1. Scope
This Privacy Policy explains how AppMaker ("AppMaker", "we", "us") collects, uses, shares and protects personal data when you visit https://appmaker.live, use the AppMaker editor, connect a preview device, contact support or subscribe to a paid plan.
It does not cover apps you build with AppMaker. If you publish an app, you are responsible for providing your own privacy notice to your end users and for complying with the laws that apply to your app.
2. Data we collect
- Account data: name, email address, profile image, team and workspace membership, authentication identifiers and session information.
- Billing data: plan, billing interval, invoice and subscription status, tax information and the last four digits of a payment method. Full card details are handled by Stripe and are not stored by AppMaker.
- App content: the screens, text, images, media, templates, code, versions and settings you create or upload, together with related metadata.
- Usage and device data: IP address, browser and operating-system information, device identifiers, pages viewed, feature usage, logs, error reports and approximate region.
- Support and communications: messages you send to us, attachments, and records of the help we provide.
- AI prompts and outputs: the instructions you send to AI features and the generated results, to deliver the feature and maintain service quality.
Please do not send us sensitive personal data (such as health, biometric or government-identity data) unless we specifically ask for it and explain why.
3. How we use personal data
- Provide, operate, secure and maintain the Service, including authentication, realtime preview and code export.
- Process payments, manage subscriptions, issue invoices and prevent fraud.
- Respond to support requests, enforce our Terms and resolve disputes.
- Send service messages, security alerts and, where permitted, product updates you can opt out of.
- Analyse usage and improve features, performance and reliability.
- Comply with legal obligations and respond to lawful requests.
4. Legal bases (EEA/UK)
Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract (providing the Service and paid plans); legitimate interests (security, fraud prevention, product improvement and service communications); consent (optional marketing and some cookies); and legal obligation (tax, accounting and lawful requests). You may withdraw consent at any time without affecting prior processing.
6. International transfers
Our providers may process data in countries other than yours. Where required, we use appropriate safeguards such as standard contractual clauses, adequacy decisions or equivalent mechanisms, and apply additional security measures where appropriate.
7. Retention
- Account and app content: while your account is active, then for a limited period (generally up to 30 days) after deletion so the deletion can be completed and backups cycled.
- Billing and tax records: for the period required by accounting and tax law (often six to ten years).
- Security and usage logs: generally 30–90 days, unless needed to investigate an incident or legal claim.
- Support records: up to 24 months after the request is closed.
- AI prompts and outputs: retained only as long as needed for the feature, troubleshooting and abuse prevention, unless a longer period is required by law.
We may retain anonymised or aggregated information that can no longer identify you.
8. Security
We use technical and organisational measures designed to protect personal data, including encryption in transit, access controls, row-level security in Supabase, least-privilege service credentials and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
If you believe you have found a security vulnerability, please report it to [email protected]. Do not access, modify or disclose other users’ data while testing.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict, object to or port your personal data, and to withdraw consent or lodge a complaint with your local data-protection authority.
To exercise a right, email [email protected] from the address associated with your account. We may need to verify your identity. We will respond within the timeframe required by law, normally within 30 days.
11. Children
The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will take appropriate steps to delete it.
12. Changes to this policy
We may update this Privacy Policy to reflect changes in the Service or the law. If a change is material, we will provide reasonable notice. The "last updated" date at the top of this page shows when the current version took effect.
13. Contact
Privacy questions and data requests: [email protected]. General support: [email protected]. Postal address and phone details, if required, are available on our Contact page and on valid invoices.
Need help with this policy?
Email [email protected] or use our contact page.
This page is provided for transparency and does not replace a signed agreement or mandatory rights under your local law.