Protecting your Privacy, The Maybe* promise.

1. Introduction & Our Commitment

Maybe* is committed to protecting your privacy and ensuring that your personal data is secure, handled lawfully, and used transparently. We are a Data Controller for the purposes of data protection law.

This policy covers www.maybetech.com, the Maybe* platform, and the other websites we operate, including www.thebigaisecret.com. Where a site or programme involves processing this policy does not describe, we publish a separate notice for it, and that notice links back here. Where the two differ, the specific notice applies to that programme.

2. What Data We Collect

2.1 Data you give us

We may collect:

• Name, contact details, and communication preferences.

• Login credentials and account details.

• Documents, content, and metadata you upload or edit via our platform.

• IP address, browser type, device information, and activity logs when you use our website.

• Social media usernames if you engage with us on those platforms.

• Notes from our conversations with you, including feedback or complaints.

• Your answers, and the results produced from them, if you complete an assessment or diagnostic on one of our websites.

We do not intentionally collect special category data (e.g., health, ethnicity) unless you explicitly provide it. Payment card details stay with the payment processor.

2.2 Data we obtain from other sources

We also hold business contact information about professionals who have not contacted us, so that we can invite them to take part in our research or tell them about services relevant to their role. This information relates to you in your professional capacity, not your personal life.

The categories we hold are your name and job title, your business email address and sometimes a business telephone number, your employer’s name, sector, approximate size and location, and publicly available professional information such as a company website biography.

We obtain it from:

• Third-party business-to-business data providers, currently Apollo (ZenLeads, Inc., trading as Apollo.io), a registered data broker which provides its own notice to individuals whose data it holds.

• Email verification providers, currently MillionVerifier, who confirm only whether an address is deliverable.

• Publicly accessible sources, including company websites, Companies House, and professional networking sites.

• Referrals and introductions from clients, partners and colleagues, and from people who invite their colleagues to take part in our research.

We can tell you which of these your details came from, and you can ask us at any time. We do not obtain or hold special category data from these sources.

3. How We Use Your Data

We use your data to:

• Provide, maintain, and improve our services.

• Fulfil contractual obligations.

• Respond to your enquiries and support requests.

• Operate AI-driven productivity tools at your instruction.

• Communicate about service updates, security alerts, or surveys.

• Produce and send you the results of any assessment you complete, and include your answers in our published research as anonymised statistics.

• Invite professionals to take part in our research programmes, and share the findings with those who ask for them.

• Contact professionals about products and services relevant to their role, where we consider it reasonable and where they have not asked us to stop.

• Advertise our services and research on third party platforms, including social media, where you have agreed to advertising cookies or where you have given us your details directly.

• Comply with legal obligations.

We do not use your data for generalised AI training or sell it to third parties.

4. Legal Bases for Processing

We process your data based on:

• Your consent (e.g., signing up for marketing updates).

• Your consent, for advertising and analytics cookies, for taking part in an interview or assessment, and for receiving our research updates.

• Contractual necessity (e.g., delivering services you’ve requested).

• Legitimate interests. We rely on this to understand how our services are used, to keep our services secure, to contact professionals at organisations about research and services relevant to their role, and to include assessment answers in our published research once they have been anonymised. Before relying on legitimate interests for any of these, we carried out a legitimate interests assessment weighing our interest against the interests and reasonable expectations of the people affected. You may request a summary at any time by emailing dpo@maybetech.com.

• Compliance with legal obligations.

This service is not intended for children under 16, and we do not knowingly collect their data.

5. Direct marketing and your right to say no  

If we contact you about our research or our services, you can tell us to stop at any time and we will. You do not need to give a reason, and we will not ask for one. This right is absolute: unlike other objections, we do not weigh it against our own interests.

To stop hearing from us, use the unsubscribe link in any message, reply with the word stop, or email dpo@maybetech.com.

When you opt out, we add your details to a suppression list. This is a minimal record, your contact details and the date you opted out, and we keep it indefinitely. We do this so that we do not contact you again by mistake, including if your details reappear in a future data update from one of our providers. We use it for nothing else. If you would prefer us to erase your details entirely rather than suppress them, tell us and we will, though we will then have no way of recognising your details if we receive them again in future.

Opting out of messages also removes you from any advertising audience we have created from our own contact lists. See section 10.

6. Our research programmes  

Maybe* runs research programmes in which we interview business leaders and run assessments about how technology is used in their organisations. The Big AI Secret, published at thebigaisecret.com, is one of these. Maybe Solutions Limited is the controller for that programme.

If you take part, additional information applies to you, covering how we record and transcribe interviews, what anonymisation means in practice, what your colleagues can and cannot see if you were invited by someone at your organisation, and how to withdraw. It is set out at thebigaisecret.com/privacy.

7. AI & Machine Learning

Maybe* provides AI-driven features to help you work more efficiently. These:

• Operate only at your explicit request.

• Process your data solely to perform the requested task.

• Never train, improve, or inform generalised AI or machine learning models.

• Do not make fully automated decisions that have legal or significant effects on you.
  

The AI tools on Maybe* don’t make binding or serious decisions about you - they just assist you, and you remain in control. If you ever wish to contest an AI-generated outcome or request a human review, please contact us.

9. Cookies, tracking and consent  

We use cookies and similar technologies on our websites. Cookies that are strictly necessary to make a site work are set automatically. All others, including analytics, advertising and tag management, are set only after you agree to them.

When you first visit, you will be asked to accept or reject non-essential cookies. Rejecting is as easy as accepting. You can change your choice at any time through the cookie settings link in the footer of every page.

