Legal
Privacy Policy
Summary
- You can run an audit without an account. We process the web address you submit and the public page it points to.
- With an account we process your email address, the name you give us, and the websites, pages, audits, workflow states and notes you save.
- You can connect a coding agent through MCP with a revocable API token, or let an app connect by signing in to MaxiMarket. MaxiMarket receives page addresses and returns audits; it never receives your source code. See Coding agents and API access.
- We use one strictly necessary sign-in cookie. We use no advertising cookies, no third-party analytics and no trackers. There is no cookie banner because nothing optional is stored.
- Our product analytics run on our own server, without cookies or device identifiers, and never store IP addresses.
- We do not sell personal data or share it for targeted advertising.
- You can delete your account, and everything saved in it, at any time from your account page.
- Accounts that are never used are deleted automatically after a short period; accounts you use, and what you save, are kept. See Accounts that are never used.
Who is responsible
The controller responsible for personal data processed through MaxiMarket (maximarket.info) is Robert Halas, who operates MaxiMarket as an individual. Contact for privacy requests: support@maximarket.info.
If the law requires us to appoint a representative in the European Union, we will name them in this policy.
What we process and why
For people in the European Economic Area, the table names the legal basis under Article 6(1) of the General Data Protection Regulation (GDPR).
| Data | Purpose | Legal basis (EEA) |
|---|---|---|
| Web address you submit for an audit, and the audit result | Running the audit you request and showing you the report | Legitimate interests (providing the requested audit; 6(1)(f)); for signed-in users, performance of our agreement (6(1)(b)) |
| Email address, name, email-verified status, account creation date | Creating and operating your account and passwordless sign-in | Performance of our agreement with you (6(1)(b)) |
| Sign-in sessions: a session token, its expiry, and the IP address and browser user agent recorded when the session started | Keeping you signed in and protecting accounts against misuse | Performance of our agreement (6(1)(b)); legitimate interests in account security (6(1)(f)) |
| One-time sign-in and verification links (stored only as a hash, with your email address) | Verifying your email address and signing you in | Performance of our agreement (6(1)(b)) |
| Sites, pages, groups, audits, workflow states and private notes | The Sites features you use | Performance of our agreement (6(1)(b)) |
| API tokens you create for coding agents: their name, permissions, a keyed hash of the token (never the token itself), when they were created, first and last used and revoked, the last tool used, the client name your agent reports when it connects, and which audits, crawls and fix checks each token started; the audit requests your agent sends with them | Letting your agents use MaxiMarket on your behalf and keeping that access revocable | Performance of our agreement (6(1)(b)) |
| Apps you connect by signing in (OAuth): the app’s identifier and the details it publishes about itself (such as its name, website and the addresses it returns to), the access you allowed and when, its access and refresh tokens, stored only as hashes, and which crawls and fix checks it started | Letting the apps you choose use your account on your behalf, within the access you allowed, and letting you revoke them | Performance of our agreement (6(1)(b)) |
| Feedback you send while signed in: its type and message, with the page you sent it from, the audit and standard version shown there, your browser’s user agent and window size | Investigating reported problems and improving MaxiMarket | Legitimate interests (6(1)(f)) |
| Product analytics events (see below) | Understanding which features are used so we can improve and keep the service reliable | Legitimate interests (6(1)(f)) |
| IP address, held briefly in memory; server access logs | Rate limits, abuse prevention and security | Legitimate interests in security and in keeping the free service available (6(1)(f)) |
Where we rely on legitimate interests, you can object at any time (see Your rights).
Audits of public web pages
When you submit an address, our servers request that public page and a few related public files (such as robots.txt and sitemaps) and store a bounded, structured result: for example the page title, meta description, headings count and a summary of structured data. We do not store the full page. Please submit only pages you are allowed to have audited (see the Terms).
Audits you run while signed out are stored without a link to you or to an account, and without your IP address. They do not appear in any audit history, and once you leave the report MaxiMarket offers no way to find it again. Each audit has a random ID: the result is not listed or published anywhere, but anyone who has that ID can retrieve it until the audit is deleted. If you choose Save on such a report and sign in or create an account, the audit moves into that account and from then on is visible only to you. Audits you run or save while signed in belong to your account and are visible only to you, unless you create a public link for one of them (see below).
An audit is temporary until it is saved. Audits that are not added to Sites, whether run while signed out or signed in, are deleted 30 days after they were requested. Audits you add to Sites become part of that site’s audit history and are kept until you delete them (or the page, website or your account).
Saved audits are private by default. For a saved audit in your Sites you can choose to create a public link; nothing is shared until you do. Anyone with that active link can view that one audit report, read-only: the audited address and its result, not your name, email, account, other audits or the page’s history. Public links are not listed anywhere and ask search engines not to index them. Removing the link makes its address unavailable at once, and a later link gets a new address. The link is also removed when you delete that audit, its page, website or your account.
If you turn on monitoring for a page in your Sites, MaxiMarket audits that public page again automatically, about once a week, and may retry a check shortly afterwards when it could not be completed. Each check is saved as an audit of that page, like the audits you run yourself. For monitoring we store its schedule, the Audit Standard version it is compared under, and which check was last considered for a monitoring email, until you stop monitoring the page or delete the page, Site or your account.
Coding agents and API access
You can create API tokens under Agent access in your dashboard and give one to a coding agent that supports the Model Context Protocol (MCP), or use it with our REST API. With a token, an agent can start audits of page addresses and read your account’s audits and Fix Briefs, and, with Website SEO Audit, read your Sites and start crawls and fix checks, within the permissions you chose for that token. Crawls and fix checks it starts count against your account’s limits like those you start yourself. Audits it starts belong to your account and follow the same rules as your other audits, including deletion of unsaved audits after 30 days.
MaxiMarket receives only what the agent sends: page addresses to audit and the IDs of audits to read. It does not receive, request or store your source code or repository. The agent runs in your own environment, with the AI provider or local model you choose; what you share with that agent or provider is governed by their terms, not by this policy.
We store a keyed hash of each token, never the token itself, together with its name, permissions, and when it was created, first and last used and revoked. For your activity overview we also keep the last tool the token used, the client name your agent reports when it connects (such as the name of your coding agent), and which audits the token started. Each crawl and fix check records how it was started (the dashboard, the REST API or MCP, with a token or a connected app) and the internal identifier of that token or app, which is kept with the crawl even after the token is revoked or the app removed; we do not record IP addresses, request contents or headers for this. Our application never writes tokens to its logs. Requests made with a token appear in the web server’s access logs like any other request (see Security and server logs). You can revoke a token at any time; it stops working immediately.
Some apps, such as Claude Code or Codex, can connect without a token. The app opens MaxiMarket in your browser; you sign in and choose whether to allow it. Nothing is shared until you press Allow. A connected app can read your Sites, crawls, findings, Agent Briefs, fix checks and audits, depending on what you allowed. It can start crawls or fix checks only if you allowed that permission; the app has to ask for it, and MaxiMarket asks you again before it is granted. It cannot start single-page audits, cancel anything or change your settings.
To show you who is asking, we fetch the app’s public details from the web address that identifies it, and keep its name, website and the addresses it returns to. For each app you allow, we keep what you allowed and when, and its access and refresh tokens as hashes, never the tokens themselves. Access tokens expire after 15 minutes. You can see and revoke connected apps under Agent access. Revoking removes the permission and the app’s tokens, and the app stops working at its next request.
We send only service email: verification and sign-in links, and, if you monitor pages, monitoring emails about meaningful changes on those pages (a technical regression, verified fixes, a page that could not be checked, or a new Audit Standard). You can turn monitoring emails off in your account or with the link in every monitoring email; this does not stop or pause monitoring. Email is delivered by Mailgun (Sinch) through its EU region, with open and click tracking turned off. We do not send marketing email.
Cookies and browser storage
We use one strictly necessary authentication cookie while you are signed in, valid for 30 days and never extended; logging out ends the session and removes it. A theme preference is stored in your browser only if you choose a theme. Full details are on the Cookies page. We do not use advertising or analytics cookies, and no third party sets cookies or collects data through our pages.
Product analytics
Our own server records a small set of product events, such as “audit started”, “audit completed”, “page saved” or “fix brief created”, with a timestamp and a few coarse details (for example audit mode, standard version or outcome category). Events from signed-in actions are linked to the account internally; events from signed-out visitors are not linked to anyone. We never store IP addresses, user agents, referrers, email addresses, submitted addresses or form contents in analytics, and we do not use cookies, device identifiers, fingerprinting or cross-site tracking for it. Events are deleted after 13 months, and the events linked to an account are deleted with the account.
Security and server logs
To limit abuse of the free audit service, we count audits per IP address. The address is held only in memory as a one-way hash, for at most 24 hours, and is not written to disk. Our web server keeps standard access logs (IP address, time, requested path, response status and browser user agent) for security and troubleshooting, and deletes them regularly through log rotation. Application logs record operational errors without the contents of your requests.
Service providers and transfers
- Hosting: Akamai Technologies (Linode) provides the server that runs MaxiMarket and its database, located in Frankfurt, Germany.
- Transactional email: Mailgun (Sinch), EU region.
They process personal data on our behalf, only to provide their services to us. MaxiMarket’s server and database are in the EU, and email is sent through Mailgun’s EU region. Akamai Technologies is based in the United States, and Mailgun is a US company in the Sinch group. We do not otherwise disclose personal data, except where required by law.
No selling or targeted advertising
We do not sell personal data and do not share it for cross-context behavioural (targeted) advertising, and we have not done so. MaxiMarket does not track visitors across other websites, and no third parties collect data about your activity over time and across sites through MaxiMarket. Because there is no such tracking, browser “Do Not Track” and Global Privacy Control signals do not change how we process data; we already treat every visitor as opted out of sale and sharing.
How long we keep data
- Account data and everything you save, including audits added to Sites: until you delete it or delete your account. Account deletion removes it immediately and permanently, together with any unsaved audits of the account.
- Accounts that are never used: deleted automatically 30 days after they were created (72 hours if the email address was never verified). Accounts you use are kept; see Accounts that are never used.
- Sign-in sessions: until you log out or the session expires after 30 days; expired sessions are removed by a daily cleanup.
- Sign-in and verification links: until used or expired (15 minutes for sign-in links, 24 hours for verification links); expired links are removed by a daily cleanup.
- Unsaved audits, whether run while signed out or signed in: 30 days after the audit was requested, then deleted by the daily cleanup and can no longer be opened. An audit that is still running is not deleted by this cleanup.
- Website crawls (Website SEO Audit): each crawl is stored with its website as audit history. It includes the pages it found, what happened to each page and their audit results. We keep the 5 newest finished crawls of each website, whether they completed, stopped or were cancelled. Older finished crawls may be removed by the daily cleanup. A crawl that is still running is never removed. Crawls are deleted with the website or your account.
- Fix checks (Verify fixes in Website SEO Audit): each fix check is stored with its website. It includes the pages it checked again, their new audit results, and a copy of the original findings it compared. We keep the 10 newest finished fix checks of each website, in addition to the 5 newest crawls. Older finished fix checks may be removed by the daily cleanup. A fix check that is still running is never removed. Fix checks are deleted with the website or your account.
- Monitoring settings and your monitoring email preference: until you stop monitoring the page, or delete the page, Site or your account. Monitoring checks are audits of the page in your Sites and are kept like them.
- Feedback you send: until you delete your account.
- API tokens: until you delete your account. A revoked token can no longer be used; its record (name, permissions and dates, without the token) is kept until you delete it under Agent access or delete your account.
- Connected apps: what you allowed, and the app’s tokens, until you revoke the app or delete your account. Refresh tokens expire after 30 days if the app is not used. An app’s public details are kept while it is connected to an account.
- Product analytics: 13 months.
- Rate-limit counters: at most 24 hours, in memory only.
- Web-server logs: for a limited period for security and troubleshooting, then deleted through log rotation.
Accounts that are never used
To avoid keeping personal data we do not need, a daily cleanup deletes accounts that were created but never used. An account is kept as long as any of these is true:
- it has an audit, run or saved while signed in;
- it has a Site or an audited page in Sites;
- it was signed in to or used more than 24 hours after it was created (the visit in which you confirm your email address does not count on its own).
An account with none of these is deleted 30 days after it was created, or 72 hours after it was created if its email address was never verified. Accounts you use, and everything you save in them, are not affected: they are kept until you delete them or your account. To apply this rule we record when your account last signed in and was last active, without device or location details. You can always create a new account later.
Your rights
Everyone
You can see and delete what your account holds directly in MaxiMarket: delete single pages, groups or websites, or your whole account from the account page. For anything else, contact us at support@maximarket.info. We may need to confirm that a request comes from the account holder.
European Economic Area
Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to processing, and to data portability. Where processing is based on legitimate interests, you can object on grounds relating to your situation. You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State where you live or work, or where an alleged infringement took place.
United States
Depending on your state, privacy laws such as the California Consumer Privacy Act may give you rights to know, access, correct and delete personal information, to opt out of its sale or sharing and of targeted advertising, and not to be discriminated against for using these rights. We do not sell or share personal information or use it for targeted advertising. We honour requests to know, correct and delete from any user, whether or not a particular law applies to MaxiMarket.
Children
MaxiMarket is a professional tool and is not directed to children. Accounts are for people aged 16 or over, and we do not knowingly collect personal data from children under 13. If you believe a child has created an account, contact us and we will delete it.
Security
Connections use HTTPS. Sign-in links are single-use, short-lived and stored only as hashes; there are no passwords. Session cookies are HttpOnly, Secure and SameSite. The database is not reachable from the internet, and audits of submitted addresses are limited to public destinations. No system is perfectly secure; we will notify you and authorities where the law requires.
Changes to this policy
We will update the effective date above when this policy changes. For material changes we will notify signed-in users by email or in the product before the change takes effect.
Contact
MaxiMarket is operated by Robert Halas as an individual. Privacy, account and data requests: support@maximarket.info.