Mavlow

Legal

Privacy Policy

Last updated: September 23, 2026

Mavlow (mavlow.com) is a multi-tenant content workspace operated by Mavlow LLC. Teams draft, review, schedule, and publish social posts and related media for their organizations. We do not sell personal data.

1. Who this covers

This policy applies to the Mavlow web application at mavlow.com and to the developer integrations we use to connect third-party platforms (including Instagram via Meta, X, and TikTok) on behalf of an organization you belong to. By using Mavlow or connecting a platform account, you agree to this policy.

2. Data we collect

  • Account: work email and authentication session data (magic-link sign-in).
  • Organization: membership, roles, brand settings, prompts, and content you create (captions, hashtags, drafts, media uploads, review notes, schedules).
  • Billing: subscription status and Stripe customer / subscription identifiers. Card details are handled by Stripe; we do not store full card numbers.
  • Connected platforms: OAuth tokens and account identifiers needed to sync or publish (stored server-side; not exposed in the browser). For Instagram we request only the scopes required to identify the connected account, publish content you approve, and manage comments when that feature is used.
  • Connected AI: when you authorize ChatGPT, Claude, or another compatible AI host to connect to your Mavlow workspace, we store which AI connection you authorized, which capabilities you granted, and content-free usage logs for that connection (see section 5).
  • Usage: operational logs required to run the service (errors, publish status, security events).

3. How we use data

We use data only to operate Mavlow for your organization, including to:

  • Authenticate users and enforce organization access.
  • Generate and store drafts, media, and review workflows.
  • Connect, sync, and publish to platforms you authorize.
  • Provide Connected AI features when you authorize ChatGPT, Claude, or another compatible host (see section 5).
  • Process subscription payments and manage billing status.
  • Send transactional email (invites, magic links, teammate mentions) when configured.

We do not use Instagram or other platform data to build unrelated advertising profiles, and we do not sell that data to third parties.

4. Instagram and Meta

When an organization connects Instagram through Mavlow, Meta provides account and publishing-related data under Meta's terms and the permissions the user grants. That data is used only to provide the connected features in Mavlow (for example showing the connected account, publishing approved posts, and related sync). Organization admins can disconnect Instagram at any time under Integrations, which clears stored Instagram tokens for that organization.

5. Connected AI (ChatGPT and Claude)

You may connect ChatGPT, Claude, or another standards-compatible AI host to your Mavlow workspace (Connected AI). Connecting is optional and requires you to sign in and consent. Learn more at mavlow.com/send-to-mavlow (Send to Mavlow — ChatGPT and Claude).

When connected, the AI host may request, and Mavlow may return, data from the workspace you authorized, limited to what you granted. Today that typically includes:

  • Workspace name and website.
  • Connected channel names (for example Instagram, X, TikTok).
  • Brand voice, business facts, content preferences, and related settings you saved in Mavlow.
  • Recent published posts and upcoming calendar items (bounded).
  • Drafts you have already saved in Mavlow.

When you ask the connected AI to save content to Mavlow, we store the draft (caption and related fields) in your workspace the same way we store drafts created in the Mavlow app. When ChatGPT provides a downloadable image or video with that send, we copy the file into your workspace media library and associate it with the draft — the same storage path as uploads and Canva imports. Claude and other caption-only hosts do not send file bytes today; you attach media in Mavlow. Connected AI does not publish or schedule on your behalf. We also record content-free usage logs for Connected AI tool calls (which user, which AI client, which tool, when, whether it succeeded, and aggregate media transfer outcomes). Those logs do not include captions, brand text, file URLs, or OAuth tokens, and are retained only as long as needed for security and operations (then cleaned up automatically).

Connected AI does not publish or schedule posts on your behalf in the current version. You still approve, schedule, and publish in Mavlow.

You can disconnect a Connected AI authorization at any time under Integrations → Send to Mavlow. Disconnecting stops new access from that AI host. Drafts already saved to your workspace remain until you delete them.

6. Subprocessors

  • Supabase: database, auth, storage, and edge functions.
  • Netlify: static site hosting.
  • Stripe: subscription checkout and billing.
  • OpenAI: optional AI draft / image generation when an organization enables those features, and (when you connect ChatGPT as Connected AI) the ChatGPT host that calls Mavlow on your behalf.
  • Anthropic: when you connect Claude as Connected AI, the Claude host that calls Mavlow on your behalf.
  • Resend: transactional email when configured.
  • Meta, X, TikTok: only when an org connects that platform; data shared is limited to what those APIs require for the authorized actions.

7. Retention and deletion

Content and connection data are retained while the organization uses Mavlow. Organization admins can disconnect platforms (which clears stored tokens for that org). Connected AI authorizations can be revoked under Integrations → Send to Mavlow.

Data deletion requests: to delete your user account, organization workspace data, or connected-platform tokens, email hello@mavlow.com from the address on the account (or have an organization admin make the request). Include the email used to sign in and, if relevant, the organization name. We will confirm and delete or de-identify the requested data within a reasonable period (typically within 30 days), except where we must retain limited records for security, fraud prevention, or legal obligations.

You can also disconnect Instagram (or other platforms) under Integrations at any time; that removes stored OAuth tokens for that organization without deleting your whole account.

8. Your choices

You can disconnect a platform or a Connected AI authorization at any time under Integrations. You can stop using Mavlow and request deletion as above. Do not upload content you are not authorized to publish.

9. Measurement and advertising

When enabled on production, Mavlow uses Google Analytics 4 (GA4) to understand how visitors use public pages (for example page views and conversion events such as workspace signup, paid subscribe, and setup completion). Event data is associated with a Measurement ID configured for mavlow.com; we do not send passwords or full payment card numbers to GA4.

When an OpenAI Ads measurement pixel is enabled, the same conversion event names may also be sent to OpenAI's ads measurement SDK for campaign attribution. The pixel is initialized with a pixel ID only — we do not attach a user object or hashed personal identifiers to the pixel. You can limit tracking via browser controls and industry-standard opt-outs where available.

These tools are used to operate and improve Mavlow marketing and product funnels. They are not used to sell personal data.

10. Contact

Mavlow is operated by Mavlow LLC. Questions about this policy or privacy requests: hello@mavlow.com.

Website: https://mavlow.com