Privacy Policy

About Maynut Technologies

Maynut Technologies Inc. ("Maynut," "we," "us," or "our") is a Canadian corporation operating from Toronto, Ontario. We are an advertising agency that designs, launches, and manages advertising campaigns on Meta platforms — including Facebook, Instagram, Messenger, and Audience Network — on behalf of licensed real estate agents (our "Clients").

For the purposes of Canadian privacy law (PIPEDA), we are a private-sector organization that collects, uses, and discloses personal information in the course of commercial activity. For the purposes of the EU General Data Protection Regulation (GDPR), we act as a data controller for information about our Clients and visitors to maynut.co, and as a data processor for personal information of end users that we handle on a Client's behalf through their Meta ad accounts.

Scope of this policy

This policy applies to:

• Visitors to maynut.co and any subdomain we operate
• Real estate agents and brokerages who engage Maynut as their advertising agency
• Anyone who creates an account and uses the Maynut platform — the web dashboard at app.maynut.co or the Maynut mobile app for iPhone and Android
• Leads and contacts whose information a Client stores in, or whose calls, texts, and emails a Client sends through, the Maynut platform
• Individuals whose information is processed by Maynut through Meta's advertising platforms when we act as our Clients' agency — for example, when we manage a Client's Meta ad account, run lead generation campaigns on their behalf, or access advertising performance data
• Anyone who contacts us by email, phone, or any web form we operate

It does not cover the privacy practices of Meta Platforms, Inc., the Clients themselves (each Client maintains its own privacy policy), or any third-party site we link to. When you interact with a Meta ad we have built, Meta's own Privacy Policy also applies to that interaction.

Whose data we handle

Because we sit between Meta and our Clients, we encounter several categories of people. We treat each differently:

Information we collect

From website visitors

• Contact information you submit voluntarily: name, email address, phone number, brokerage name, market area, and anything else you put in a message
• Technical information automatically logged when you visit: IP address, browser type and version, device type, operating system, referring URL, pages viewed, time on page, and approximate location derived from IP
• Cookies and similar technologies: described in the section on Meta data below

From Clients

• Business information: legal entity name, brokerage affiliation, real estate license number, billing address, billing contact
• Payment details processed by our payment provider (we do not store full card numbers on our own systems)
• Account credentials needed to operate your Meta Business Portfolio and ad accounts on your behalf — handled exclusively through Meta's official OAuth flow and System User mechanisms; we do not ask for and do not store your Facebook password
• Marketing assets you provide for use in ads: photographs, video, listing details, copy, branding
• Communications: emails, call notes, message exchanges, meeting recordings (only with consent)

From the Meta Marketing API

This is described in detail in the next section.

Data from Meta platforms

With your express authorization, Maynut connects to your Meta Business Portfolio and ad accounts through Meta's Marketing API, Graph API, and related developer interfaces (collectively, the "Meta Platform"). The connection is established through Meta's official authorization flow, in which you actively grant Maynut a defined set of permissions. You may revoke this access at any time from your Facebook account's Settings → Business Integrations page or from your Business Portfolio's Connected Apps settings.

Permissions we request

Maynut requests only the Meta permissions necessary to operate your advertising on your behalf. Depending on the services you have engaged us for, these may include:

• ads_management — to create, edit, pause, and delete campaigns, ad sets, and ads in your ad account
• ads_read — to read campaign performance, audience insights, and reporting data
• business_management — to manage assets in your Business Portfolio that are connected to advertising, such as ad accounts, pixels, and custom audiences
• pages_manage_ads and pages_read_engagement — to attach ads to your Facebook Page and read engagement metrics, since every Meta ad must be tied to a Page
• instagram_basic — to associate ads with your Instagram business account where applicable
• instagram_content_publish: to publish the images you choose, with the caption and alt text you write, as posts on your own Instagram business account, only when you click Post in Maynut
• leads_retrieval — to retrieve leads generated by your lead-form ads so we can route them to your CRM
• public_profile — to retrieve your Facebook user ID and display name after you authenticate via Facebook Login, used to identify you within the platform and confirm the correct account is connected
• pages_show_list — to discover which Facebook Pages you manage, so you can select the Page to attribute your ads to
• pages_manage_metadata — to subscribe your connected Pages to leadgen webhook events for real-time lead delivery, and to assign system users to your Pages in the agency partner flow

