PRIVACY POLICY

MaxximusAI, Inc. ("Maxximus," "we," "us," or "our") operates the Maxximus AI platform, including the website at maxximus.ai, our mobile applications (iOS and Android), and our AI coaching services (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. INFORMATION WE COLLECT

1.1 Information You Provide Directly

• Name and email address (account creation, preview program enrollment)
• Coaching conversations and text exchanges you submit to our AI
• Per-message feedback ratings (thumbs up/down) and the content of messages you rate, collected to evaluate and improve AI coaching quality
• Free-text session feedback you choose to submit, including session context such as message count
• Responses to onboarding questions ("The Initiation")
• Profile information and preferences
• Photos, screenshots, and profile images you upload through Connection Files (sent to SpaceXAI to generate coaching insights — not shared with anyone else)
• Payment information (processed securely via Stripe — we do not store card numbers)
• Content you post in The Forum community feature
• Voice dictation you use within the app — audio is sent to SpaceXAI for speech-to-text processing; only the resulting text is retained
• Reports and blocks you submit about other users or content

1.2 Information Collected Automatically

The information collected automatically differs between our mobile app and our website:

Mobile app:

• Device information (device type, operating system, app version)
• Push notification tokens (if you enable push notifications)

The mobile app contains no analytics, advertising or crash-reporting SDKs and does not determine your location.

Website (maxximus.ai):

• IP address and approximate location (derived from IP only — we do not access GPS or precise location)
• Usage data (features used, session duration, screens visited)
• Log data and crash reports
• Cookies and similar tracking technologies

1.3 Mobile Application Permissions

When you use the Maxximus mobile application, we may request access to the following device features:

• Photo Library / Camera Roll: To allow you to upload photos and screenshots for Connection Files and profile setup. We access only the images you explicitly select — we do not scan your photo library.
• Microphone: For voice dictation only — to let you speak your messages instead of typing them. Audio is processed by SpaceXAI for speech-to-text; only the resulting text is retained. We do not record or store audio.
• Push Notifications: To send you coaching reminders, Forum activity, and service updates. You may disable push notifications at any time through your device Settings.
• Internet Access: Required to communicate with our servers and deliver AI coaching responses.

We request only the permissions necessary to provide the features you use. You may revoke any permission at any time through your device Settings, though this may limit certain features.

1.4 Sign-In Methods

The Maxximus mobile application supports the following sign-in options only:

• Apple Sign In — governed by Apple's Privacy Policy (apple.com/privacy)
• Google Sign In — governed by Google's Privacy Policy (policies.google.com/privacy)
• Email and password — stored securely via Supabase authentication

The Maxximus mobile application does not integrate with Meta (Instagram/Facebook), TikTok, or any other social media platform for sign-in or data access.

1.5 Information from Web Platform Third-Party Integrations

The Maxximus web platform (maxximus.ai) — separately from the mobile application — integrates with Meta's platforms (Instagram and Facebook) through the Meta Graph API for the purpose of managing our business social media presence and AI-powered comment responses. In connection with this web platform integration, we may collect:

• Public profile information associated with our business accounts
• Comments and interactions on our public business posts
• Messaging data when users initiate contact with our business accounts on Instagram
• Basic account metadata provided by the platform

This Meta integration exists solely on the web platform for business social media management. It is not present in the Maxximus mobile application. We do not sell, transfer, or use Meta platform data for advertising targeting or profiling. All use complies with the Meta Platform Terms.

