Privacy Policy

Last updated: September 18, 2026

This Privacy Policy explains how MEDICI + MAESTRO LLC, doing business as MaestroX Studio ("MaestroX Studio," "we," "us"), collects, uses, and shares personal information in connection with the MaestroX Studio platform, websites, and related services (the "Service").

1. Our Two Roles

As a controller. For information about our customers and their users — such as account, billing, and website-visitor data — we act as the data controller and this Policy describes our practices.

As a processor. Our customers (agencies) use the Service to manage their own clients and upload data about those clients and their end users ("Customer Data"). For that Customer Data, the customer is the controller and we process it on the customer's behalf under our agreement with them. If you are an end client of an agency that uses MaestroX Studio, please direct privacy requests to that agency.

2. Information We Collect

• Account & contact information — name, email, company/agency name, and login credentials.
• Billing information — subscription plan, transaction history, and billing details. Card details are collected and stored by our payment processor, Stripe; we do not store full card numbers.
• Customer Data — content, files, assets, messages, and information about clients and campaigns that customers submit to the Service.
• Usage & device data — log data, IP address, browser and device information, pages viewed, and actions taken, collected automatically.
• Cookies & similar technologies — used for authentication, preferences, security, and analytics (see Section 7).
• Communications — messages you send us (for example, support requests).

3. How We Use Information

• Provide, operate, secure, maintain, and improve the Service.
• Process subscriptions, payments, and account administration.
• Communicate with you about your account, security, changes, and support.
• Send service and, where permitted, product communications (you can opt out of marketing).
• Monitor for, prevent, and address fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our terms.

Where the Service offers AI-assisted features, content you provide to those features may be sent to our AI provider to generate outputs; we do not permit that provider to use it to train their models.

4. Legal Bases (EEA/UK)

Where the GDPR or UK GDPR applies, we process personal data on the bases of: performance of a contract (to provide the Service), our legitimate interests (to operate, secure, and improve the Service), consent (where required, e.g., certain cookies or marketing), and compliance with legal obligations.

5. How We Share Information

We do not sell personal information. We share it only as follows:

• Service providers (subprocessors) who help us operate the Service, under contracts requiring appropriate protections;
• To comply with law, respond to lawful requests, or protect rights, safety, and property;
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy;
• With your direction or consent.

Key providers we use include:

Provider	Purpose
Stripe	Payment processing & subscription billing
DigitalOcean	Cloud hosting & data storage
Resend	Transactional email delivery
Twilio	SMS delivery (where used)
Anthropic	AI-assisted features (where used)
Google Analytics	Website & product analytics

This list may change as our services evolve; contact us for the current list of subprocessors.

6. Google User Data (Google Analytics & Search Console)

When you connect a Google account to MaestroX Studio, you authorize the Service to access certain Google user data on your behalf, strictly to power read-only reporting features you initiate. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Data we access. With your consent we request read-only scopes only: Google Analytics (analytics.readonly) to read your GA4 property's aggregated reporting data (sessions, users, acquisition channels, landing pages, and device/audience/geography breakdowns); Google Search Console (webmasters.readonly) to read your verified sites and search-performance metrics; and your Google account email (userinfo.email) solely to label the connected account in the app.
• How we use it. We use this data only to display and generate the performance dashboards and reports you request inside your workspace. We do not modify your Google data, write to any Google API, or access any other Google product.
• How we share it. We do not sell, rent, or transfer Google user data, and we do not use it for advertising. It is shown only to authorized users of your workspace and is processed by our hosting subprocessor (DigitalOcean) to operate the Service. We do not use Google user data to develop, improve, or train generalized AI/ML models.
• Retention & deletion. Report data is cached briefly to improve performance and refreshed from Google. You can disconnect a Google account at any time from the app's Integrations page, which revokes our access and stops further data retrieval; you may also revoke access at myaccount.google.com/permissions.

7. Cookies & Analytics

We use strictly necessary cookies for authentication and security, and analytics cookies to understand usage. You can control cookies through your browser settings; disabling some cookies may affect functionality.

8. Data Retention

We retain personal information for as long as needed to provide the Service and for legitimate business or legal purposes. Customer Data is retained per our customer's instructions and our agreement with them, and is deleted within a reasonable period after account termination unless we are required to retain it.

9. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit, access controls, and tenant isolation. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International Transfers

We may process and store information in the United States and other countries. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

11. Your Rights & Choices

Depending on your location, you may have rights to access, correct, delete, port, or restrict the use of your personal information, to object to certain processing, and to withdraw consent. Residents of certain U.S. states (e.g., California) have rights to know, delete, correct, and opt out of "sale"/"sharing" of personal information; we do not sell personal information. To exercise any right, contact us at maestrox-support@mx2.llc. We will not discriminate against you for exercising these rights. If your data is Customer Data controlled by an agency, please contact that agency.

12. Children

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take appropriate steps.

13. Third-Party Links

The Service may link to third-party sites and services we do not control. Their privacy practices are governed by their own policies.

14. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide additional notice where required.

15. Contact Us

Questions or requests regarding this Policy or your personal information:
maestrox-support@mx2.llc
MEDICI + MAESTRO LLC · 121 S. Broad St., 15th Fl. #250, Philadelphia, PA 19107