Information accessed via the Meta Platform

Through these permissions, we may access and process:

• Public profile data: Facebook user ID and display name, used to identify the connected account within the platform
• Account metadata: ad account ID, name, currency, time zone, status, spending limit, billing information
• Campaign data: campaign, ad set, and ad names; targeting parameters; budgets; bidding settings; creative assets; placements; schedules
• Performance data: impressions, reach, clicks, click-through rate, cost-per-result, conversions, and other reporting metrics
• Page and Instagram data: Page ID, name, profile picture, follower count, engagement metrics on ads we manage
• Instagram posts you publish from Maynut: the Instagram post ID and link, the caption and alt text you wrote, and which of your images were used
• Lead data from lead-form ads we run on your behalf — typically the name, email, phone number, and any custom fields you have configured in the lead form. This data belongs to you, our Client; we transmit it to your designated destination (CRM, email, webhook) and do not retain it for our own purposes
• Pixel and conversion data from the Meta Pixel installed on your website, used for measurement and audience optimization. We do not see the raw browsing behaviour of individual visitors to your site; we see aggregated and modeled conversion data from Meta

Publishing to Instagram

If you connect an Instagram business or creator account and choose to post from Maynut, we send the images you select from your Media Library, together with the caption and optional alt text you write, to Instagram to publish on your account. Posts are published only when you click Post; we never post automatically or on a schedule, and only to the Instagram account you connected.

We store the Instagram post ID, its link, the caption, and the images used, so you can see what was posted from Maynut. We do not read, edit, or delete any other content, comments, or messages on your Instagram account.

Meta Pixel on maynut.co

Our own website may use the Meta Pixel and Conversions API to measure the performance of advertising we run for our own marketing purposes. The Pixel sets cookies in your browser and transmits limited information — IP address, browser fingerprint, and pages viewed — to Meta. You can manage this through your browser's cookie controls or your Facebook ad preferences.

The Maynut platform and mobile app

Maynut operates a web dashboard at app.maynut.co and a mobile app for iPhone and Android (together, the "Platform"). Clients sign in to the Platform to manage their leads, conversations, campaigns, and settings. This section describes the information the Platform handles, which is in addition to the advertising services described above.

Your account

To use the Platform you create an account with your name, email address, and a password, which we store only as a salted cryptographic hash. You may enable two-factor authentication, in which case we store the secret needed to verify your codes and your recovery codes. We also record sign-in events, including the approximate time, IP address, and device type, so you can review and revoke active sessions.

Your contacts and their data

The core function of the Platform is to help you follow up with your leads. On your behalf we store the information you add, import from your CRM, or receive from a lead form, which typically includes a lead's name, phone number, email address, mailing address, lead source, and the stage of your relationship, together with the notes, tags, tasks, comments, and qualification details (such as budget range, buying timeline, and home preferences) recorded by you or determined by our AI from conversations.

We act as a processor for this information: it belongs to you, our Client, and we handle it only to provide the Platform to you. Unlike lead-form data that we merely route, contact records remain stored in the Platform until you delete them or close your account, because the Platform exists to keep that history available to you.

Text messages and phone calls

Where you enable texting and calling, Maynut provisions a phone number for your organization through our telephony provider, Twilio. We then process, and store in your account:

• The content, direction, timestamps, and delivery status of text messages sent to and received from your leads, including opt-out requests
• Call metadata such as the numbers involved, time, duration, and outcome
• Audio recordings of AI calls and their written transcripts, together with an AI-generated summary of what was discussed and any details the AI extracted, such as budget or timing

Call recording is subject to law that varies by jurisdiction and generally requires notice to, or the consent of, the people on the call. You are responsible for configuring your AI calling scripts and your use of the Platform so that recording and automated outreach comply with the laws that apply to you and to the people you contact, including Canada's anti-spam legislation (CASL), the U.S. Telephone Consumer Protection Act (TCPA), and applicable call-recording and do-not-call rules. Maynut provides the tools; you decide who is contacted and what is said.

Email

Where you enable email, we send messages to your contacts through our email provider, Postmark, from a domain you verify. We store the content of those messages and delivery events such as sends, opens, clicks, bounces, and unsubscribes.

