1. Who We Are

Max AI, Inc. is a Texas corporation headquartered in Austin, Texas. We build AI-powered personal assistant tools including MaxAssistant, MaxDockets, MaxLedgers, MaxServices, Sarah AI, and NorthOS.

Email: [email protected]
Legal: [email protected]
Mail: Max AI, Inc., Austin, Texas

2. The Short Version

We collect what we need to run the service. We don't sell your data. We don't train AI on your conversations — period. You can delete everything, anytime. That's the deal.

3. What Data We Collect

Account Information

• Name, email address, and password (hashed)
• Phone number (if you use voice features)
• Profile photo (if provided)
• Account creation date and last login

Usage Data

• AI conversation history (your messages and Max's responses)
• Features used and frequency of use
• Session duration and activity logs
• Errors and performance data (anonymized)

Voice Data

• Audio recordings processed for speech-to-text (via Deepgram)
• Voice interaction logs for Sarah AI features
• Audio is processed in real time and not stored beyond session unless you enable voice history

Biometric Data (Photo Organization)

• Face embeddings (mathematical representations) generated from photos you upload for organization
• Embeddings are stored securely with access controls that restrict them to your account
• Face embeddings are used solely for photo organization — we do not share, sell, or train AI models on them
• Face embeddings are stored in your account and not shared with third parties for independent commercial purposes. Photo content submitted for analysis may be processed by our AI infrastructure providers under their own data terms (see /privacy/providers).
• All biometric data is permanently deleted when you delete your account

Payment Information

• Payment processing is handled entirely by Stripe
• We store only the last 4 digits of your card, expiration, and billing address for your records
• Full card numbers never touch our servers

Device and Technical Data

• IP address and approximate location (country/city)
• Browser type and version, or mobile OS
• Device identifiers
• Cookies and session tokens (see Cookie Policy)

4. How We Collect It

Directly from you — when you create an account, type messages, upload photos, or contact support.

Automatically — when you use the service, we log technical data needed to operate and secure it.

From third parties — if you sign in via Google or another provider, we receive basic profile info from them. We don't receive data from data brokers.

5. Why We Collect It

We use your data for these purposes only:

• Delivering the service — your conversations, tasks, and preferences
• Account security — detecting fraud, protecting your account
• Customer support — diagnosing and fixing issues you report
• Service improvement — aggregate, anonymized analysis of how features are used
• Service improvement — aggregate, anonymized analysis of how features are used (not individual content)
• Legal compliance — where required by law
• Billing and payment processing

We do not sell your data. We do not share it with data brokers or ad networks.

Advertising: We do not currently use your content for advertising. If that ever changes, we will update this policy and notify you before it takes effect.

We may share data with service providers (hosting infrastructure, payment processing via Stripe, analytics) only to the extent needed to operate the service. These providers are bound by data processing agreements and may not use your data for their own purposes.

6. Third-Party Processors

We share your data with these service providers only to the extent necessary to provide the service. Each is bound by data processing agreements:

• AI inference providers — Max routes your requests to third-party AI services to generate responses. Your message content is transmitted to these providers. Each provider operates under its own data terms (links below).
• Stripe — Payment processing and subscription management.
• Twilio — Voice and SMS infrastructure for Sarah AI and voice features.
• ElevenLabs — Text-to-speech voice synthesis for AI voice responses.
• Deepgram — Speech-to-text transcription for voice input.
• Microsoft (Azure) — Cloud infrastructure, email processing via Microsoft Graph.
• Google — Authentication (if you use Google Sign-In), cloud services.

The specific provider used for any request depends on your subscription tier and request type. We do not sell your data to any of these providers or anyone else. A full list of active providers with links to their data terms is available at maxassistant.ai/privacy/providers.

7. Data Retention

• AI conversations: Retained for up to 2 years, or until you delete them — whichever comes first.
• Account data: Retained until you delete your account.
• Payment records: Retained for 7 years per IRS requirements.
• Voice audio: Processed in real time; not retained unless voice history is enabled.
• Biometric data: Deleted immediately upon account deletion.
• Server logs: Retained for 90 days for security monitoring.

