MAX is an AI assistant that businesses "hire" to talk with their leads and customers (starting with WhatsApp), book appointments, keep a simple CRM, send follow-ups and report back to the owner. MAX is operated by Doc Lock LLC ("we", "us"), 7121 Regal Ln, Knoxville, TN 37918, USA.
This policy explains, in plain language, what data we handle, why, and the choices you have. Questions: hello@maxatwork.com or +1 865-204-8121.
1. Two kinds of data, two roles
- Business owners and their team ("you"): we decide how your account data is used, so for that data we are responsible (the "controller" or database owner).
- Your business's customers: when your customers message your business, MAX processes those messages on your behalf and under your instructions. For that data your business is the controller and we are its processor (service provider).
If you are a customer of a business that uses MAX, the business's own privacy notice applies to you, and the business is the first place to go with requests. We will help the business answer them — see Data deletion.
2. What we collect
- Account data: your name, email address, phone number, business name, language and settings, and sign-in details (passwords are handled by our authentication provider and stored hashed; or you sign in with Google or Apple).
- Business content you give MAX: your website address and what we read from it, services, prices, opening hours, FAQs, rules, the assistant's personality and permissions, and voice recordings you choose to make during setup.
- Customer conversation data (processed for your business): messages, photos and files exchanged on WhatsApp, the customer's phone number and profile name, details they share, appointments, follow-ups and CRM notes.
- Technical data: logs, IP address, device and browser type, and error reports, used to run and secure the service.
- Billing data: when paid plans launch, payments will be handled by a third-party payment processor. We will not store full card numbers.
3. How we use data
- To provide the service: answer your customers, book appointments, send follow-ups you allowed, and send you reports and approval requests.
- To set up and improve your assistant from the content you provide.
- To keep the service secure, prevent spam and abuse, and fix problems.
- To give you support and tell you about important changes to the service.
- To meet legal obligations.
We do not sell personal data, and we do not use your customers' data for advertising.
4. AI processing
To write replies, understand messages, extract details and transcribe voice, MAX sends the relevant conversation and business content to third-party AI model providers (for example, through OpenRouter, and OpenAI). They process it to return a result to us.
We don't use your or your customers' data to train AI models, and we configure our AI providers not to use it for training where they offer that option.
AI can make mistakes. You decide what MAX may do on its own and what needs your approval; when MAX does not know an answer, it is designed to ask you rather than make one up.
5. WhatsApp and Meta
Messages are sent and received through the WhatsApp Business Platform operated by Meta, via a Meta Business Solution Provider. Meta and that provider process message data under their own terms and privacy policies.
7. How long we keep data
We keep account data, business content and conversation data for as long as the business account is active, or until the business deletes it. After an account is closed we delete or anonymize its data within 30 days, except records we must keep by law (for example, billing and tax records). Backups are overwritten on a rolling basis.
8. Your rights and choices
You can ask to see, correct, export or delete your personal data. Email hello@maxatwork.com or follow Data deletion. We will verify the request and answer within 30 days.
Israel: under the Protection of Privacy Law, 5741-1981, as amended (including Amendment 13), you have the right to review personal data held about you and to ask for it to be corrected or deleted.
United States: depending on your state (for example, California, Virginia, Colorado or Connecticut), you may have rights to know, access, correct, delete and port your data, to opt out of the sale or sharing of personal data or targeted advertising (we do none of these), and to appeal our decision. We will not discriminate against you for using these rights. An authorized agent may act for you where the law allows.
Customers of a business that uses MAX should contact that business first; we will support it.
9. Security
We protect data with measures such as encryption in transit, access controls and least-privilege access for our team, separation of each business's data, and monitoring. No system is perfectly secure; if a security incident affects your data, we will notify you and the authorities as the law requires.
11. Children
MAX is a service for businesses and is not directed at children. Account holders must be at least 18. If you believe a child has given us personal data directly, contact us and we will delete it.
12. International transfers
We operate from the United States, and our service providers may process data in the United States, the European Union and other countries. When we transfer personal data from Israel, we do so as permitted by the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001, and with contractual safeguards.
13. Changes to this policy
We may update this policy. We will change the "Last updated" date, and tell account holders about important changes before they take effect.
14. Contact
Doc Lock LLC · 7121 Regal Ln, Knoxville, TN 37918, USA · +1 865-204-8121 · hello@maxatwork.com