MaxAI

GDPR overview

There is no GDPR implementation to report. Across every page collected, from the privacy policy and the terms to the contact page and the full sitemap, the words GDPR, CCPA and General Data Protection do not appear once. No Article 27 representative is designated, no data protection officer is named, no legal basis for processing is stated, no data processing agreement is offered and no subprocessor list is published. No hosting country or region is disclosed either. What exists is informal: deactivating an account is said to trigger deletion from the servers within a reasonable timeframe, and marketing messages carry an opt-out. The terms are governed by California law with jurisdiction in Santa Clara County, and the Chrome Web Store listing declares the publisher a Non-trader, warning EU consumers that consumer rights do not apply to contracts with them.

Who owns the data?

MaxAI's terms make the user responsible for the content they submit and require them to own or hold the rights to it; no clause claims ownership of the outputs the tool generates. The privacy policy, dated 29 June 2023, states that the publisher holds only an email address and a name, used to recognize users at sign-in and sync their settings across devices. It declares that MaxAI collects no information about the sites visited or the content read, and sells no information to third parties. The Chrome Web Store listing repeats that data is neither sold nor transferred for purposes unrelated to the extension's core function.

Reuse rights

The terms place no restriction on what users do with the answers, summaries, rewrites or images MaxAI produces: no ownership claim, no licence-back clause and no attribution requirement appears in the document, so outputs can be reused freely. Responsibility travels with that freedom, since users must already hold the rights to whatever they feed into the service and remain accountable for it. On the publisher's side, declared uses are narrow. Email and name serve sign-in and settings sync, while automatically generated extension reports covering browser version, extension version and operating system feed functionality improvements, usage analysis and troubleshooting. Marketing messages may be sent where the law permits, with an opt-out in every message or through user settings. Nothing in the policy addresses whether submitted content is used to train AI models.

Data retention & training

Hosting summary

No hosting information is published. The privacy policy, the terms and the Chrome Web Store listing name no country, no region and no infrastructure provider, and the site has no trust or security page. No certification, whether SOC 2, ISO 27001 or any other, is claimed. The only commitment offered is generic: the publisher says it applies commercially reasonable technical, administrative and organizational measures against loss, misuse and unauthorized access, while conceding that no transmission or storage method is completely secure. Two observations sit outside that silence and carry no contractual weight. Network lookups resolve the domain to 198.49.23.144, an anycast address belonging to Squarespace, Inc. and geolocated in the United States, which describes where the marketing site is served rather than where user data lives. Separately, AI requests are answered by third-party model providers including OpenAI, Anthropic, Google, xAI, DeepSeek and Mistral, whose own hosting arrangements the publisher never documents. Anyone with a data residency requirement should treat the location of their content as undetermined and ask before subscribing.