2. HOW WE USE YOUR INFORMATION

We use the information we collect to:

• Provide, operate, and improve the Maxximus AI coaching Service
• Personalize your coaching experience based on your goals, history, and Initiation responses
• Process transactions and send related information (receipts, confirmations)
• Send you service updates, coaching reminders, security alerts, and administrative messages via push notification and email
• Respond to your comments, questions, and requests
• Monitor and analyze usage patterns to improve the Service
• Evaluate AI coaching quality and product experience through feedback
• Detect, prevent, and address technical issues and fraudulent activity
• Moderate The Forum community for compliance with our Community Conduct Policy
• Comply with legal obligations
• Aggregate and anonymize coaching interaction data to improve our AI models through our "Collective Intelligence" system — data is always anonymized and never linked to your identity; you may opt out at any time by contacting us at privacy@maxximus.ai

3. AI PROCESSING AND DATA

Maxximus AI uses large language models to generate coaching responses. When you interact with our AI:

• Your coaching conversations, messages, and any photos you upload are processed by SpaceXAI (formerly xAI), the company behind Grok, our AI language model provider, pursuant to SpaceXAI's published Data Processing Addendum (available at x.ai/legal/data-processing-addendum), which satisfies the requirements of GDPR Article 28 for EU/EEA users. SpaceXAI's privacy policy is available at x.ai/privacy. No data is sent to SpaceXAI or TypeSafe until you have provided your consent during onboarding.
• SpaceXAI does not use API-submitted data to train its general models by default under its API terms
• Voice dictation audio is sent to SpaceXAI for speech-to-text processing; only the resulting text is retained
• Forum posts and replies are checked by an AI safety model (Jev, by TypeSafe, via Vercel's AI Gateway) before they go live. Posts with harassment or hate, explicit sexual content or spam are blocked. Posts showing signs that someone may harm himself or others stay up and alert our moderators.
• If you report an AI coaching reply, our moderators can read that reply to review your report.
• Conversation data may be retained to provide continuity across sessions
• We do not use your personal coaching conversations to train third-party AI models without your explicit consent
• Anonymized, aggregated data may be used to improve Maxximus's own coaching capabilities through our Collective Intelligence system

4. HOW WE SHARE YOUR INFORMATION

We do not sell your personal information. We may share your information only in the following circumstances:

4.1 Service Providers

• Supabase — database and authentication infrastructure
• Vercel — hosting and infrastructure
• Stripe — payment processing
• SpaceXAI (formerly xAI / Grok) — AI language model processing coaching conversations, photo analysis, and voice dictation (bound by SpaceXAI's Data Processing Addendum)
• TypeSafe — content moderation for Forum posts (screens for harassment, sexual content, threats, and spam)
• Expo — push notification delivery infrastructure
• GoHighLevel (GHL) — CRM, account management, and transactional email
• ElevenLabs — voice synthesis for content features
• Meta Platforms — social media API integration (web platform only — not used in the mobile application)
• Apple — iOS app distribution, Apple Sign In authentication, and if applicable, in-app purchase processing
• Google — Android app distribution, Google Sign In authentication, and if applicable, in-app purchase processing

All service providers are contractually obligated to protect your data and use it only for the purposes we specify.

4.2 The Forum — Community Content

Content you post in The Forum — including your display name and posts — is visible to other Maxximus members. All posts are screened by our content moderation system (TypeSafe) before publication. Do not post personal information in The Forum that you do not wish other members to see.

4.3 Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights or the safety of others.

4.4 Business Transfers

If Maxximus is acquired, merged, or its assets are transferred, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website before your data is transferred and becomes subject to a different privacy policy.

5. META PLATFORM DATA — WEB PLATFORM ONLY

The Maxximus mobile application does not integrate with Meta platforms. The following disclosures apply exclusively to the Maxximus web platform (maxximus.ai).

• We access our own business account data on Instagram and Facebook — we do not access the personal accounts of Maxximus users through Meta APIs
• We use this access solely to publish content on our business accounts, read and respond to public comments on our posts via our AI coaching system, and manage our business page presence
• Meta platform data is not used for ad targeting, data brokering, or any purpose outside of operating our social media presence
• We retain Meta platform data only as long as necessary to provide the Service or as required by law
• The Maxximus mobile app uses Apple Sign In, Google Sign In, and email only — no Meta login or data access of any kind

6. DATA RETENTION

We retain your personal information for as long as your account is active or as needed to provide you the Service. If you request deletion of your account through the in-app account deletion feature in Settings, your personal data is deleted immediately. Email deletion requests are completed within 30 days, except where we are legally required to retain certain data (e.g., financial records for tax purposes). Anonymized aggregate data may be retained indefinitely.

