Maxymus.aiBack to home
Legal

Privacy Policy

Effective date: October 23, 2026 · Last updated: October 23, 2026

This Privacy Policy explains how Maxymus.ai (“Maxymus.ai,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you visit our website, use our applications, or use our sales-training services (together, the “Service”). It applies to trainees, managers, administrators, and visitors.

If you access the Service through your employer or another organization, that organization may be the controller of your account and practice data. We process that data on the organization’s behalf and according to our agreement with it. This policy describes our practices; your organization’s own privacy notice may also apply.

Fictional training only. The Service is designed for practice with fictional customer scenarios. Do not enter real customer data or sensitive personal information, such as health, financial, or government-identification information. If you choose to include personal information about yourself or anyone else, you are responsible for having the right to do so.

1. Information we collect

We collect information you provide, information generated when you use the Service, and information from sign-in and service providers.

Account and identity information

When you create an account or are invited to one, we collect your name, email address, profile image, organization or team, role, sign-in provider, user identifier, and authentication metadata. If you sign in with Google or Microsoft, we receive the account information those providers share with us, such as your name, email address, profile image, and account identifier. Authentication credentials are handled by our authentication provider; we do not store plaintext passwords.

Practice and training information

When you use the Service, we collect the content you and the Service generate, including messages, transcripts, scenario context, hints, evaluations, scores, feedback, manager notes, and session metadata. If you use voice features, we process audio to provide the interaction and may create transcripts. We do not use voice for biometric identification.

If you are a trainee, your manager or organization administrators may see your practice sessions, scores, and feedback as part of the Service.

Usage and technical information

We collect limited technical information such as IP address, browser and device type, pages viewed, timestamps, error and performance data, referring URL, cookie and session identifiers, and approximate location derived from IP address. This information helps us operate, secure, and improve the Service.

Support communications

If you contact us, we collect your message, contact details, and any information you choose to include so we can respond and keep a record of the request.

2. How we use information

We use personal information to:

  • Provide, operate, and secure the Service, including creating and managing accounts and organizations.
  • Authenticate you, maintain your session, and enforce access permissions.
  • Generate customer responses, hints, evaluations, transcripts, and feedback, including through AI service providers.
  • Save your progress and show training insights to you and, where applicable, your manager or organization administrators.
  • Respond to support requests and communicate service or administrative messages.
  • Monitor, troubleshoot, prevent abuse, and improve the quality and safety of the Service.
  • Comply with law, enforce our agreements, and protect our rights and the rights of others.

We do not use personal information for third-party advertising, and we do not sell personal information.

If you are in the European Economic Area or the United Kingdom, we rely on one or more of the following legal bases: performance of a contract (providing the Service), our legitimate interests (security, improvement, and business operations), your consent (where we ask for it), and compliance with legal obligations. Where your organization is the controller, it is responsible for the legal basis and we process on its instructions.

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that already occurred.

4. Cookies and similar technologies

We use strictly necessary cookies and similar technologies to authenticate you, keep you signed in, and protect the Service. Our authentication provider sets session cookies; in production they are HTTP-only, Secure, and SameSite=Lax. We do not use advertising cookies or cross-site tracking.

We do not currently respond to browser Do Not Track signals. If we introduce analytics or other non-essential cookies, we will update this policy and, where required, ask for consent before using them.

5. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only as described below.

Service providers

We use providers that process information on our behalf to operate the Service, including Supabase (authentication and database), Amazon Web Services (hosting and backups), LiveAvatar (avatar and voice interaction), and OpenRouter and the underlying model providers it routes to (AI text and speech processing). These providers process information under their agreements with us and are not permitted to use it for their own advertising.

Google and Microsoft also act as independent providers when you use their sign-in services; their own privacy policies apply to their handling. We receive only the account information described above.

Your organization

If you use the Service through an organization, managers and administrators may see your account information, practice sessions, scores, and feedback as part of the Service.

Legal, safety, and business transfers

We may disclose information if we believe it is necessary to comply with law or legal process, protect the rights, safety, or security of our users or others, investigate fraud or abuse, or enforce our agreements. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to appropriate confidentiality protections.

We may also share information with your consent or at your direction.

6. Google and Microsoft sign-in

When you sign in with Google, we receive your name, email address, profile image, and Google account identifier. We use this information to authenticate you, create and manage your account, and display your profile.

Maxymus.ai’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, sell it, use it to determine creditworthiness or for lending purposes, or use it to train generalized AI models. We do not allow humans to read Google user data unless we have your consent, it is necessary for security or support, it is required by law, or the data is aggregated or de-identified.

When you sign in with Microsoft, we receive similar account information. Microsoft’s privacy terms apply to its handling of your Microsoft account data.

7. AI processing

We use AI service providers to generate customer responses, hints, evaluations, transcripts, and speech. Your practice content may be sent to these providers to produce the output. AI outputs may be inaccurate, incomplete, or biased; they are training aids, not professional, legal, or financial advice.

We do not use your practice content to train our own generalized AI models. Our providers’ handling of information is governed by their terms and our agreements with them.

8. Retention and deletion

We retain personal information for as long as needed for the purposes described in this policy, including while your account is active. Practice data is retained according to your organization’s agreement and settings. Our model request and response context logs are retained for up to seven days for debugging and quality purposes. Backup copies are retained for a limited period for recovery.

We may retain information longer if required by law, to resolve disputes, or to enforce our agreements. When you or your organization asks us to delete information, we delete or de-identify it, except for backup copies that are overwritten on their normal cycle and information we must retain by law.

9. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including TLS for connections between your browser and the Service’s public HTTPS endpoints, access controls, server-side secrets, and encryption at rest provided by our infrastructure providers. Some internal infrastructure and provider connections may use different transport protections; we restrict access to those paths and review them as part of operations. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

10. International transfers

Our providers primarily process information in the United States. If you access the Service from another country, your information may be transferred to, stored in, and processed in the United States and other countries where our providers operate. Where required, we use appropriate safeguards for these transfers.

11. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or port your personal information; restrict or object to certain processing; withdraw consent; and lodge a complaint with a supervisory authority. To exercise these rights, contact us at the email below. We may need to verify your identity before responding. If your organization is the controller, it may handle your request, and we will assist it.

California residents

If you are a California resident, you may have the right to know what personal information we collect, use, and disclose; to delete or correct it; to opt out of the sale or sharing of personal information; to limit the use of sensitive personal information; and to not be discriminated against for exercising your rights. We do not sell personal information or share it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics about you. You may exercise your rights through an authorized agent, subject to verification.

Other U.S. state privacy laws

Residents of other states with comprehensive privacy laws may have similar rights, including rights to access, correct, delete, and opt out of certain processing. Contact us to exercise those rights.

12. Children

The Service is intended for workplace training and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact us and we will delete it.

The Service may contain links to third-party websites or services. We are not responsible for their privacy practices. We encourage you to review their privacy policies before providing information to them.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date. If changes are material, we will provide notice as required by law. Your continued use of the Service after the effective date means you accept the updated policy.

15. Contact us

If you have questions, privacy requests, or concerns about this policy, contact us at protostatis.dev@gmail.com. Please include “Privacy Request” in the subject line so we can route your message. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local supervisory authority.

Maxymus.ai