Opening your next view
Who is responsible
Maxx (prototype: no legal entity has been formed yet) is the controller of the personal data described here. Contact for privacy questions and requests: privacy@maxx.example. The Legal notice has the address and any representative or data protection officer.
What we collect and why
| Data | Why | Basis |
|---|---|---|
| Account: email, display name, sign-in methods (password hash, passkey public keys, linked providers, encrypted authenticator secret) | Create and secure your account | Contract; security (legitimate interest) |
| Security activity: sign-in events with a shortened network address (the first part only) and browser name | Detect and alert you to unusual sign-ins | Legitimate interest |
| Bloc activity: your maximum price, your membership and outcome | Run the negotiation and settle it | Contract |
| Payments: PayPal order, authorization, capture and refund ids, amounts, status | Charge the winning price, refund, reconcile, keep accounting records | Contract; legal obligation |
| Delivery address and phone (encrypted), only after you win | Let the seller ship your order | Contract |
| Orders and problem reports, including messages | Fulfilment, refunds, disputes | Contract; legitimate interest |
| Seller details: legal name, business type, address, phone, support email, registration number, payout email, return policy, certifications | Verify and publish trader details, pay sellers, comply with marketplace law | Contract; legal obligation |
| Screenshots you scan | Read the product and price. Processed in memory; not stored by Maxx | Contract |
| Audit log: money and trust decisions (who, what, when) | Security, fraud prevention, investigations | Legitimate interest; legal obligation |
We do not sell personal data. We do not use advertising or analytics trackers, and we do not build advertising profiles.
AI and your data
In live mode, screenshots you scan are sent to an AI vision model and product details to a search provider. Negotiation prompts contain the demand curve of the group and each seller’s own private terms, never your identity. See AI agents and automated decisions.
How long we keep it
| Data | Kept for |
|---|---|
| Delivery address on an order | Wiped 90 days after the order finishes (delivered, cancelled or refunded), sooner if you close your account |
| Saved addresses | Until you delete them or close your account |
| Account and security activity | While your account is open; deleted when you close it |
| Payment, order and refund records | As long as tax and accounting law requires (commonly 6 to 10 years). They keep an opaque account id, not your profile |
| Seller trader records | For 6 months after the seller’s account closes, as marketplace law requires, then deleted |
| Problem reports and messages | While the order record is kept |
| Audit log | As long as needed for security and investigations, and reviewed at least yearly |
Some of these periods are targets for the production service. The prototype wipes delivery addresses on schedule; the remaining schedules need to be enforced before launch.
Your rights
Depending on where you live (for example under the GDPR, UK GDPR, or California law) you can ask to access, correct, delete, export or restrict your data, object to processing, and withdraw consent. You will not be treated worse for using these rights.
- Export: Account settings, “Download my data”, gives you a file with your account, security activity, addresses, payments, orders and problem reports.
- Delete: Account settings, “Delete my account”. This removes your profile, sign-in methods, saved addresses and the address copies on finished orders. Records we must keep stay, linked only to an opaque id.
- Anything else: write to us. We answer within one month.
- You can complain to your data protection authority. In the EU you can find yours on the European Data Protection Board’s website.
Security
Passwords are hashed with scrypt and checked against a breach list without sending the password. Authenticator secrets and delivery addresses are encrypted at rest. Sessions are bound to secure cookies and expire. Read Security and responsible disclosure for more.
International transfers
Some providers process data outside your country. Where required we rely on adequacy decisions or standard contractual clauses. The Service providers page names each provider and what it receives.
Children
Maxx is not for people under 18, and we do not knowingly collect their data. Tell us if you think we have and we will delete it.
Changes
We will tell you about material changes by email and in the product at least 30 days before they apply.