Calendar

If you connect a Google or Microsoft calendar so the AI can book appointments, we connect through our scheduling provider, Cal.com, using that provider's official authorization flow. We read your availability and write the appointments that are booked. We do not read the contents of unrelated calendar events, and we never receive your calendar password.

CRM connections

If you connect a CRM — Follow Up Boss, Lofty, BoldTrail, or GoHighLevel — we exchange contact and activity data with that system on your instruction, using the API key or authorization you provide. What we send is limited to the contacts and activity generated in Maynut; what we receive is written into your Maynut account. Your use of the CRM remains governed by that provider's own privacy policy.

Photos and files

The mobile app asks for permission to access your photo library so you can add images to your ads and media library. We only receive the images you specifically choose; we never browse or upload your library. You can change or withdraw this permission at any time in your device settings.

Device and diagnostic information

When you use the Platform we collect technical information needed to operate and improve it: device type, operating system and app version, IP address, and crash and error reports through Sentry, together with product usage events through PostHog (for example, which screens are opened and which features are used). We use these to fix problems and improve the product, not to build advertising profiles of you, and we do not use third-party advertising trackers in the mobile app.

Deleting your account from the app

You can delete your Maynut account directly in the mobile app at Settings → Profile → Delete Account, or in the web dashboard under your profile. Deleting your account removes your personal profile, sessions, and credentials. Where you are the owner of an organization, you will be asked to delete the organization or transfer ownership first, because an organization's contacts, conversations, and campaigns belong to that organization rather than to you individually. Deleting an organization releases its phone number and deletes its contacts, conversations, recordings, transcripts, ads, and workflows. See Data deletion requests for the full process and the limited records we must keep by law.

AI texting, calling, and content

Maynut uses artificial intelligence to draft and send text messages, place and conduct phone calls, transcribe and summarize those calls, extract qualification details from conversations, and generate advertising copy and images. To do this we send the necessary content — such as the text of a conversation, a contact's name and qualification details, or a description of the ad you want — to our AI providers, currently Anthropic (language models) and Retell (voice calling and transcription).

AI output can be wrong. Messages, summaries, extracted details, and advertising copy generated by the Platform are suggestions produced by software, not professional advice, and you remain responsible for what is sent from your account and for the accuracy of anything you rely on. The Platform is designed to hand a conversation to you when a lead asks for a person, and you can pause the AI for any contact at any time.

How we use information

We use the information described above to:

• Provide, operate, and improve our advertising services for our Clients
• Build, launch, and manage Meta ad campaigns on behalf of Clients who have authorized us to do so
• Measure campaign performance, generate reports, and recommend optimizations
• Route leads from Client lead-generation campaigns to the destination the Client has specified (such as a CRM, email address, or webhook)
• Publish images and captions to a Client's connected Instagram business account when the Client chooses to post them
• Communicate with Clients and prospects, including responding to inquiries, sending invoices, and providing service updates
• Comply with our legal, regulatory, and contractual obligations
• Detect, prevent, and respond to fraud, abuse, security incidents, and policy violations
• Operate, secure, and improve maynut.co

We do not use personal information accessed through Meta APIs for any purpose unrelated to operating that Client's advertising. We do not share Meta-derived data with our other Clients. We do not use a Client's audience or lead data to target advertising for any other party.

Legal basis for processing

For Canadian residents, our processing is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws. We rely on consent, contractual necessity, and legitimate business interests as the basis for our processing.

For residents of the European Economic Area, the United Kingdom, and other jurisdictions where the GDPR or similar laws apply, we rely on the following legal bases:

• Consent — when you grant Meta permissions to our app, when you submit a contact form, when you opt in to marketing communications, and where consent is otherwise required
• Contractual necessity — to deliver the services agreed in our service contract with each Client
• Legitimate interests — to operate, secure, and improve our business, communicate with Clients, prevent fraud, and pursue commercial opportunities, in each case balanced against the privacy interests of the data subject
• Legal obligation — when processing is required to comply with applicable law, court order, or regulatory request

How we share information

We share personal information only in the limited circumstances set out below.

