1. Introduction

Maxfusion AI s.r.o. (“Controller,” “we,” “us,” or “our”), a company registered in the Czech Republic, with its registered office at Školská 660/3, Hlavní město Praha, 110 00, Praha 1, Czech Republic, is committed to protecting the privacy and security of your personal data. This Privacy Policy outlines how we collect, use, disclose, and safeguard your personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation or “GDPR”) when you use the Maxfusion website, platform, API and MCP server (together, the “Platform”), including through AI assistants you connect to it.

2. Data Controller

The data controller responsible for the processing of your personal data is:

Maxfusion AI s.r.o.
Company ID (IČO): 24091375
Školská 660/3, Hlavní město Praha, 110 00, Praha 1, Czech Republic
Email: info@maxfusion.ai

3. Data Collection

We may collect personal data that directly or indirectly identifies you, including:

• Identification Data: Full name, email address.

• Professional Data: Company name, position/function, company size, company website, logo.

• Login Data: Logs, IP address.

• Third-Party Authentication Data: Name and email collected when you sign in with Google.

• Browsing Data: IP address, pages viewed, date and time of connection, browser used, operating system, user ID, location data.

• Usage Data: Your activity on the Platform, such as the tools you use, your generations, and your credit usage and transactions.

• Content Data: Prompts, scripts and other text you enter; images, videos, audio and voice samples you upload; and the images, videos, audio and voices you create on the Platform.

• Connection Data: The AI assistants and integrations (such as Google Drive, Asana or ElevenLabs) you connect, and the access tokens or API keys needed to keep them connected.

• Communication Data: Messages you send us by email or chat, and the content of calls with our team.

• Billing Data: Billing name and address, tax ID, invoices and payment history, and bank details when you pay by bank transfer. Card payments are processed by our payment provider; we do not receive or store your full card number.

• Contact Data: Information provided in contact requests.

We shall specify whether providing certain data is mandatory or optional at the time of collection.

4. Legal Basis and Purposes of Processing

We process personal data for the following purposes, based on the specified legal grounds and retention periods:

Processing Purpose: Provision of services through the Platform.
Legal Basis: Performance of a contract, or pre-contractual steps at your request.
Data Retention Period: Account duration, including API and AI assistant request logs; Archived for 5 years for evidentiary purposes.

Processing Purpose: Generating, editing and storing the content you request, and sharing it with the members of your workspace.
Legal Basis: Performance of a contract.
Data Retention Period: While your account is active. You can delete content from your workspace at any time and ask us to erase it completely.

Processing Purpose: Ad research based on publicly available content (Research Lab).
Legal Basis: Legitimate interest.
Data Retention Period: While the content is saved in a workspace.

Processing Purpose: Contract management, order processing, invoicing, and customer relationship management.
Legal Basis: Performance of a contract.
Data Retention Period: Duration of business relationship; Transaction data (excluding banking data): 5 years for evidentiary purposes; Contract and signature data: 10 years; Credit card data retained by payment service provider.

Processing Purpose: Improvement of services.
Legal Basis: Legitimate interest.
Data Retention Period: Personal data: 6 months.

Processing Purpose: Management of user opinions on products, services, or content.
Legal Basis: Legitimate interest.
Data Retention Period: 2 years from publication of opinion.

Processing Purpose: Creation of customer and prospect database.
Legal Basis: Legitimate interest.
Data Retention Period: Customers: Duration of business relationship; Prospects: 3 years from last contact.

Processing Purpose: Sending newsletters, requests, and direct marketing mailings.
Legal Basis: Legitimate interest.
Data Retention Period: 3 years from last contact.

Processing Purpose: Responding to information requests and inquiries.
Legal Basis: Legitimate interest.
Data Retention Period: 3 years from last contact.

Processing Purpose: Compliance with legal and regulatory obligations.
Legal Basis: Legal obligations.
Data Retention Period: Invoices: 10 years; Transaction data (excluding banking data): 5 years for evidentiary purposes; Contract and signature data: 10 years.

Processing Purpose: Analytics, advertising and improvement of Platform functionality (cookies and similar technologies).
Legal Basis: Consent.
Data Retention Period: 25 months.

Processing Purpose: Processing data subject requests to exercise their rights.
Legal Basis: Legitimate interest.
Data Retention Period: Proof of identity retained only for verification purposes and then deleted.

