Privacy Policy
Last updated 23 October 2026
Management Max is a weekly metrics platform for mobile app companies, operated by Solarity AI LLC ("we", "us"), registered at 310 Gran Via, Irving, TX 75039. This policy describes what the service holds today, why, where it is stored, how long it is kept and how you have it removed.
The service is in internal validation and is not yet commercially available. This policy describes what is actually built. It does not describe features that are planned, and we will publish a revision before any new way of collecting data goes live. Automated connections to third-party sources are not available yet; today figures reach the platform only by manual entry, spreadsheet upload, or an API key you create yourself.
1. What we do not collect
We do not collect end-user personal data from our customers' apps. There is no SDK that runs inside your app, no device or advertising identifier, no event stream tied to a person, and no individual user record. The platform is built to hold aggregate company figures.
One honest caveat: a spreadsheet you upload is a file you control, and nothing stops a person from putting personal data in one. We do not parse anything except the metric cells we expect, we do not index the rest, and we ask you not to upload personal data. If you upload a file that contains it by mistake, tell us and we will delete the file.
2. What we collect
2.1 Account data
Your name, email address, a hashed password (Argon2id, never the password itself), your role and the workspace you belong to. Invitations record the email address invited, the role offered, who invited them and when it expires.
2.2 Company operational data
The metrics your team records: revenue, subscribers, installs, crash rates, marketing reach and the rest of the metric catalogue, along with the apps, groups and definitions you configure. This is business data about a company, not about a person.
2.3 Uploaded files
Spreadsheets you upload for import are stored so an import can be reviewed, reversed and audited. We store the file, its original name and its checksum. Files are checked for type, size and structure before they are parsed.
2.4 Audit log
Every change to a metric figure is recorded with the identifier of the account that made it, the time, and the values before and after. Account and workspace events are recorded with the actor's identifier and the action. The log stores an account identifier rather than a name.
2.5 Technical data
Server logs recording the request path, response status, timing and a correlation identifier so a single request can be traced. Your session is kept in your own browser's local storage, not in a cookie.
3. How we collect it
- Directly from you when you sign up and create a workspace
- From your workspace's Owner or an Admin when they invite you, which is where we obtain your email address if you did not give it to us yourself
- From figures your team types into the weekly entry form
- From spreadsheets your team uploads
- From your own systems, where you have created an API key and send figures to us
- Automatically, as server logs, when your browser makes a request
4. Why we process it, and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the service | Account data, company data, uploads | Performance of a contract |
| Inviting and managing workspace members | Name, email, role | Performance of a contract; our legitimate interest in running a team product |
| Security, abuse prevention, debugging | Technical data, audit log | Legitimate interest in a secure service |
| Meeting accounting and legal obligations | Audit log, any billing records | Legal obligation |
Providing your name and email is necessary to hold an account; without them we cannot give you access. We do not sell data, we do not share it with advertisers, we do not use it to train machine learning models, and we make no automated decisions that produce legal effects about you. The optional AI explanation in section 6 does not change that: our provider does not train its models on what we send it either.
5. Where your data is stored
Management Max runs in Amazon Web Services in the us-west-2 region, in
Oregon, United States.
The application, the database and file storage are all in that region.
If you are in the European Economic Area or the United Kingdom, your data is therefore transferred outside it, and we rely on the Standard Contractual Clauses for that transfer. If you are in Türkiye, the transfer abroad is disclosed for the purposes of KVKK Article 9. Write to us at the address in section 11 for a copy of the transfer safeguards or a data processing agreement.
Cloudflare terminates TLS at edge locations worldwide. That is a transit path rather than storage, and it is disclosed here rather than left implicit.
EU data residency is not offered. We say so plainly rather than describing an option that does not exist. If your organisation requires it, talk to us before signing up: a European deployment is a change we would make for a customer who needs it, not a setting you can switch on.
