1. Overview
Mae (“Mae”, “we”, “us”, or “our”) operates the AI-powered marketing automation platform available at heymae.ai and related applications (collectively, the “Service”). The Service helps small businesses generate marketing content, schedule and publish posts, and analyze performance across social media platforms such as Facebook, Instagram, and WhatsApp.
This Privacy Policy describes the information we collect, how we use and share it, and the choices you have. By creating an account or using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.
2. Information We Collect
2.1 Information you provide
- Account information: your name, email address, password (stored only as a salted hash), profile picture, time zone, and the business type and goals you select during signup.
- Business profile: details about your business such as business name, owner name, industry, location, website, contact details, hours, products and services, target audience, competitors, brand voice, colors, and other branding and content preferences. Some of this may be gathered automatically from a website you provide (see below).
- Conversations and content: the messages you send within the Service, instructions you provide, files or images you upload, and the content (posts, captions, images, and videos) generated for you.
- Payment information: billing details you provide when you subscribe. Card and bank account details are collected and processed directly by our payment processor, Stripe — we do not receive or store full card numbers.
- Support communications: information you provide when you contact us.
2.2 Information collected automatically
- Usage data: actions you take in the Service, features used, content generated, and event timestamps.
- Device and log data: IP address, browser type, user agent, and similar technical information recorded in our server logs.
- Analytics data: product analytics collected through PostHog to help us understand how the Service is used and improve it.
- Authentication tokens: tokens stored in your browser (for example, in local storage) to keep you signed in.
2.3 Information from websites you provide
If you provide your business website, we may automatically scrape and analyze publicly available content from it (such as descriptions, images, contact details, and social links) to build and enrich your business profile.
4. How We Use Information
We use the information we collect to:
- Provide, operate, and maintain the Service, including generating marketing content and publishing posts on your behalf;
- Personalize content to your brand using your business profile and preferences;
- Process payments, manage subscriptions and trials, and prevent billing fraud;
- Communicate with you about your account, transactions, and service updates, and (where permitted) send re-engagement or marketing emails;
- Monitor, analyze, and improve the Service, including measuring AI usage and costs;
- Maintain security, debug issues, and enforce our Terms of Service;
- Comply with legal obligations.
Where required by law (for example, in the EEA/UK), we rely on the following legal bases: performance of our contract with you (to provide the Service and process payments); your consent (for example, optional analytics and marketing email); our legitimate interests (to operate, secure, and improve the Service); and compliance with legal obligations.
5. AI Processing
The Service is powered by third-party large language model and generative AI providers, including OpenAI, Anthropic, and Google. To generate content and respond to your requests, we send relevant inputs — such as your messages, business profile, website content, and uploaded or referenced images — to these providers for processing. Outputs are returned to you and stored as part of your account.
These providers process the data on our behalf to deliver the requested feature. We select providers that contractually commit not to use business or customer data submitted through their APIs to train their general models, consistent with their published API terms. Please do not submit sensitive personal information (such as government identifiers, health, or financial account details) into the Service, as it is not designed for that purpose.
7. Service Providers
We rely on the following categories of third-party service providers. Each processes only the data needed for its function and is bound by confidentiality and data-protection obligations.
| Provider | Purpose |
|---|---|
| OpenAI, Anthropic, Google (Gemini) | AI content and image generation, analysis |
| Stripe | Payment processing and subscription billing |
| Amazon Web Services (SES) | Transactional and marketing email delivery |
| Google Cloud (Storage) | Hosting and storage of media and generated content |
| PostHog | Product analytics |
| Meta (Facebook, Instagram, WhatsApp) | Social publishing and analytics for accounts you connect |
9. Data Retention
We retain your information for as long as your account is active and as needed to provide the Service. We may retain certain information after account closure where necessary to comply with legal obligations, resolve disputes, prevent fraud, and enforce our agreements (for example, billing and transaction records). When information is no longer needed, we delete or anonymize it.
10. Security
We use technical and organizational measures designed to protect your information, including encryption in transit, hashed passwords, access controls, and isolation of credentials. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.
11. Your Rights & Choices
Depending on where you live, you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights:
- Access and update: view and edit your account and business profile within the Service;
- Delete your account: request account deletion, which removes your account and associated conversations and content (some records may be retained as described in Section 9). You can also contact us to request deletion;
- Disconnect social accounts: remove connected platforms at any time from within the Service;
- Email preferences: opt out of marketing and re-engagement emails using the unsubscribe link in those emails. We may still send essential service messages;
- Other requests: email hello@heymae.ai.
We will not discriminate against you for exercising your rights. We may need to verify your identity before fulfilling a request.
12. International Transfers
Mae and our service providers may process and store information in countries other than your own, including the United States. Where required, we use appropriate safeguards (such as standard contractual clauses) for international transfers of personal information.
13. Children’s Privacy
The Service is intended for businesses and users who are at least 18 years old (or the age of majority in their jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the Service or by email. Your continued use of the Service after the changes take effect constitutes acceptance of the updated Policy.
15. Contact Us
If you have questions about this Privacy Policy or our data practices, contact us at hello@heymae.ai.
3. Connected Social Accounts
When you connect a Facebook, Instagram, or other social account, you authorize Mae to access certain information through that platform’s official API. Depending on the permissions you grant, this may include:
We use this access only to provide the features you request. Your use of connected platforms is also governed by those platforms’ own terms and policies (for example, Meta’s Platform Terms and Privacy Policy). You can disconnect a social account at any time from within the Service, which revokes our stored access tokens.