Where we rely on legitimate interest, our interest is to run, secure, improve and promote our business in the way described in that purpose. You can object to this processing at any time.

5. AI Processing, AI Assistants and Integrations

AI processing. To produce a result, we send the inputs it needs, such as your prompt and the images or audio you selected, to the AI service provider that runs the selected model, and we store the result in your workspace.

AI assistants and API. You can use the Platform from AI assistants such as ChatGPT and Claude, and through our API. When you connect an assistant, you sign in with your Maxfusion account. The assistant then sends us only what it passes to Maxfusion tools to carry out your requests, and we return the results to it. We do not receive your other conversations with the assistant, and the assistant’s provider handles your conversation under its own privacy policy. We keep a log of which tool ran, when, and with what outcome, without storing the full request in it. You can revoke an assistant’s access at any time in Settings > MCP.

Integrations. If you connect Google Drive, Asana or ElevenLabs, we use the connection only to carry out the actions you request, such as saving a file to a folder you choose. API keys you provide are stored encrypted. You can disconnect an integration at any time in Settings > Integrations.

Workspaces. Members of a workspace share its projects and content, and the workspace owner and admins can see each member’s usage.

Other people in your content. If your content includes other people, for example their face or voice, you must have their permission. We process that personal data on your behalf, as a processor, as set out in clause 19 of our Terms and Conditions.

Publicly available content. Research Lab shows ads and posts that are publicly available on platforms such as the Meta Ad Library, TikTok and Instagram, including the public names and handles of the accounts that published them. If you appear in such content and want it removed from Maxfusion, contact us.

6. Data Recipients

Your personal data may be disclosed to:

• Our employees.

• Our data processors, including AI service providers, lipsync providers, generative voice AI providers, hosting service providers, newsletter sending service providers, audience measurement and analysis service providers, advertising partners (such as Google and Meta), customer support tools, electronic messaging service providers, secure payment service providers, invoicing tools, cookie management tools.

• AI assistants and integrations you choose to connect, which receive the results of the actions you request.

• Public and private organizations, when required by law.

7. International Data Transfers

Your personal data is hosted on servers located within the European Union. However, in the context of our processing activities, data may be transferred outside the European Union. Such transfers are safeguarded as follows:

• Transfers to countries with an adequacy decision by the European Commission.

• Transfers to countries without an adequacy decision, based on appropriate safeguards such as Standard Contractual Clauses, Binding Corporate Rules, or approved certification mechanisms.

• Other transfers under appropriate safeguards as per Chapter V of the GDPR.

8. Data Subject Rights

You have the following rights:

• Right to be informed: About the collection and use of your personal data.

• Right of access: To obtain confirmation that your data is being processed and to access it.

• Right to rectification: To correct inaccurate or incomplete data.

• Right to restriction of processing: To limit the processing of your data under certain circumstances.

• Right to erasure (“right to be forgotten”): To request the deletion of your data.

• Right to lodge a complaint: With a supervisory authority. In the Czech Republic, this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.gov.cz).

• Right to withdraw consent: At any time, where processing is based on consent.

• Right to data portability: To receive your data in a machine-readable format and to have it transferred to another controller.

• Right to object: To processing of your data under certain circumstances.

You can unsubscribe from marketing emails at any time using the link in every email. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.

To exercise these rights, contact us at info@maxfusion.ai or Maxfusion AI s.r.o., Školská 660/3, Hlavní město Praha, 110 00, Praha 1, Czech Republic. We may require identity verification.

9. Children’s Privacy

Our services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will take steps to delete it promptly.

10. Cookies

We use cookies and similar technologies to keep you signed in, to remember your preferences, to measure how the website and Platform are used, and to measure our advertising and make it more relevant to you. You can give, refuse or change your consent to analytics and advertising cookies in the cookie settings on our website, and you can block or delete cookies in your browser.

11. Contact Information

For data privacy matters, contact:

Email: info@maxfusion.ai

Address: Maxfusion AI s.r.o., Školská 660/3, Hlavní město Praha, 110 00, Praha 1, Czech Republic

12. Modifications

We may update this Privacy Policy to reflect changes in our practices or legal obligations. The updated version will be effective upon posting. We will notify you of significant changes.