Privacy policy
Your data, plainly
Last updated 14 October 2026
- We collect what we need to run MavroPost for you: your email, your website, your brand and posts, and, if you connect it, your Instagram account.
- We never sell your data, and we never use it for advertising.
- Analytics on this site only run if you say yes.
- Nothing is posted to your Instagram unless you tap approve.
- Email [email protected] and we'll delete your data.
Who we are
MavroPost (“we”, “us”) is an AI marketing manager for small businesses, run from the United Kingdom. Mavro is the assistant inside it. We are the controller of the personal data described here. For anything about your data, email [email protected].
What we collect, and why
If you join the waitlist
- Your email address and website, to tell you when your place opens and to have your first posts ready.
- Where you came from: the campaign tag in the link you followed, or the site that sent you, so we know which places bring people in.
Our reason (lawful basis): you asked us to (consent). Ask and we'll remove you.
If you have an account
- Your email address, to sign you in. There are no passwords: we email you a one-time link.
- Sign-in records: when you last signed in and the browser you used, so you can stay signed in and we can spot misuse. We only keep scrambled (hashed) versions of sign-in links and sessions, never the links themselves.
- Your website and Instagram handle, if you give them when you sign up.
- Your brand: what Mavro reads from your public website (text, colours, fonts, logo and a screenshot of your home page), the brand kit made from it, and anything you add, such as example posts or notes.
- Your posts: the drafts, captions and images Mavro makes, your edits, and what you approve or reject and why. Your decisions are how Mavro learns your taste.
Our reason: to provide the service you signed up for (contract).
If you connect Instagram
- An access token from Meta, so we can publish the posts you approve.
- Your account and post insights (reach, likes, comments, saves, shares, profile visits, follows), so Mavro can score what works and shape next week's posts.
We only use the permissions you grant, and only to publish what you approved and to read how it did. Our reason: contract. You can disconnect at any time in Settings, or in Instagram under Settings → Website permissions → Apps and websites.
People who visit a link-in-bio page
Brands using MavroPost have a page at go.mavropost.com. When someone opens it or taps a post, we count it, so the brand can see which posts bring people to their site. We set no cookies there and don't store IP addresses. We keep a scrambled code made from the visitor's address and browser that changes every day, so one person counts once a day and can't be followed from one day to the next. We also note the website that sent them, such as instagram.com. Our reason: legitimate interests (giving brands simple, privacy-friendly counts).
Visiting this website
If you accept analytics cookies, Google Analytics records which pages you visit, roughly where you are and what device you use, so we can see how people find MavroPost. If you don't accept, it never loads. Our reason: consent. See the cookie policy.
If you email us
We keep your message and our reply, so we can help you. Our reason: legitimate interests.
How Mavro uses AI
Mavro uses AI models to read your website, draft your brand kit, and write, picture and check your posts. To do that, your website's content, your brand kit and your drafts are sent to the AI providers below. They process it to give us an answer, under their terms for business customers. We don't send them your email address or your Instagram login. Nothing Mavro drafts is published until you approve it.
Who helps us run MavroPost
These companies process data for us, only for the purposes above:
| Who | What for | Where |
|---|---|---|
| Hetzner | Our servers: the app, the database, images | Germany |
| Cloudflare | This website, the waitlist, security, and forwarding email sent to us | Global |
| Anthropic | AI: reading sites, writing and checking posts | USA |
| Google (Gemini) | AI: images and some writing | USA |
| Resend | Sending sign-in and account emails | Ireland (EU) |
| Google (Gmail) | Our inbox for emails you send us | Global |
| Google Analytics | Site analytics, only if you accept | Global |
| Meta (Instagram) | Publishing your approved posts and reading their insights, only if you connect Instagram | Global |
Stock photos come from Unsplash. We only send them a search term, never anything about you.
Where data goes outside the UK, it's protected by the UK's adequacy rules or by approved contract terms (the UK Addendum to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement).
How long we keep it
- Waitlist: until your place opens, or until you ask us to remove you.
- Your account, brand and posts: while you have an account. When you close it, we delete them within 30 days. Copies in backups go when those backups expire, within a further 30 days.
- Sign-in links: they stop working after 20 minutes (7 days for an invite) and are deleted within a day of expiring or being used.
- Sessions: 30 days after you last used MavroPost.
- Instagram access: until you disconnect it or close your account. Insights are kept with your posts.
- Link-in-bio counts: while the brand's account exists.
- Analytics: Google Analytics deletes visit-level data after 2 months, and anything tied to a returning visitor after 14 months.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of your data;
- correct it;
- delete it;
- stop or limit how we use it, or object to it;
- send it to you, or to someone else, in a usable format.
Where we rely on your consent, you can withdraw it at any time. Email [email protected] and we'll reply within a month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd like the chance to put it right first.
Deleting your data
To delete your account and everything in it (your brand, posts, images, insights, and your Instagram connection):
- email [email protected] from the address you sign in with, with the subject “Delete my data”;
- we'll confirm, delete it within 30 days, and email you when it's done.
To stop us using your Instagram account straight away, disconnect it in MavroPost's Settings, or remove MavroPost in Instagram under Settings → Website permissions → Apps and websites. Either way, our access stops working at once; email us if you'd also like the data we got from Instagram deleted.
Keeping it safe
Connections to MavroPost are encrypted (HTTPS). Sign-in uses one-time links instead of passwords. We keep only scrambled versions of links and sessions. Each person can see only their own brands. Access to our servers is limited to us.
Children
MavroPost is for businesses and isn't meant for anyone under 18.
Changes
If we change this policy, we'll update the date at the top. If a change matters, we'll email account holders before it takes effect.