7. ACCOUNT DELETION

You may delete your Maxximus account at any time:

• In-app: Navigate to Settings > Account > Delete Account
• By email: Contact us at support@maxximus.ai with the subject line "Account Deletion Request"

In-app deletion is immediate. Email requests are completed within 30 days. Upon deletion, your personal data, coaching history, Connection Files, and Forum posts will be permanently deleted. Anonymized and aggregated data that cannot be linked to your identity may be retained.

8. PUSH NOTIFICATIONS

If you enable push notifications, we may send you:

• Coaching reminders and check-ins
• Forum activity alerts (replies, mentions)
• Service announcements and updates

You may disable push notifications at any time through your device Settings (iOS: Settings > Notifications > Maxximus | Android: Settings > Apps > Maxximus > Notifications).

9. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies on our web platform to maintain your session, remember your preferences, and analyze usage. You can control cookie settings through your browser.

We do not use cookies for cross-site advertising tracking or sell cookie data to third parties. Our mobile applications do not use browser cookies but may use similar device-based identifiers for session management only.

10. YOUR RIGHTS AND CHOICES

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (see Section 7)
• Portability: Request a machine-readable copy of your data
• Opt-out: Opt out of Collective Intelligence data contribution at any time by contacting privacy@maxximus.ai
• Push Notifications: Disable at any time through device Settings
• Withdrawal of consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at privacy@maxximus.ai. We will respond within 30 days.

11. CALIFORNIA PRIVACY RIGHTS (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• The right to know what personal information we collect, use, disclose, and sell
• The right to delete personal information we have collected from you
• The right to correct inaccurate personal information
• The right to opt out of the sale or sharing of personal information — we do not sell or share personal information for cross-context behavioral advertising
• The right to limit the use and disclosure of sensitive personal information
• The right to non-discrimination for exercising your CCPA/CPRA rights

Sensitive Personal Information: Under CPRA, coaching conversation content and photos you upload may qualify as sensitive personal information. We use this information only to provide the coaching Service to you — not for inferring characteristics or for any secondary purpose. You may limit our use of sensitive personal information by deleting your account or contacting privacy@maxximus.ai.

To submit a CCPA/CPRA request, contact us at privacy@maxximus.ai.

12. GDPR — EUROPEAN USERS

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

• Contract: Processing necessary to provide the Service you have requested
• Legitimate interests: Improving our Service, fraud prevention, security, community moderation
• Consent: Where you have explicitly consented (e.g., marketing emails, push notifications, Collective Intelligence data contribution)
• Legal obligation: Where we are required to process data by law

In addition to the rights in Section 10, EEA/UK/Switzerland users also have the right to:

• Object to processing based on legitimate interests
• Restrict processing in certain circumstances
• Withdraw consent at any time — contact privacy@maxximus.ai or use in-app account settings

International Transfers: Your data may be transferred to and processed in the United States. For EEA users, transfers to SpaceXAI are covered by SpaceXAI's Standard Contractual Clauses (EU SCCs, Modules 2/3) as published in SpaceXAI's Data Processing Addendum (x.ai/legal/data-processing-addendum).

You may lodge a complaint with your local data protection authority if you believe we have not handled your data in accordance with GDPR.

13. CHILDREN'S PRIVACY

Maxximus AI is intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we discover that a person under 18 has provided us with personal information, we will delete it immediately. Contact us at privacy@maxximus.ai if you believe your child has provided us information.

14. SECURITY

We implement industry-standard technical and organizational security measures including encryption in transit (TLS/HTTPS), encrypted database storage, access controls, secure API key management, and regular security reviews. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. In the event of a data breach affecting your rights, we will notify you as required by applicable law.

15. THIRD-PARTY LINKS

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

16. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last Updated" date. For significant changes, we will also send an email notification to registered users. Your continued use of the Service after any changes constitutes your acceptance of the revised policy.

17. CONTACT US

If you have questions, concerns, or requests regarding this Privacy Policy, contact us: