Privacy Policy
How max.app collects, uses and shares personal data, and the rights you have over it.
This notice explains what happens to personal data when you use www.max.app (the "Site"). It covers visitors to the Site and people who contact us through it. max.app is in private beta: there are no accounts, no logins and no payments, which keeps what follows short.
References to "we", "us" and "our" are to Tzar.Tech Ltd.
Who is responsible
Tzar.Tech Ltd. is the controller for personal data processed through the Site.
- Registered office: 16 Blaga Dimitrova, 1505, Sofia, Bulgaria
- Privacy contact: privacy@max.app
What we collect
What you give us
Three things reach us because you chose to send them:
- Contact form — your name, work email, company, the workload you picked from a fixed list, and your message.
- Newsletter — your email address.
- Waitlist / early access — your email address, when that form is shown.
Nothing else on the Site sends us anything. There is no account to create and no profile to fill in.
What is collected automatically
- Server and platform logs — IP address, user agent and timestamps, kept by our hosting provider so the Site can be operated and debugged.
- Usage measurement — page views and interaction events, described under Analytics below. These carry no name, email, company or message.
- Bot checks on the form pages — technical signals sent to Cloudflare, described under Bot protection below.
We do not build profiles, we do not track you across other sites, and we set no advertising identifiers.
Why we use it, and on what legal basis
| What we do | Legal basis (UK/EU GDPR Art. 6) |
|---|---|
| Answer your contact message | Legitimate interests — responding to an enquiry you initiated |
| Send the newsletter you asked for | Consent, withdrawable at any time |
| Hold your place on the early-access waitlist | Consent, withdrawable at any time |
| Keep the Site available, secure and free of automated abuse | Legitimate interests — operating and defending the service |
| Measure how the Site is used, in aggregate | Legitimate interests — improving the Site, using data that does not identify you |
| Meet obligations that apply to us | Legal obligation |
We do not sell personal data, and we do not use it to make automated decisions about you.
Who else is involved
We use a small number of processors. Each one is bound by a written contract and may only act on our instructions.
| Provider | Role | What it receives |
|---|---|---|
| Vercel Inc. | Hosting and delivery of the Site; usage measurement | Request metadata (IP, user agent, page), and analytics events |
| Cloudflare, Inc. | Bot check on the form pages; protected access to our content service | IP address, user agent and technical browser signals |
| Our own content service | Stores form submissions | The contents of the form you submitted |
Form submissions are stored on infrastructure we operate ourselves, reached over an authenticated connection, rather than handed to a third-party CRM or marketing platform.
Beyond the above, we may disclose personal data where we are legally required to, or where it is necessary to establish, exercise or defend legal claims. If our business or its assets were ever acquired, personal data could transfer as part of that — you would be told.
Otherwise we do not share, sell or rent your personal data to anyone.
Analytics
Usage is measured with Vercel Web Analytics, which is cookieless and stores nothing on your device. It records the page you are on, where you arrived from, coarse technical details such as country, browser and device type, and events for the links, buttons and forms you use. The only form value it receives is the workload you select from the fixed list. It never records what you type — not your name, email, company or message — and it does not identify you across other sites.
Bot protection
The contact, newsletter and waitlist forms are checked with Cloudflare Turnstile before a submission is accepted, so that a person gets through and a script does not.
On a page that carries a form, your browser contacts Cloudflare, which receives your IP address, your user agent and technical signals about the browser itself, and scores the check from them. Cloudflare does not receive what you type into the form. Pages with no form on them do not contact Cloudflare at all.
We rely on legitimate interests for this: without it, the forms fill with automated submissions. Cloudflare's own handling is governed by its privacy policy at cloudflare.com/privacypolicy.
Sending data outside the EEA
Vercel and Cloudflare are established in the United States, so operating the Site involves transfers outside the European Economic Area. Those transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses together with appropriate technical measures.
We do not rely on the EU-US Privacy Shield, which the Court of Justice invalidated in 2020.
Details of the safeguards for any specific transfer are available on request from privacy@max.app.
How long we keep it
- Contact submissions — kept while we handle your enquiry and for a reasonable period afterwards so we can pick up the thread, then deleted.
- Newsletter subscriptions — kept until you unsubscribe.
- Server logs — rotated on a short operational cycle.
- Analytics — retained in aggregate, and not tied to you.
Where we hold data for marketing on the basis of your consent, we stop using it for that purpose as soon as you withdraw consent.
Your rights
You have the following rights over your personal data. To use any of them, email privacy@max.app.
- Access — a copy of the personal data we hold about you, confirmation that we are using it, why, and what safeguards apply to any transfer outside the EEA.
- Rectification — correction of anything inaccurate or out of date.
- Erasure — deletion, in the circumstances where that right applies.
- Restriction — a pause on how we use your data, in the circumstances where that right applies.
- Objection — to ask us to reconsider any use we base on legitimate interests.
- Withdraw consent — at any time, where consent is the basis we rely on. This does not affect what was lawful before you withdrew it.
- Stop marketing — an absolute right; use the unsubscribe link in any email, or write to us.
- Portability — to receive your data in a portable form, or have it sent to another provider, where we rely on consent or contract and process by automated means.
We will respond within one month. We may need to verify your identity first. If an exemption applies to part of your request — for example, where we must keep something to meet a legal obligation — we will say so in our response.
Complaints
If something about our handling of your data concerns you, please raise it with us first at privacy@max.app so we can look into it.
You also have the right to complain to a data protection supervisory authority. In Bulgaria, that is the Commission for Personal Data Protection (cpdp.bg). You may instead go to the authority where you live or work.
Security
We take reasonable organisational and technical measures to protect personal data against loss, misuse and unauthorised access. Traffic to the Site is encrypted in transit, and form submissions travel to our content service over an authenticated connection.
No transmission over the internet is ever completely secure, so we cannot guarantee the security of data while it is in transit to us.
Cookies
The Site sets no cookies. What little is stored in your browser, and the third-party connections the Site makes, are set out in the Cookie Policy, which forms part of this notice.
Changes
We may update this notice. The effective date at the top always reflects the current version, and material changes will be highlighted on this page.
Questions — the contact form reaches a person. All legal notices.