Last updated: 18 October 2026
1. Who we are
We are the controller of your personal data under the EU General Data Protection Regulation (GDPR). We haven't appointed a data protection officer because we aren't required to. If you have any privacy questions, just email us.
2. Hosting
joinmazi.ai and our application system run on our own server with OVHcloud (OVH SAS, 2 rue Kellermann, 59100 Roubaix, France) in a data center in Frankfurt, Germany. When you visit the site, the server handles technical data such as your IP address, the time of your visit, the page you requested and your browser type so it can deliver the site and protect it from abuse. Our legal basis is our legitimate interest in running a secure, stable service (Art. 6(1)(f) GDPR). We don't store this data permanently.
We serve fonts and every other part of the site from our own server. Nothing is sent to third parties unless you consent.
3. Your application
What we collect
- Step 1: your first name, email address and your consent, along with the time, IP address and browser type as a record of that consent
- Step 2: the videos you upload or link to, the styles, AI video models and platforms you select, and anything you choose to tell us in the free-text field
- where your visit came from, such as campaign parameters in an ad link
Why and on what basis
We use this information to review your application, get back to you and set up potential work with brands. Our legal bases are your consent (Art. 6(1)(a) GDPR) and taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR). You can withdraw your consent at any time by emailing us. This won't affect anything we did before you withdrew it.
Where it's stored and for how long
Everything you send us, including your videos, is stored on our server in Germany and is never publicly accessible. Only the mazi team can see it. We only share your videos with a brand if you agree, for example as part of a brief. If we don't end up working together, we delete your application no later than six months after we get back to you. If we do work together, we keep your data for as long as the collaboration runs and afterward only as long as the law requires.
4. Cookies and consent
On your first visit, we ask whether you allow analytics and marketing tools. We save your choice in your browser's local storage for 180 days (Art. 6(1)(c) GDPR together with Section 25(2) of the German TDDDG). You can change it anytime via "Cookie settings" at the bottom of the homepage.
5. Analytics with PostHog
Only if you allow analytics do we use PostHog, a service of PostHog, Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA. PostHog shows us how people use the site: page views, clicks, scroll depth, heatmaps, load times, technical errors and session recordings. Passwords and email fields are masked in recordings. When you submit the application form, we link this usage data to your email address so we can see where applicants get stuck. The data passes through our own domain to PostHog and is processed in the US under the EU Standard Contractual Clauses. PostHog doesn't store IP addresses for us, and we delete recordings after 90 days at the latest.
Our legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without it, PostHog never loads.
6. Marketing with the Meta Pixel
Only if you allow marketing do we use the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. It tells us which Instagram and Facebook ads lead to visits and applications. Meta may link this data to your account and may also process it in the US under the EU-U.S. Data Privacy Framework. We and Meta are joint controllers for collecting and transmitting this data (Art. 26 GDPR). You can read the agreement at facebook.com/legal/controller_addendum. Our legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
7. Email and booking a call
If you email us, we process your message to reply (Art. 6(1)(b) or (f) GDPR). We use Google Workspace from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
If you book a call at joinmazi.ai/call, we store your name, email address, the time you picked and, if you add one, your topic. We create the event in our Google Calendar with a Google Meet link, and Google emails you the invite (Google Workspace, provider as above). To show open times, we only check busy times in our own calendars; your data isn't shared with any other service. The legal basis is setting up the call you asked for (Art. 6(1)(b) GDPR). We delete booking data no later than 6 months after the call unless we end up working together.
8. Your rights
You have the right to access, correct and delete your data, to restrict how we process it, to receive it in a portable format, and to object to processing based on our legitimate interests. You can withdraw any consent at any time. Just email lars@hc-cy.com.
You can also file a complaint with a data protection authority, such as our lead authority, the Commissioner for Personal Data Protection in Nicosia, Cyprus, or the authority where you live.
9. What you need to provide
We need your name, email address and at least two videos to review your application. Everything else is optional. We don't make automated decisions: a real person looks at every application.
10. mazi for brands: connecting your Meta ad account
This section applies to companies ("brands") that use the mazi platform to run ads with creator videos. It describes the data we receive when a brand connects its Meta (Facebook and Instagram) assets to mazi through our Meta app "mazi" using Facebook Login for Business.
What we receive from Meta
- the name and Facebook user ID of the person who connects the account, and an access token that lets mazi act for the brand
- the business assets the brand selects: ad accounts, Facebook Pages, Instagram accounts and pixels or datasets, with their IDs and names
- campaigns, ad sets, ads and creatives that mazi creates in the connected ad account
- performance data for those ads, such as spend, impressions, clicks, video views, conversions and conversion value
- a list of the videos and ads in the connected ad account, which we use only to check whether mazi creator videos are being used outside the agreed campaigns
What we receive from the brand's shop
If a brand also connects its online shop (for example Shopify or WooCommerce), we receive order data needed to attribute sales to individual mazi ads: order ID, order date, amounts, discounts, refunds and the tracking parameters of the visit. We don't need and don't request end customers' names or addresses. For this data we act as a processor on behalf of the brand under a data processing agreement (Art. 28 GDPR).
Why we use it and on what basis
We use this data to create and manage the brand's mazi campaigns, measure their results, calculate creator payouts, invoice the brand and enforce the content license agreed in our Terms. The legal basis is the contract with the brand (Art. 6(1)(b) GDPR) and, for the data of the person connecting the account, our legitimate interest in providing the service to their company (Art. 6(1)(f) GDPR).
How we handle Meta data
- We use each brand's Meta data only to run and measure that brand's campaigns. We keep every brand's data separate.
- We don't sell Meta data, don't share it with other brands and don't use it to build profiles of people.
- Creators don't see a brand's raw Meta advertising data. They see their own earnings and the results of their own videos to the extent the brand has agreed to this.
- Access tokens are stored encrypted on our server in Germany (OVHcloud, Frankfurt). Only the mazi team has access.
How long we keep it
We keep the data while the brand's account is connected and for up to 90 days after it is disconnected, so that pending payouts and invoices can be settled. Invoices and payout records are kept as long as tax and commercial law requires. After that, we delete the data.
11. How to delete your data
You can ask us to delete the data we hold about you or your company at any time. There are two ways:
- Remove the app: In Facebook, go to Settings & privacy → Settings → Business integrations (or, for a business portfolio, Business settings → Integrations → Connected apps) and remove "mazi". Meta then notifies us automatically, and we delete the data we received through the app within 30 days.
- Email us: Send an email with the subject "Data deletion" to lars@hc-cy.com and tell us which account or business it concerns. We confirm your request and complete the deletion within 30 days.
We only keep data that we are legally required to retain, such as invoices, and we tell you if that applies. Creators can delete their application data the same way by emailing us.