8. Your Rights

You have these rights regarding your data, regardless of where you live:

• Access — Request a copy of data we hold about you.
• Correction — Ask us to fix inaccurate data.
• Deletion — Delete your data or your entire account from Settings → Privacy, or email [email protected].
• Portability — Export your conversation history and account data in a machine-readable format.
• Opt-out of AI training — We do not train AI models on your data. No opt-out is needed.
• Opt-out of sale — We don't sell your data, so there's nothing to opt out of. But you have this right by law.

To exercise any right, go to Settings → Privacy, or email [email protected]. We respond within 45 days.

9. AI Training — Our Policy

We do not train AI models on your data.

Max AI has no proprietary language model. All AI responses are generated by third-party API providers (Anthropic, Groq, Google, OpenAI, DeepSeek, xAI) under their own terms. We do not submit your data to those providers for model training purposes, and we do not offer an opt-in training program.

Children's data is never used for advertising or AI training under any circumstances.

10. Biometric Data (BIPA Notice)

If you use photo organization features in MaxAssistant, Max AI collects face embeddings — mathematical representations of facial geometry derived from your photos. These are not photographs; they are numerical vectors used to group similar faces.

• Face embeddings are stored securely and associated only with your account.
• Max AI accesses face embeddings only to provide the photo organization feature you use — they are not shared or used for any other purpose.
• Face embeddings are never sold, leased, or traded. They may be processed by our AI infrastructure providers as part of delivering the photo organization feature, under those providers’ own data terms.
• Face embeddings are permanently deleted within 30 days of account deletion.
• We do not use face embeddings for any purpose other than photo organization features you explicitly use.
• Retention: Face embeddings are retained only as long as you maintain an active account.

By using photo organization features, you consent to this collection and use as described. You may revoke consent by disabling photo organization in Settings and deleting your uploaded photos.

11. Children's Privacy (COPPA)

Max AI services are not directed to children under 13. We do not knowingly collect personal information from children under 13.

Users aged 13–17 may use Max AI only with verified parental consent. Parents or guardians may:

• Review their child's account data
• Request deletion of their child's account and data
• Revoke consent at any time

If we learn we have collected data from a child under 13 without parental consent, we will delete it immediately. Contact us at [email protected] with parental concerns.

12. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know — You can request what categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete — You can request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale — We do not sell personal information, so this right does not apply in practice.
• Right to Non-Discrimination — We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request: email [email protected] with subject "CCPA Request." We will verify your identity and respond within 45 days.

Categories of personal information collected: identifiers, internet activity, geolocation, audio data, biometric data (if photo features used), commercial information. We do not collect sensitive personal information beyond what is described in this policy.

13. Geographic Scope

Max AI is a US-based service incorporated in Texas. Our services are intended for users in the United States, and are governed by United States and Texas law.

If you access Max AI from outside the United States, your information will be transferred to and processed in the United States. By using Max AI, you acknowledge this transfer. We do not currently tailor our service for users in the European Economic Area or United Kingdom, and make no representations about compliance with regulations specific to those regions.

14. Security

We take security seriously. Our measures include:

• Encryption in transit (TLS 1.2+) for all data
• Encryption at rest for stored data
• Secure storage for biometric data — face embeddings are associated with and accessible only to your account
• Access controls and role-based permissions for employees
• Regular security reviews and vulnerability testing
• Incident response procedures

No system is 100% secure. If we discover a breach affecting your data, we will notify you within 72 hours as required by applicable law.

15. Changes to This Policy

When we make material changes, we will:

• Update the effective date at the top of this page
• Send an email notification to your registered address
• Display an in-app notice for at least 30 days

Your continued use of Max AI after the effective date of a material change constitutes acceptance of the updated policy. If you disagree with changes, you may delete your account.

16. Contact Us

Privacy questions, requests, and complaints:

Max AI, Inc.
Email: [email protected]
Austin, Texas

We aim to respond to all privacy inquiries within 5 business days and to complete formal requests within 45 days.

Max AI, Inc. · Austin, Texas · [email protected]
Effective March 23, 2026