Privacy Policy

This Privacy Policy describes how Maktby (“we”, “us”, “our”) collects, uses, discloses, and protects information when you use our websites, applications, APIs, and related services (collectively, the “Service”). By using the Service, you acknowledge this Policy together with our Terms of Service.

If you use the Service on behalf of a company or other organization, you represent that you are authorized to accept this Policy for that entity. Consumer protection and privacy laws vary by region; where required, we will honor applicable rights and provide additional disclosures.

We hope everyone uses Maktby with honesty and care: only for lawful purposes, and never to harm others or break the rules of the platforms you connect. Illegal activity has no place in our community.

Our Terms of Service include a warm, plain-language section on lawful use and Islamic values for people who want their marketing, messaging, and creative work to stay aligned with Islamic ethics—alongside full compliance with the law. This Policy describes how we handle data; those Terms describe how we expect the Service to be used. Together they reflect the same spirit: respect, integrity, and doing the right thing.

The data controller for personal data processed through the Service is the legal entity operating Maktby. For privacy requests (including access, correction, deletion, or portability where applicable), contact us through the contact options published on the Service (for example, the Contact page). Include enough detail for us to verify and fulfill your request securely.

• We may ask you to verify your identity before processing sensitive requests.
• If you connect third-party accounts (social networks, messaging platforms, payment providers), those providers also process data under their own policies.

We collect information in the following categories, depending on how you use the Service:

• Account and profile: name, email, username, password or authentication tokens, organization or workspace identifiers, role, preferences, and security settings.
• Billing and commerce: billing contact details, transaction references, invoices, and payment status. Payment card data is typically handled by our payment processors; we do not store full card numbers on our servers when processors tokenize payments.
• Content you provide: prompts, generated media (images, video, audio), text, uploads, comments, posts, drafts, schedules, templates, knowledge-base materials, bio pages, short links, and other materials you submit to features across the platform.
• Communications: messages you send or receive through connected channels (for example, business messaging or social inboxes where you enable integrations), support tickets, and email correspondence with us.
• Integrations and OAuth: when you connect external accounts (such as Meta, WhatsApp Business, TikTok, Google Business Profile, or other supported platforms), we receive tokens, identifiers, page or channel metadata, and content needed to provide inbox, publishing, analytics, and automation features you configure.
• Technical and usage data: IP address, device type, browser, approximate location derived from IP, timestamps, logs, diagnostics, feature usage, API calls, error reports, performance metrics, and security signals (such as failed logins or abuse patterns).
• Cookies and similar technologies: see the Cookies section below.

We use personal data to operate, secure, and improve the Service, including:

• Providing core functionality: authentication, workspaces, credits or usage accounting, AI generation and editing, galleries, publishing, calendars, inboxes, automations, reporting, and administrative tools you are entitled to access.
• Processing instructions you give the product (for example, generating images from a prompt or posting content to a connected channel at your direction).
• Safety and integrity: detecting fraud, spam, malware, policy violations, and protecting users and the platform.
• Support and communication: responding to requests, sending service notices, security alerts, and (where permitted) product updates.
• Analytics and product improvement: understanding feature usage in aggregated or de-identified form where possible.
• Legal compliance: complying with law, responding to lawful requests, and enforcing our Terms and acceptable use rules.

Certain features use artificial intelligence models and related infrastructure operated by us or by subprocessors you configure (including “bring your own key” setups where you supply API credentials). Inputs you provide (such as prompts, attachments, or conversation context) may be transmitted to model providers solely to generate outputs you request.

• Do not submit highly sensitive personal data (for example, government ID numbers, health records, or payment card data) in prompts unless a specific feature explicitly requires it and you accept the risk.
• Outputs may be imperfect; you are responsible for reviewing outputs before relying on them for professional, legal, medical, or safety-critical decisions.
• We may retain logs and outputs as described in Retention and as needed to provide history, billing evidence, abuse investigation, or legal obligations.

When you connect third-party platforms, we process data needed to mirror inboxes, publish posts, fetch analytics, manage comments, or import content, according to your settings and the permissions you grant. Each platform’s terms and privacy policy also apply.

• You can disconnect integrations from your workspace settings where supported; revocation may take time to propagate on the third-party side.
• Webhook or streaming events may contain message content and metadata from end users interacting with your connected channels; you are responsible for lawful collection and for providing any required notices to your customers or contacts.
• We do not control third-party APIs; outages, policy changes, or account restrictions may affect features.

We use cookies, local storage, and similar technologies for session management, security (for example, CSRF protections), preferences, language selection, analytics where enabled, and to remember certain UI choices. You can control cookies through browser settings; disabling some cookies may limit functionality.

We do not sell your personal information as “sale” is commonly understood in privacy laws. We share information only as needed:

• Service providers: hosting, storage, email delivery, analytics, security, customer support tooling, and AI/model infrastructure under strict contracts and security expectations.
• Payment processors: to complete transactions you initiate.
• Legal and safety: when required by law, to enforce our agreements, or to protect rights, safety, and security.
• Business transfers: in connection with a merger, acquisition, or asset sale, subject to appropriate safeguards and notices.
• With your direction: for example, when you publish content to a third-party network or invite collaborators into a workspace.

We may process and store information in countries other than where you live. Where required, we use appropriate safeguards (such as standard contractual clauses or equivalent mechanisms) for cross-border transfers of personal data.

We retain personal data for as long as your account is active, as needed to provide the Service, and as required by law, dispute resolution, or legitimate business purposes (such as backups with limited retention, audit logs, and fraud prevention). Deletion may be delayed in backup systems for a reasonable period. Some aggregated or de-identified data may be retained without identifying you. Short links without an active plan are limited to a maximum lifetime of twenty-four (24) hours from creation; after expiry they are no longer publicly resolvable, though limited records may remain for security, billing, or legal purposes as described elsewhere in this Policy.

We implement administrative, technical, and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure; you should use strong passwords, enable multi-factor authentication where available, and protect API keys and integration secrets.

For more detail, see our Security page on the marketing site.

Depending on your location, you may have rights to access, correct, delete, or export personal data; object to or restrict certain processing; withdraw consent where processing is consent-based; and lodge a complaint with a supervisory authority. You may also have rights related to automated decision-making where applicable laws provide them.

To exercise rights, contact us through the published contact channel. We will respond within the timeframe required by applicable law. If we deny a request, we will explain why where required.

The Service is not directed to children under the age where parental consent is required in their jurisdiction. We do not knowingly collect personal information from children. If you believe we have collected such information, contact us and we will take appropriate steps to delete it.

Where permitted, we may send promotional communications. You can opt out of marketing emails using the unsubscribe link or account settings. We may still send non-promotional service messages (for example, billing receipts, security alerts, or policy updates).

Residents of certain U.S. states may have additional rights under state privacy laws (such as rights to know, delete, correct, opt out of certain processing, or appeal decisions). The categories of personal information we collect are described in “Information we collect”. We use such information for the purposes in “How we use information”. To submit a request, use our contact options; we will verify and respond in accordance with applicable law.

We may update this Privacy Policy from time to time. We will post the revised version on the Service and update the effective date at the top of this page. If changes are material, we will provide additional notice as appropriate (for example, by email or in-product notification). Continued use after the effective date constitutes acceptance of the updated Policy, except where prohibited by law.