Privacy Policy.

This policy explains what data Maja collects, why we collect it, how we protect it and what rights you have over it. It applies to the Maja web application and everything you connect to it.

Account data: your email address, name if you provide one, and subscription status.

Connection credentials: the API keys, tokens and OAuth grants you provide so Maja can read your tools.

Performance data: metrics read from your connected tools, such as ad spend, clicks, emails sent, reply rates, leads and campaign names.

Product usage: your conversations with Maja, reports generated, actions proposed and approved, and basic technical logs.

We use your data solely to operate the Service: to read your tools, generate your reports and insights, execute the actions you approve, provide support, process payment, and keep the Service secure and working. The legal basis is performance of our contract with you, and our legitimate interest in securing and improving the Service.

We do not sell your data. We do not share it with advertisers. We do not use your business data to train third-party AI models.

API keys and tokens are encrypted at rest with AES-256-GCM and are only ever decrypted server-side, for the duration of a request to the corresponding tool. They are never exposed in the application interface and are not readable by our team.

Connections are read-only by default. Any operation that changes something in your tools requires your explicit in-app approval.

We use a small number of vendors to run the Service: our hosting and database platform, Stripe for payment processing, an email delivery provider for transactional email, and AI model providers to generate analysis. Each processes data only on our instructions and only as needed to provide their part of the Service.

The tools you connect remain independent controllers of the data in their own systems, governed by their own privacy policies.

Performance metrics, reports and conversation history are retained while your account is active so Maja can compare periods and keep context. When you disconnect a tool, its stored credentials are deleted immediately. When you delete your account, your data is deleted within 30 days, except records we must keep for accounting or legal obligations.

If you are in the EU or UK you have the right to access, correct, export, restrict, or erase your personal data, and to object to processing. You can disconnect any tool and delete your account yourself at any time from the app, or contact us to exercise any of these rights. We respond within 30 days.

Some of our processors operate outside the EU. Where data is transferred internationally, we rely on Standard Contractual Clauses or an equivalent lawful transfer mechanism.

We use only the cookies and local storage needed to keep you signed in and to remember basic preferences. We do not use advertising or cross-site tracking cookies.

We will notify you by email of material changes to this policy before they take effect. For any privacy question or request, reach us through our contact page.