Privacy Policy

This policy explains how MAALI ("we", "us") handles personal data, both for people who use MAALI (our customers) and for businesses whose public websites MAALI reads on a customer's behalf. Questions: hello@maali.si.

1. Data about our customers

Account data. Your name, email address and password (stored as a secure hash), and your workspace settings.

Campaign data. The offer you describe, the store domains you add, drafts, your edits and approvals, and messages sent through MAALI.

Mailbox credentials. If you connect a mailbox, we store its server settings and your password or app password, encrypted at rest. We use them only to send the emails you approve and to read replies and bounces to those emails. We never store other mail from your inbox.

Billing data. Payments are processed by Polar, our merchant of record. We receive your subscription status and order details, not your full card number.

Usage and technical data. Logs needed to run and secure the service, such as IP addresses and timestamps.

Analytics. We use Google Analytics 4 to understand which pages and features help people, for example how many people sign up or build a Store Brain. It sets cookies and records pages visited, events, device and approximate location. Visitors in the EU/EEA, the UK and Switzerland are asked first and analytics stays off unless they accept; everyone else can turn it off any time under "Cookie preferences" in the site footer. Advertising features are off, and we don't use the data for ads. See the Cookie Policy.

We use this data to provide the service, process payments, prevent abuse, and improve MAALI. We don't sell personal data.

2. Data about businesses MAALI researches

When a customer adds a store, MaaliBot reads that store's public pages: its homepage, public product catalog, store metadata, and its contact or about page. From these we keep public business information, such as the store name, catalog statistics, detected apps, public social profile links, and the business contact email the store publishes. We do not collect personal email addresses or phone numbers from other sources, and we follow robots.txt.

Customers use this information to decide whether to contact a business about their service. Our legal basis is legitimate interest in enabling relevant business-to-business communication, balanced by strict limits: public business data only, a human approves every first email, and a platform-wide opt-out.

If you run a store and want MAALI to stop researching or contacting it, use the opt-out form. It applies to every MAALI customer, and we delete the store data we cached.

3. Service providers

We use carefully selected providers to run MAALI, including hosting, database and storage providers, Polar for payments, Google for analytics, and Anthropic for AI processing of store information and drafts. They process data only on our instructions.

4. Retention

Account and campaign data is kept while your account is active and deleted within 30 days after you close it, except where we must keep records for legal, tax or security reasons. Cached public store research expires and is refreshed or removed regularly. Do-not-contact entries are kept so that opt-outs keep working.

5. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal data, to object to or restrict processing, and to complain to a data protection authority. Email hello@maali.si and we will respond within 30 days.

6. Security

We encrypt mailbox credentials and use encrypted connections. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you as required by law.

7. Changes

We will update this page when our practices change and note the date above. Significant changes will be announced to customers by email.