Privacy Policy

1. Who is responsible for your data

The data controller is Max Interface AB (org. no. 559492-7385), Barnängsgatan 1B, 116 50 Stockholm, Sweden. For any privacy question or request, email support@maxinterface.com.

2. What we collect and why

Account data. When you sign in with LinkedIn or Google, the sign-in provider shares your email address, name, profile photo URL and an account identifier with us. We use it to create and secure your account and to link your purchases to you. We also record which version of our Terms & Conditions you accepted and when, so we can show what you agreed to. Legal basis: performance of our contract with you (GDPR art. 6(1)(b)), and our legitimate interest in being able to prove the agreement (art. 6(1)(f)).

Purchase data. Payments are processed by Stripe. We never see or store your full card details. We receive your name, email address, billing country, the theme you bought, the amount paid and a Stripe customer and transaction reference. Legal basis: performance of our contract with you, and our legal obligation to keep accounting records (art. 6(1)(b) and (c)).

Theme access. We record which themes your account has access to, whether you bought them or were given them, and when. If we give you a theme before you have an account, we store your email address until you first sign in, so we can add it to your account. We also store theme codes with the theme they unlock and their dates. Legal basis: performance of our contract with you.

Support messages. If you email us, we use your email address and message to help you. Legal basis: our legitimate interest in answering your questions (art. 6(1)(f)), or our contract with you when the message concerns a purchase.

Technical data. Our hosting provider automatically records server logs, including IP address, browser type and the time of each request, which we use to keep the site secure and working. Legal basis: our legitimate interest in running a secure service (art. 6(1)(f)).

What we don’t collect. Your name, title, logo, photos and other details you enter in the generator are processed locally in your browser and are not uploaded to our servers. The final images are generated on your device too. We don’t use analytics or advertising trackers.

3. Cookies and local storage

We only use what is strictly necessary for the site to work, so we don’t ask for cookie consent:

• Sign-in cookies keep you logged in. They are set when you sign in and removed when you sign out or your session expires. When you tick “I agree to the Terms” before signing in, a short-lived cookie carries that choice through the LinkedIn sign-in and is deleted straight after (at most 15 minutes).
• Local storage in your browser remembers the theme codes you have unlocked and small interface preferences. It stays on your device and you can clear it in your browser settings at any time.
• Stripe sets its own cookies on its checkout pages to process payments and prevent fraud. See Stripe’s privacy policy.

If you choose a custom Google Font in the generator, your browser loads it directly from Google, which receives your IP address in the process.

4. Who we share data with

We never sell your personal data. We share it only with service providers who help us run Maxinterface, under data processing agreements, or as independent controllers where noted:

• Supabase — database and user authentication.
• Vercel — website hosting and server logs.
• Stripe — payment processing (independent controller for some processing, e.g. fraud prevention).
• LinkedIn and Google — sign-in, if you choose to sign in with them (independent controllers).
• Google Fonts — only if you choose a custom font.

We may also disclose data when required by law, for example to a tax authority or court.

5. Transfers outside the EU/EEA

Some of these providers are based in, or have staff in, the United States. Where personal data is transferred outside the EU/EEA, it is protected by the EU–US Data Privacy Framework or by the European Commission’s Standard Contractual Clauses.

6. How long we keep data

• Account data — until you delete your account. You can do this at any time from the account menu (click your initial in the top-right corner, then Delete account), or by emailing us. Deletion is immediate and permanent.
• Purchase records — seven years after the end of the financial year, as required by the Swedish Accounting Act (Bokföringslagen).
• Support emails — for as long as needed to resolve your request, then at most 24 months.
• Server logs — for a short period, typically no more than 30 days.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted, unless we must keep it by law (such as accounting records) — you can delete your account yourself from the account menu;
• restrict or object to our processing, including processing based on legitimate interest;
• receive your data in a portable format.

To use any of these rights, email support@maxinterface.com. We will respond within one month. You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or to the data protection authority in the country where you live.

8. Children

Maxinterface is not intended for children under 16, and we don’t knowingly collect their data. You must be at least 18 to make a purchase.

9. Changes to this policy

We may update this policy when our service or the law changes. We will change the “Last updated” date above and, for significant changes, notify customers by email.

10. Contact

Max Interface AB, Barnängsgatan 1B, 116 50 Stockholm, Sweden. Email: support@maxinterface.com. See also our Terms & Conditions.