6. Who else processes it
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, database, file storage | United States (us-west-2) |
| Amazon Web Services (Simple Email Service) | Sending invitation and password-reset emails, and scheduled report emails to the members a report is addressed to (with the report as a PDF for members who may export it) | United States (us-east-1) |
| Cloudflare | DNS, TLS termination, edge protection | Global edge network |
| Anthropic | The optional AI explanation of a closed week or of one metric, follow-up questions about it, and report drafts from a described request (the request, the report's current layout and the names of your metrics, apps and groups), only where an Owner has turned it on | United States |
The AI explanation is off until a company's Owner turns it on in Settings. When someone asks for an explanation, we send Anthropic a bounded summary that our own calculations have already produced: for a closed week, or for one metric over up to 26 weeks for the apps they selected, the metric and app names, the figures, how each figure was combined across apps, where each value came from (a connector, an import or manual entry), which figures were refused and which were not reported. A follow-up question, at most 300 characters typed by the person who asked, is sent with that summary, and Anthropic may ask our application for more of the same kind of aggregate figures for the same apps and weeks; it cannot reach anything else. We never send source credentials, uploaded workbooks, notes or any data about your own apps' end users. Under Anthropic's commercial terms, what we send through its API is not used to train its models and is deleted from its systems within 30 days, except where it must keep something longer to enforce its usage policy or meet a legal obligation. We keep each explanation, follow-up question and answer with the request, visible only to the person who asked.
That is the complete list today. Error reporting and payment processing are not yet in use; when we add a provider that handles customer data we will update this table and tell workspace Owners before it starts.
7. How long we keep it
| Data | Retention |
|---|---|
| Metric figures and definitions | For as long as the workspace exists, because they are your historical record |
| Account data | Until the account is deleted, then removed within 30 days |
| Uploaded files | Until the workspace is deleted, or on request |
| Audit log | For the life of the workspace, and deleted with it |
| AI explanations, follow-up questions and their answers | Until the person who asked is removed from the workspace or the workspace is deleted |
| Server logs | Rotated on the host; not retained as a searchable archive |
These are the periods we apply today. A copy of your data may survive briefly in a database backup after deletion; backups are not searched to remove individual records, because editing a backup destroys its value as a recovery tool.
8. Your rights
Management Max is used from many countries, and we extend the same set of rights to everyone as a matter of policy rather than only where a local law compels it. You have the right to:
- Learn whether we process your personal data, and request access to it
- Learn the purpose of the processing and whether it is used accordingly
- Know the third parties your data is transferred to, at home or abroad
- Have incomplete or incorrect data corrected
- Have your data deleted or destroyed
- Require that a correction or deletion is communicated to anyone your data was transferred to
- Object to a result reached solely by automated analysis
- Receive a copy of your data in a portable format
- Object to or restrict processing we base on legitimate interest
- Withdraw consent where processing rests on consent
- Complain to your local data protection authority
Where a specific law gives you more, that law controls: under the GDPR, if you are in the European Economic Area or the United Kingdom; under the KVKK, if you are in Türkiye; under the CCPA, if you are a California resident.
To exercise any of these, write to [email protected]. We verify that a request comes from the account holder, then answer within 30 days at the latest and usually sooner. There is no charge. To have data removed, see Data Deletion.
If you are a member of a workspace rather than its Owner, some requests about company data reach us through that Owner, because the company decides what its own operational data is used for and we process it on their instruction. Requests about your own account details come straight to us.
9. Security
Passwords are hashed with Argon2id and are never stored or logged in readable form. Every company's rows are isolated at the database level rather than only in application code, so an ordinary application query cannot reach another company's data even if the application is wrong; this is enforced by row-level security on every table and verified by an automated test that walks the database catalogue. Every change to a figure is audited with the actor and the values before and after. Uploads are validated for type, size and structure before they are read. Traffic is served over TLS.
No system is perfectly secure. If we discover a breach affecting your data we will tell you and the relevant authority within the time the law requires.
10. Cookies
We do not use cookies. Your session is held in your browser's own local storage so that you stay signed in, and it is cleared when you sign out. There are no advertising cookies, no third-party trackers and no analytics that follow you across sites.
11. Children
Management Max is a business tool and is not directed at anyone under 16. We do not knowingly collect data from children.
12. Changes to this policy
We post any change here with a new date at the top. If a change materially affects how we handle your data, or if we begin collecting data in a new way, we will notify the workspace Owner before it takes effect.
13. Contact
The data controller is Solarity AI LLC, 310 Gran Via, Irving, TX 75039. For any question, request or complaint, including data protection matters, write to [email protected].