Privacy Policy

What we collect

Your name, username and email address, and the job, quote, customer and invoice data you enter to run your business (including customer names, phone numbers, email and postal addresses, and photos you attach to jobs). Our servers also keep basic technical logs (such as IP address and the pages requested) to keep the service secure. We don't currently take payments, so we hold no payment details.

What we use it for

• Running your account and the features you use (quotes, jobs, invoices, the assistant)
• Emailing you to confirm your email address, reset your password, and about your account or service changes
• Emailing your customers the quotes, invoices, receipts and reminders that you ask us to send (or switch on)
• Keeping the service secure (for example limiting repeated login attempts)
• Fixing bugs and improving the product

Who else handles your data

• Our hosting provider, which stores the service and its database.
• Amazon Web Services (Amazon SES), which delivers the emails we send you and the emails sent to your customers on your behalf. For those, the customer's name and email address, and the quote or invoice (as a PDF and a link) go to Amazon SES.
• Google: if you sign in with Google, Google tells us your name and email. The text you type into the AI assistant, and into the chat box on our website, is sent to Google's Gemini service to produce a reply. Please don't type anything into the assistant you wouldn't want processed this way. Our pages also load fonts from Google, which means your browser contacts Google.

Customer email addresses and names that you enter are processed by us on your behalf, as your service provider: you decide who they are emailed and when, and you are responsible for having a proper basis to contact them. We don't send marketing to your customers. Quote and invoice pages are reachable by anyone who has the private link, so only share it with the customer.

We don't sell your data, and we don't share your customer data with anyone beyond the providers above that are needed to run the service.

Your rights and your data

Under UK data protection law you can ask us for a copy of your data, to correct it, or to delete it. You can do most of this yourself in Settings: Download my data gives you a ZIP of spreadsheets and PDFs (up to 3 times a day; photos optional), you can edit your details, change your email address, and delete your account. For anything else, email info@maintenato.com.

When you delete your account we permanently remove your account, customers, quotes, invoices, jobs, photos, settings, assistant chats and the log of emails sent to your customers from the live service, together with your sign-in and security details. Backups made before that are kept for up to 30 days and then deleted, so your data will be gone from them after that. We use backups only to restore the service after a failure. We keep anonymous usage counts for the AI assistant (no message text and no link to you), and any message you sent us through the contact form so we can answer it (email us if you want it removed). UK businesses are generally required to keep invoicing and accounting records for several years: that duty is yours, so download your records before you delete and check gov.uk or ask your accountant how long you need to keep them.

You are the controller of the customer data you put into Maintenato, and we process it on your behalf. You are responsible for having a lawful reason to hold it.

Cookies

We use only the cookies needed to run the site. We don't use advertising or analytics cookies, so there is no cookie banner to accept. These are all of them:

• sessionid: keeps you signed in, and remembers where you are in a sign-up, sign-in or two-factor step. If you use the chat box on our website, it also keeps that conversation. Lasts up to 14 days. Not readable by scripts on the page; sent over HTTPS only.
• csrftoken: protects forms from forgery. Set when a page with a form is shown. Lasts up to a year.
• messages: shows a one-off notice such as "Business details saved". Removed as soon as it has been shown; it never outlasts your browser session.
• td ("remember this device"): only set if you tick that box when you sign in. Lasts 30 days. It is signed, tied to your account, and stops working if you change your password or use "Sign out everywhere".

If you sign in with Google, Google sets its own cookies on its own pages. Our fonts are served from our own site, so opening one of our pages, including a quote or invoice link, does not contact Google or any other font service.

Contact

Questions about this policy: info@maintenato.com