1. Who We Are

Maxie ("we", "us", "our") is a privacy-first family calendar app designed for parents and carers. We're based in the United Kingdom and operate globally.

2. Who Can Use Maxie

Maxie is designed for parents. It's adult use only. You must be 18 years or older to create an account. Children do not have Maxie accounts and we do not knowingly collect personal information directly from anyone under 18. Parents and carers may add details about their own children (such as a first name, birthday, school and activities) to their family calendar; we process that information only on the account holder's behalf, to provide the service, and never for advertising. If you believe someone under 18 has created an account, please contact us so we can delete it.

3. What Data We Collect

We only collect what's needed to make Maxie work for you:

We do not intentionally collect special category data (such as health information). If you choose to include this, we process it only to provide the requested feature and rely on your explicit consent.

4. How We Use Your Data (Purposes & Legal Bases – UK/EU)

5. Who We Share Data With

We only share your data with trusted providers acting on our instructions:

• Supabase – hosting, database, authentication, file storage (UK, London)
• Anthropic (Claude) – AI features: reading and structuring the text, emails and images you give Maxie, and answering your questions (see Section 9). We also use Anthropic for internal product analysis, limited to pseudonymised identifiers and aggregate engagement data.
• Google (Gemini API) – reading text from uploaded photos and scanned documents (see Section 9)
• OpenAI – embeddings and some AI text and image processing (see Section 9)
• Google APIs – calendar sync when connected (see Section 8); push notification delivery via Firebase Cloud Messaging (FCM); place search and maps; weather forecasts for your events
• Google document preview – when you open a PDF or Office document (Word, Excel, PowerPoint) that you uploaded, Google's document viewer displays it. Google receives that document through a temporary link that expires after one hour.
• Resend – email delivery for invites, reminders, notifications
• RevenueCat – subscription management and billing infrastructure
• Stripe – web payment processing
• Amplitude – product analytics and usage insights
• Sentry – error monitoring and crash reporting (EU, Germany)
• Lovable – application hosting and infrastructure provider.

We do not sell or share your data for advertising purposes.

6. International Transfers

Our main database, authentication and file storage are hosted in the UK (London). To provide some features, such as reading a school email or photo, sending email or processing payments, some data is processed by the providers listed in Section 5, which may be outside the UK. Where personal data is transferred outside the UK:

• Where the recipient is certified under the UK-US Data Bridge, we rely on that adequacy regulation.
• Otherwise, we use the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and conduct transfer risk assessments.
• For NZ residents, we ensure comparable safeguards under IPP 12.

7. Your Rights

UK/EU: Access, rectify, erase, restrict, port data, object to processing, withdraw consent, complain to the ICO/EU authority.

USA (CA + others): Know/access, delete, correct, data portability, appeal decisions. We do not sell/share personal data or use sensitive personal information for additional purposes.

Australia: Access/correction, complaint to OAIC, details on cross-border disclosure.

New Zealand: Access/correction, complaint to the Privacy Commissioner.

Canada (PIPEDA & Québec Law 25): Access/correction, complain to the OPC or Québec CAI, transparency on automated decision-making (we do not use solely automated decisions with legal/significant effects).

8. Google API Disclosure

Maxie's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Scope: Maxie sends events from your Maxie calendar to your Google Calendar. It does not read events from your Google Calendar.
• No secondary use, no unauthorised transfers, minimal retention.

9. AI Processing

When you use "Quick Add" or AI-powered features:

• The information you provide (such as event details, forwarded emails, or uploaded photos and documents) is sent to our AI providers (Anthropic, Google Gemini and OpenAI) for processing
• Each acts as a data processor on our behalf under its data processing terms
• None of them uses API data to train its models by default
• Data may be retained briefly by a provider for abuse monitoring before deletion

We minimise the data sent and only share what is needed to provide the feature. We never use your family's data to train AI models.

10. Marketing vs Service Emails

• Service emails (e.g., reminders, invites) are essential to providing Maxie.
• Marketing emails are only sent with your consent or under a "soft opt-in" and can be unsubscribed from at any time.

11. Cookies & Analytics

If we use non-essential cookies/SDKs, we will request your consent (UK/EU). Essential cookies are used for security and login.

12. Retention Schedule

13. Security

We use encryption in transit and at rest, Row-Level Security, signed URL access for files, and strict access controls.

14. Changes to This Notice

We may update this notice and will notify you by email or in-app for significant changes.

15. How to Contact Us

Email: privacy@maxie.family

Postal: Noodle Labs Ltd, 3rd Floor, 3 Hill Street, New Town, Edinburgh, EH2 3JP

Complaints:

• UK – ico.org.uk
• EU – Your national data protection authority
• Australia – oaic.gov.au
• NZ – privacy.org.nz
• Canada – priv.gc.ca / quebec.ca/en/government/departments-and-agencies/cai