Service providers

We engage carefully selected third-party service providers to operate our business. Each is contractually bound to use the information only to provide services to Maynut and to protect it with reasonable security measures. These include:

• Meta Platforms, Inc. — the advertising platform on which we run our Clients' campaigns
• Cloud hosting and infrastructure providers — to host our application and store data securely
• Payment processors — to handle Client billing
• Email and communication providers — to send Client communications and operate our help desk
• Customer relationship management (CRM) and analytics tools — to manage our own pipeline and understand site usage
• Lead-routing tools — to deliver lead-form data to a Client's chosen destination, where the Client has set this up

With Clients

We share with each Client the data that pertains to their own advertising — campaign reports, ad performance, leads from their campaigns, and so on. We do not share one Client's data with another Client.

Legal and safety

We may disclose information if required by law, court order, subpoena, or regulatory request; to protect the rights, property, or safety of Maynut, our Clients, or others; or to detect or prevent fraud, security incidents, or violations of our Terms of Service.

Business transfers

If Maynut is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to standard confidentiality protections and the terms of this policy.

We do not sell your personal information.

Maynut does not sell personal information for monetary consideration, and does not engage in the categories of "sharing" of personal information for cross-context behavioural advertising as defined under U.S. state privacy laws such as the California Consumer Privacy Act, beyond the operation of the Meta Pixel on our own website (which you may disable as described above).

How long we keep it

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, to deliver our services, and to comply with legal, regulatory, accounting, or reporting obligations. Specific retention periods include:

Where data is stored solely for legal or compliance reasons, we restrict access to it and use it only for those purposes.

Security

We implement administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, and destruction. These include:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of sensitive data at rest, including all stored Meta access tokens
• Strict access controls based on the principle of least privilege; access logged and reviewed
• Multi-factor authentication on all internal systems handling personal information
• Regular security review of our infrastructure, dependencies, and access patterns
• Confidentiality and data protection obligations in contracts with all employees, contractors, and service providers
• Incident response procedures, including notification of affected individuals and regulators where required by law

No system is perfectly secure. If we become aware of a security incident affecting your personal information, we will notify you and the appropriate authorities as required by applicable law.

Your rights

Depending on your location, you may have some or all of the following rights regarding personal information that Maynut holds about you:

• Access — to request a copy of the personal information we hold about you
• Correction — to request that we correct inaccurate or incomplete information
• Deletion — to request that we delete your personal information, subject to legal retention obligations
• Restriction — to request that we restrict processing in certain circumstances
• Portability — to request a copy of your personal information in a structured, commonly used, machine-readable format
• Objection — to object to processing based on legitimate interests or for direct marketing
• Withdrawal of consent — to withdraw any consent you previously provided, without affecting the lawfulness of prior processing
• Complaint — to lodge a complaint with a supervisory authority, including the Office of the Privacy Commissioner of Canada or your local data protection authority

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days, or as required by applicable law. We may need to verify your identity before processing your request. There is no fee for a reasonable request, but we may decline manifestly unfounded or excessive requests.

For data we hold as a processor on a Client's behalf — for example, leads generated by a Client's ad campaign — we will direct your request to the relevant Client, who is responsible for responding as the controller of that information.

Data deletion requests

If you would like Maynut to delete personal information we hold about you, including data we have accessed through the Meta Platform, you may submit a request in any of the following ways:

• Delete your account in the mobile app at Settings → Profile → Delete Account, or from your profile in the web dashboard
• Email [email protected] with the subject line "Data Deletion Request"
• Visit maynut.co/data-deletion for instructions and our deletion request form
• If you are a Client, disconnect Maynut from your Facebook account at Settings → Business Integrations on Facebook; we will automatically delete the associated tokens and cached Marketing API data within 30 days

We will confirm receipt within 7 days and complete the deletion within 30 days, unless we are required to retain certain information by law (for example, billing records required for tax purposes). Where we cannot delete information, we will tell you why and how long we are required to retain it.

International transfers

Maynut is headquartered in Canada. Personal information we collect may be processed in Canada, the United States, or any other country where our service providers operate. When we transfer personal information out of your country of residence, we rely on lawful transfer mechanisms — including standard contractual clauses, adequacy decisions, and your consent where applicable — to ensure that your information continues to receive an appropriate level of protection.

Children

Our services are intended for licensed real estate professionals and the adult audiences of their advertising. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected information from a child, contact [email protected] and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If the changes are material, we will provide a more prominent notice — for example, by email to active Clients or by a banner on maynut.co — before the changes take effect. Your continued use of our services after the effective date of an updated policy constitutes acceptance of the updated terms.

Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of personal information, please contact us:

If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the data protection authority in your jurisdiction.