer until you delete them.

When an assistant needs a cloud AI model to answer you, the parts of your Google data that the answer needs, for example the text of the email you asked about, are sent through our model proxy and OpenRouter to the AI model provider that writes the answer, as described in "Cloud AI reasoning" above. We process this content only to route the request, and we do not store it. We route it only to model providers that do not train on what they receive: once a Google account has been connected on your computer, Maxiful sends nothing to a provider that may train, whatever the setting that allows such providers says, until you explicitly clear that Google has been connected; some providers keep requests for a limited time under their own terms, for example to detect abuse. For up to 7 days we keep the usage metadata described in that section, which holds no content. An assistant on one of your own subscriptions (ChatGPT or Codex, Grok, or Claude) sends its requests from your computer to that provider under your own account and the provider's terms, not through our model proxy, so it can use your Google tools only after you confirm, in the Google connection's settings and for that subscription, that model training is switched off on that account (for Claude, "Help improve Claude"). Each confirmation is off until you turn it on, only you can change it, each change is recorded, and you can turn it off again at any time; without it, Maxiful refuses the Google tools for that assistant and says which setting to change. With a model on your own computer, your Google data stays on your computer.

Google data also goes where your assistants answer you. On your phone, their answers pass through our relay encrypted, as described in "Your phone: the relay and the push service" below. In a chat app you talk to them in, such as Slack or Telegram, their answers are delivered by that app's service under its own privacy policy. In a chat you share with a colleague, the colleague sees what your assistant writes there.

You can disconnect Google at any time on the Connections page in Maxiful. Maxiful takes the access back at Google, then removes the sign-in from your computer; if Google cannot be reached, Maxiful says so, keeps the sign-in and offers to disconnect again until Google takes the access back or you dismiss it. You can also remove Maxiful's access in your Google Account at https://myaccount.google.com/permissions.

Maxiful AB is the controller for Google data while it passes through our model proxy. For the Google data your assistants process on your computer, "Who is responsible for your data" above applies.

Google account data: Limited Use

Maxiful's use of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Google Workspace APIs are not used to develop, improve, or train non-personalized AI and/or ML models.

In particular, we never:

• sell Google data;
• use it for advertising, or transfer it to advertising platforms, data brokers or information resellers;
• use it to determine creditworthiness or for lending;
• use it, or let the model providers we route it to use it, to create, train or improve AI or machine-learning models: once a Google account has been connected on your computer, Maxiful holds off every provider that may train until you explicitly clear that Google has been connected, and we let an assistant on one of your own subscriptions use it only after you confirm that model training is switched off on that account;
• transfer it to anyone except as these sections describe, to keep the service secure, to comply with the law, or, with your consent given beforehand, in a merger or sale of our business.

Our staff do not read your Google data unless you ask us to look at a specific message, event or file (in a remote support session you start, we open only what you ask us to), it is needed for security, such as investigating abuse, or the law requires it.

Your phone: the relay and the push service

When you use Maxiful on your phone, two services carry messages between your phone and your computer. Maxiful AB runs both, on Cloudflare.

The relay passes messages between your phone and your computer. Each message is encrypted on the device that sends it and opened only on the device that receives it: the relay holds no key and cannot read it. While one side is offline, the relay keeps the encrypted messages waiting for it for up to 7 days and delivers what it still holds when it reconnects; if too many messages wait, the oldest are dropped to make room. A message is deleted as soon as it is delivered, and one still waiting after 7 days is never delivered and is deleted within the following hour.

The push service lets your phone know that something is waiting for you. It keeps your phone's notification address, with what it needs to check that a notification comes from your own computer, and never a message. A message passes through it still encrypted to your phone and is not kept. A reminder that an approval is waiting carries no message, only that it is an approval and a code your phone matches it to; the push service remembers that code for an hour so the same reminder is never sent twice. Apple delivers both to your iPhone with the same general alert every time, and neither the push service nor Apple can read any message.

To have what either service holds about you erased, email [email protected].

Our YouTube channel and the YouTube API

Maxiful publishes its own guide films on YouTube (youtube.com/@maxiful) using YouTube API Services, through an internal tool that only our team uses to upload to that one channel. It does not access, collect or store any YouTube data about you or any other YouTube user. By watching our films on YouTube you are subject to the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://policies.google.com/privacy). We keep only the identifiers of our own uploaded videos. Our access to our own YouTube account can be revoked at any time through Google's security settings (https://security.google.com/settings/security/permissions), and we delete the stored access token when we stop using the tool.

Changes to this policy

If we make changes to this privacy policy, we will notify you by email. The updated effective date will always be shown at the top of this page.

We will never reduce your rights under this policy without giving you clear notice.