Privacy Policy

Who We Are

The controller of your personal data is Maxspell, a sole proprietorship (toiminimi) registered in Finland, Business ID 3240546-7, Adjutantinkatu 1 A 5, 02650 Espoo, Finland. In this policy, "Maxspell", "we" and "us" mean this business.

For anything about your personal data, email [email protected].

Data We Process for Customers

When a customer uses our services, we also store data that belongs to them: emails in Business Email mailboxes, files and databases in Cloud Hosting accounts, pages crawled by SEO audits, and the destinations of short links. For that data the customer is the controller and we are their processor. We process it only to provide the service, under our Data Processing Addendum. If your data is in a customer's mailbox or website, contact that customer first.

We do not read the contents of mailboxes or hosted websites. We access them only when the customer asks us to, to deal with a security incident or an abuse report, or when the law requires it.

Personal Data We Collect

When you visit our websites:

• Server and security logs: IP address, time, the page requested, and browser details. Cloudflare processes them when it delivers our sites.
• Analytics on maxspell.com: pages viewed, referring site, browser, device type and country, collected with our own Umami server without cookies. Your IP address is not stored, and the visitor identifier changes every month. You can turn analytics off on our Cookie Policy page.
• Forms: what you enter in the contact form (name, email address, company, phone number and message), and the address you check with the SEO audit tool. Cloudflare Turnstile checks that a person sends these forms, and we use your IP address briefly to limit how often a form can be sent.

When you have a Maxspell ID account:

• Your email address, name and profile picture, and your account identifier at Google, Facebook (Meta), GitHub if you sign in with one of them.
• Passkeys (the public key only; the private key never leaves your device), one-time sign-in codes, and sessions with the IP address and browser they were created from.

When you use the dashboard and our services:

• Teams: team names, members, their roles, and invitations (including the invited person's email address).
• Billing: the name and address to invoice, billing email, VAT ID, invoices and payment history. Stripe collects card and bank details directly; we only see the type, last four digits and expiry date.
• Services: verified domains; Business Email domains, mailbox names and administrator usernames; Cloud Hosting accounts, locations, panel usernames and usage hours; SEO audit sites, results and report recipients; short links with their titles, notes and daily click totals. When someone opens a short link, we count the click per day and keep no IP address or browser details.
• Support: the messages you send us and our replies.

Why We Use It and Our Legal Bases

• To provide what you sign up for: your account, teams, the services you order, billing, service emails and support. Legal basis: performance of a contract (GDPR Article 6(1)(b)).
• To meet legal duties: accounting and tax records, and answering lawful requests from authorities. Legal basis: legal obligation (Article 6(1)(c)).
• To keep our services secure: logs, bot checks, rate limits, fraud prevention, and handling abuse reports. Legal basis: our legitimate interest in protecting our users and systems (Article 6(1)(f)).
• To answer people who are not yet customers, such as contact form messages. Legal basis: our legitimate interest in replying, or steps you ask for before a contract.
• To improve our website with cookieless, pseudonymous analytics. Legal basis: our legitimate interest in knowing which pages help visitors. You can opt out at any time.
• To establish or defend legal claims. Legal basis: our legitimate interest.

We do not send marketing emails, do not sell personal data, and do not use it for advertising. Emails about sign-in, renewals, payments and your services are part of the service.

Data You Must Provide

You need an email address to create a Maxspell ID account, and billing details and a payment method to buy a paid plan. Without them we cannot provide those services. Everything else is optional.

Who Receives Your Data

• Our sub-processors, who host, deliver, email and take payments for us, under data processing agreements. See the current list on our Sub-processors page.
• Google, Facebook (Meta), GitHub, only if you choose to sign in with them. They act as independent controllers under their own privacy policies.
• Members of your team, who see team data, and people you send reports or invitations to.
• Authorities, courts and our professional advisers (such as our accountant), when the law requires it or to protect our rights.
• A buyer of the Maxspell business, if the business is transferred. We would tell you before your data is transferred.

Transfers Outside the EU

We keep our servers and databases in the European Union. Some sub-processors are United States companies (Cloudflare, Mailgun, Stripe) and may process data in the United States. Those transfers rely on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses. Email [email protected] for a copy of the safeguards.

How Long We Keep Data

Security

All connections use TLS. Sign-in uses passkeys, one-time codes or trusted providers, so we store no passwords for Maxspell ID. Each team's data is separated by access checks on every request, and credentials such as hosting panel keys are encrypted at rest. Only the people who run Maxspell, bound by confidentiality, can reach production systems.

No system is perfectly secure. If a personal data breach puts your rights at risk, we notify the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) within 72 hours and tell you when the law requires it. Customers using our services as processor are notified as the Data Processing Addendum describes.

Your Rights

Under the GDPR you have the right to:

• access your personal data and get a copy of it;
• correct data that is wrong or incomplete;
• have your data deleted;
• restrict how we use your data;
• receive data you gave us in a machine-readable format, or have it sent to another provider (data portability);
• object to processing based on our legitimate interests, including analytics;
• withdraw consent, where we rely on it;
• lodge a complaint with the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) (tietosuoja.fi) or the authority where you live or work.

You can change your name and email address in your Maxspell ID account. For everything else, including deleting your account, email [email protected] from the address on your account. We answer within one month, free of charge, and may ask you to confirm your identity. Some data, such as invoices, must be kept for the period the law requires even after you ask us to delete it.

Automated Decisions

We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Stripe screens payments for fraud and may decline a payment; contact us if you think this happened by mistake.

Children

Our services are for businesses and adults. You must be at least 18 to create a Maxspell ID account, and we do not knowingly collect data from children.

Changes to This Policy

We publish every new version here with a new date. If a change materially affects how we use your data, we email account holders at least 30 days before it applies.

Contact

Maxspell, a sole proprietorship (toiminimi) registered in Finland, Business ID 3240546-7, Adjutantinkatu 1 A 5, 02650 Espoo, Finland. Email [email protected], or use our contact page.