Where advertising cookies are used, we and the advertising platform act as joint controllers for the collection of that information and its transmission to the platform. See section 10.

10. Advertising and social media  

We advertise our services and our research on social media platforms, including Facebook and Instagram, which are operated by Meta.

We show adverts to people who have visited our websites, using cookies and similar technologies that are set only if you agree to them. We also create audiences from the contact details of people who have given them to us directly, for example by signing up for an assessment or a report, so that platforms can show them relevant adverts and find people with similar profiles. Contact details are hashed, which converts them into an irreversible code, before they reach the platform.

We do not upload contact details obtained from business data providers to any advertising platform. If we obtained your details from Apollo or a similar source and you have never engaged with us, those details stay in our email system and are never disclosed to Meta or any comparable platform. We consider matching business details bought from a broker against someone’s personal social media account a step too far, and we do not take it.

We do not use special category data for advertising, and we do not build advertising audiences from anything you have told us in an interview or an assessment.

For the collection of information through advertising tools on our websites and its transmission to Meta, Maybe Solutions Limited and Meta Platforms Ireland Limited are joint controllers. We are responsible for obtaining your consent and for providing this information. Meta is responsible for what it does with the information afterwards, as described in its own privacy policy and controller addendum. You can exercise your rights against either of us.

To stop this, use the cookie settings link in the footer, control advertising in your own platform account settings, or email dpo@maybetech.com to be removed from our audiences.

11. Google Workspace Data

If you link your Google account:

• We access only the minimum information required.

• We comply with Google’s Limited Use policy.

• We do not use your Google data to train or improve any models.

• We do not transfer Google data to third-party AI services.
  

12. Cookies & Profiling

We use cookies and similar technologies to improve your experience, analyse usage, and show relevant content.
We may profile your activity - but only in minimally intrusive ways, and never for generalised AI training.

13. Subprocessors

That list covers the providers involved in delivering the Maybe* platform. We also use providers to run our own business, including our marketing and research activity: View our Subprocessor List

We carry out due diligence on each of these and have data processing terms in place with them.

14. Your Rights

You have the right to:

• Access your data.

• Rectify incorrect or incomplete data.

• Request erasure (“right to be forgotten”).

• Restrict or object to processing.

• Port your data to another provider.

• Object to automated processing.

• Lodge a complaint with the ICO (UK) or your local regulator.

To exercise any of these, contact our Data Protection Officer at dpo@maybetech.com. Where we contact you for direct marketing, including invitations to take part in our research, your right to object is unconditional. If you object, we stop. We do not weigh it against our own interests and we act without delay. We respond to all requests within one month. There is no charge.

15. Data Security

We use appropriate organisational and technical measures to protect your data from loss, misuse, or unauthorised acces

16. Data Retention

We keep your data only as long as necessary for the purposes for which we collected it. At the end of the retention period, we delete, anonymise, or securely store it. We keep personal data only as long as we need it.

17. International data transfers  

Some of our providers are based outside the UK, principally in the United States. Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement, and we carry out a transfer risk assessment before the transfer begins.

All processing of client personal data within the Maybe* platform remains restricted to the UK and EU. The providers listed in section 11 support our own marketing and research activity and do not have access to client data held in the platform.

18. How to Contact Us & Complaints

If you have questions, concerns, or wish to exercise your rights:
 📧 Email: dpo@maybetech.com
 📞 Phone: 0800 0614 214
 📮 Mail: Data Protection Officer, 11 Brindley Place, Brunswick Square, Birmingham B1 2LP

MAYBE SOLUTIONS LTD, Company number 09195496

You can also contact the UK’s Information Commissioner’s Office (ICO):
 📞 0303 123 1113
 🌐 www.ico.org.uk/concerns

We would rather you came to us first, but you do not have to.

19. Our details and representatives  

Maybe Solutions Limited, registered in England and Wales, company number 09195496. Registered office 11 Brindley Place, Brunswick Square, Birmingham B1 2LP. Vat number: GB207594204

20. Changes to this policy  

We may update this Privacy Policy occasionally. The last updated date above reflects the latest version.

August 2026 update: added detail on business contact data obtained from third party sources and the lawful basis for it, added website assessments, added an unconditional right to object to direct marketing with an explanation of our suppression list, added a section on advertising and social media, replaced general retention language with specific periods, separated business operations providers from platform subprocessors, and added cookie consent and company details. Sections have been renumbered.

July 2025 update: New “Privacy at a Glance” summary added to make key points easier to understand.

• AI & Machine Learning section added & clarified, explicitly explaining:

  • AI features operate only when requested by you.

  • Your data is never used to train or improve generalised AI models.

  • AI outputs are not automated decisions with legal or significant effects.

  • You have the right to contest AI outputs or request human review.

•  Google Workspace Data section improved, clearly stating our compliance with Google’s Limited Use Policy and adding examples of what we access and why.

• Subprocessors disclosure improved, now explicitly linking to a live, up-to-date list of our subprocessors.

• User Rights consolidated & clarified, listing all rights under GDPR/UK GDPR (access, rectification, erasure, objection, portability, etc.) in plain language.

• Cookies & Profiling section added, clarifying how we use cookies and reassuring users this is minimally intrusive and not used for AI training.

• Data Retention, Security, and International Transfers made clearer and easier to understand, with dedicated sections.

•  Improved structure & readability:

  • Shorter paragraphs & simpler language.

  • Clear, numbered sections with meaningful headings