Privacy Policy · maffen

1. Who we are

Maffen Oy (“Maffen”, “we”, “us”) is the data controller for the personal data described here. We are based in Finland. For any privacy question or to exercise your rights, contact privacy@maffen.ai.

Maffen is a proactive AI assistant that works inside the messaging app you already use (WhatsApp) and a companion web dashboard. This policy explains what personal data we collect, why, who processes it on our behalf, where it goes, how long we keep it, and the controls you have — including downloading or permanently deleting everything we hold about you.

2. The data we collect

Account & profile — your phone number (your login and the number you message Maffen from), whether it’s verified, display name, email if you give one, language, timezone, preferred channel, marketing opt-in, and your plan.
Channel identity — your WhatsApp user id, so a chat can be bound to your account.
Conversations — the messages you send to and receive from Maffen. We store them to provide the assistant, its memory, and continuity across chats.
Memory — facts Maffen saves about you to be useful (e.g. “does deep work in the morning”). Every memory is listed in your dashboard; you can edit or delete any item at any time, or ask Maffen in chat.
Reminders & routines — scheduled jobs you create or that Maffen sets up (reminders, morning check-ins, recurring routines).
Connected accounts — which third-party services you link (e.g. Google Calendar, Gmail) and non-secret metadata such as the granted scope and the connected account’s email. The access tokens that let Maffen reach those services are encrypted at rest, are never shown to the AI model, and are never included in your data export.
Usage & diagnostics — counts of messages, model calls and proactive sends, plus connector activity logs, used to enforce plan limits, keep the service reliable, and prevent abuse.
Subscription & billing — your plan, status, billing provider and renewal date. Payment-card details are handled by our payment provider and are not stored by us.
Security data — hashed one-time login codes and session tokens, used solely to authenticate you. These are never exported.

3. Why we use it (legal bases)

To provide the service you asked for — running the assistant, memory, reminders and connected tools (contract, GDPR Art. 6(1)(b)).
With your consent — connecting third-party accounts and sending you marketing messages. You can withdraw consent at any time (Art. 6(1)(a)).
Our legitimate interests — securing the service, preventing abuse, keeping it reliable, and limited product improvement (Art. 6(1)(f)).
Legal obligations — e.g. accounting and tax records for payments (Art. 6(1)(c)).

4. Where your data goes (sub-processors)

We don’t sell your data, and we don’t use your conversations or memories to train third-party AI models. To run Maffen we rely on a small set of service providers that process data on our behalf, strictly to operate the service. They cover hosting and our database, the messaging platforms Maffen runs on, one-time SMS codes, AI model providers, connected-account access, web search, and payments. A provider only receives data once the relevant feature is enabled for you, and we instruct AI providers not to use your content to train their models.

The specific list of current sub-processors — what each does, the data it sees and where it’s located — is available on request at privacy@maffen.ai. We’ll give notice of material changes as described in section 10.

5. International transfers

Where a provider processes data outside the EU/EEA (for example, certain AI model providers), the transfer relies on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision. EU Mode is designed to keep reasoning and assistant-data storage in Europe where technically possible. Third-party connectors and messaging platforms remain subject to their own terms and locations, which we can’t control on your behalf.

6. How long we keep it

Account data and the things you ask Maffen to remember are kept for as long as your account exists (you can view, edit or remove individual memories at any time).
The raw chat transcript is not kept indefinitely: messages are automatically and permanently deleted after about 12 months, and completed reminders are cleared a few months after they run. Anything Maffen needed to remember from a conversation has by then been distilled into your memories, so this does not change what Maffen knows about you — it just means we don’t sit on a year-old message log we no longer need.
One-time login codes expire within minutes; login sessions expire automatically.
When you delete your account, all of the above is removed immediately and irreversibly (see “Your rights” below). We do not keep a shadow copy. Routine backups, where used, are rotated and overwritten on a rolling basis.
Limited records we’re legally required to retain (e.g. billing records for tax) are kept for the statutory period.

7. Your rights — and the controls built in

Under the GDPR you can access, port, correct, erase, restrict and object to the processing of your data, and withdraw consent. Two of these are one click away in Settings → Privacy of your dashboard:

Export my data (access & portability). Downloads a single JSON file containing everything we hold about you — profile, memories, messages, reminders, connected-account metadata, usage history and subscription records. For your safety the export deliberately excludes credentials (password/one-time-code hashes, session tokens) and third-party OAuth tokens, because those are secrets, not shareable personal data.
Delete account (erasure / “right to be forgotten”). After you type DELETE to confirm, this permanently removes your profile, memories, messages, reminders, connected-service links, subscription record, login sessions and your one-time-code history. It runs in a single database transaction, your chat link stops working immediately, and it cannot be undone. Export your data first if you want a copy. Note that deleting your Maffen account does not delete data held by connected third parties or by the messaging platform — manage those directly with each provider.

You can also correct your details on the Settings and Memory pages or in chat, disconnect a connector at any time, and opt out of marketing. For restriction, objection, or any request you can’t complete yourself, contact privacy@maffen.ai and we’ll respond within one month.

If you believe we’ve mishandled your data, you can lodge a complaint with your local supervisory authority. In Finland that is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi).

8. How we protect your data

The AI model never sees your raw login secrets or your connected-service tokens. One-time login codes and session tokens are stored only as one-way hashes, and third-party OAuth tokens are encrypted at rest with authenticated encryption (AES-256-GCM). Traffic is served over HTTPS. Connectors are read-first and ask for confirmation before taking actions, so the assistant operates with the least access needed. Access to production data is limited to what’s necessary to run the service.

9. Automated decisions & children

Maffen uses AI to generate suggestions and replies, but it does not make legally or similarly significant decisions about you automatically. Maffen is not directed at children: you must be at least 16, or the age of digital consent in your country.

10. Cookies & consent

We use a small set of first‑party cookies. Strictly‑necessary cookies (your login session, anti‑forgery token, in‑progress sign‑up and referral credit, and your cookie choice itself) are required to run the service. The only non‑essential cookie is a marketing‑attribution cookie, which we set only if you choose “Accept all” in our cookie banner. We don’t use third‑party advertising or analytics trackers. Full details — every cookie, its purpose and lifetime — are on our Cookie Policy, where you can also learn how to withdraw consent.

11. California privacy rights (CCPA/CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the CPRA. In the past 12 months we have collected the categories of personal information described in section 2 (identifiers such as your phone number; electronic/commercial information such as your messages and subscription; and inferences such as your saved memories), for the business purposes in section 3.

We do not sell your personal information, and we do not “share” it for cross‑context behavioural advertising as those terms are defined under the CCPA/CPRA. We have not done so in the preceding 12 months.
You have the right to know/access the personal information we hold, delete it, correct it, and to limit the use of sensitive personal information. The Export and Delete tools in section 7 satisfy access and deletion; for the others, contact privacy@maffen.ai.
We will not discriminate against you for exercising these rights.
You may use an authorized agent to submit requests; we may verify the request and the agent’s authority.

Sensitive personal information we process is limited to what’s needed to provide the service (e.g. your phone number for login and account‑linking); we do not use it to infer characteristics.

12. India — Digital Personal Data Protection Act (DPDP)

If you are in India, we process your personal data as a Data Fiduciary under the Digital Personal Data Protection Act, 2023, on the basis of your consent or for the legitimate uses the Act permits. You are a Data Principal and may access, correct and erase your data, withdraw consent (as easily as you gave it), nominate another person to exercise your rights in the event of death or incapacity, and seek grievance redressal. The Export, Delete and Settings tools in section 7 cover access, correction, erasure and consent withdrawal directly.

Children: if you are under 18 in India, you may use Maffen only with verifiable consent from a parent or lawful guardian, and we do not undertake tracking or behavioural monitoring of, or targeted advertising to, children.

Grievance Officer. For any DPDP request or complaint, contact our Grievance Officer at privacy@maffen.ai. We will acknowledge and respond within the timelines required by law. You may also complain to the Data Protection Board of India.

13. Changes to this policy

We may update this policy as the product evolves. We’ll revise the “last updated” date above and, for material changes, give you notice through the service.