Privacy Policy

Version 6.0 — last updated and effective 20 October 2026

1. Who we are and what this policy covers

This Privacy Policy explains how Maestra handles personal information about visitors of our websites at maestra.io and its subdomains (the "Website"), users of the Maestra web application (the "Application"), and the people we deal with as prospects, customers, partners and suppliers. The Maestra Platform is the marketing software we provide to our customers; the Application is its user interface.

Two companies are responsible, depending on where you are. For visitors and contacts in the European Economic Area and the United Kingdom: Maestra B.V., Haarlemmerweg 331 A, 1051 LH Amsterdam, the Netherlands (Chamber of Commerce no. 70240833). For everyone else: Maestra.io LLC, 1167 Massachusetts Avenue, Arlington, MA 02476, USA. "We" means the company responsible for you. Company details: Maestra.io LLC, Maestra B.V.. Our Data Protection Contact for every question and request under this policy is dpo@maestra.io.

This policy does not cover the personal information our customers process through the Maestra Platform about their own customers ("End Customer Data"); section 10 explains how that is handled and whom to ask.

2. The information we collect

Information you give us — when you request a demo, contact us, sign up for an account, use the Application, attend a call or event, or buy our services: your name, business e-mail address, phone number, company and role, the content of our communications, recordings and transcripts of calls with us (we tell you at the start of a call when it is recorded), and billing details.

Information your browser and device send — when you use the Website or the Application: IP address and the approximate location derived from it, device and browser characteristics, the pages you view and the actions you take, and the page you came from; on the Website, also the identifiers stored by the technologies described in our Cookie Policy. Where we ask for consent, the non-essential technologies run only after you accept.

Information from other sources — business contact databases and data-enrichment providers (company, role, business contact details); our visitor-identification provider, which for visitors in the United States matches a visit to a business contact (name, company, business e-mail address, professional profile); publicly available professional profiles; and our customers, when they create Application accounts for their staff.

In California's statutory terms these are identifiers, commercial information, internet or other electronic network activity information, approximate geolocation, audio information (call recordings), professional information, and inferences about your interest in our services. The only sensitive personal information we collect is Application log-in credentials and payment details, used solely to provide, secure and bill for the Application; we do not use any information to infer characteristics of that kind.

3. Why we use it, on what legal basis, and for how long

Where the table says "legitimate interest", the interest is the one named in the row and you may object (section 11); you may ask us for the balancing assessment. Where it says "consent", you may withdraw at any time. When a period ends we delete the information or make it anonymous, unless the law requires us to keep it longer or we need it for a pending claim. You are not obliged to give us any information; without your contact details we cannot answer a request or provide the Application to you.

4. Cookies, trackers and advertising

Our Cookie Policy names every technology on maestra.io, who provides it, what it does and how long its cookies live, and explains where we ask for consent first and how to refuse or withdraw.

We advertise our services on other websites and apps. To measure those ads and to show them to people like our visitors, we let advertising providers set cookies and receive identifiers and online activity from the Website; they may collect information about your online activities over time and across different websites. In the United States we also let a visitor-identification provider match visits to business contacts. Under US state privacy laws, the first is "sharing" for cross-context behavioral advertising and "targeted advertising", and we treat the second as a "sale" of personal information. We receive no money for either. We also share hashed business contact details, such as business e-mail addresses, with advertising providers — currently LinkedIn, and Meta or Google where we use them for this — so they can match those contacts and show our ads to them and to similar audiences; like the above, this is "sharing" for targeted advertising under US state privacy laws, and we receive no money for it. When you submit a form on the Website, the details you type reach us — our CRM — and, for demo bookings, our scheduling provider; they are not passed to advertising providers at that point. You can opt out at any time (section 11).

We honor the Global Privacy Control signal everywhere as a request to opt out of sale, sharing and targeted advertising for the browser that sends it; it stops the sharing that runs through the technologies on that browser. The business-contact sharing described above happens outside the browser — to opt out of it, e-mail us (section 11). To cover another browser or device, enable the signal there. We do not respond to "Do Not Track" signals.

5. Who receives your information

• Service providers that work on our instructions: hosting and infrastructure, CRM and e-mail delivery, communication and collaboration tools, call recording and transcription, scheduling, prospect research and outreach, customer support, payment and accounting, e-signature, AI tools we use to analyze and draft our own work (your information is not used to train models), and security services.
• Advertising providers and our visitor-identification provider, which process your information for their own purposes as well; they are named in the Cookie Policy.
• Our group companies — Maestra B.V., Maestra.io LLC and our parent company Maestra Group, Inc. — which process your information on behalf of the company responsible for you, under an intra-group agreement.
• Professional advisers, authorities and courts where the law requires or permits it, and a buyer or successor in a merger, financing or sale of our business.

The named recipients are listed in section 13, which we update as our providers change. The sub-processors for End Customer Data are listed at maestra.io/legal/subprocessors.

6. International transfers

Our systems and most of our providers are in the United States. If you are in the EEA or the UK, your information is transferred there and to other countries outside the EEA and the UK. We rely on the European Commission's and the UK's adequacy decisions where they apply, including the EU–US Data Privacy Framework and its UK Extension for providers certified under it, and otherwise on the Standard Contractual Clauses and the UK Addendum signed with the recipient, including our own US company. You can obtain a copy of the safeguards from dpo@maestra.io.

7. Security

We protect personal information with technical and organizational measures appropriate to the risk, including access on a need-to-know basis, encryption, logging, and a security program audited every year under SOC 2. No transmission over the internet is completely secure; please contact us at once if you believe your information has been compromised.

8. Children

The Website and the Application are for businesses and their staff. We do not knowingly collect personal information from anyone under 18, and we do not sell or share the personal information of anyone we know or should know to be under 18, or use it for targeted advertising.

9. Automated decisions

We do not make decisions about you by automated means that have legal or similarly significant effects, and we do not profile you in that way.

10. Information we process for our customers

Our customers use the Maestra Platform to process personal information about their own customers (End Customer Data). For that information the customer is the business or controller and we are its service provider or processor: we process End Customer Data only on the customer's documented instructions and only as necessary to perform our services, we do not sell or share it, we do not use it to train artificial-intelligence or machine-learning models, and we do not retain, use or disclose it outside our relationship with the customer. Anonymized and other de-identified or aggregated data are handled as our customer agreements provide: we may retain and use them, we keep them in de-identified form, and we never re-identify them. Which Maestra company is the customer's provider is stated in the customer's agreement; the sub-processors and hosting locations for End Customer Data are set out in our Data Processing Agreement and the sub-processor list, and the transfer mechanisms in the Data Processing Agreement.

If you are a customer of one of our customers and want to access, correct or delete your information, or to opt out of its use, please contact that company — the store or brand whose website you visited or whose messages you received; it decides how your information is used. We assist our customers in answering such requests.

11. Your rights and choices

Your privacy choices

Depending on where you live, you have the right to know what personal information we hold about you and to receive a copy of it, to correct it, to delete it, and to obtain it in a portable format. You may also have the right to object to or restrict how we use it, to opt out of the sale and sharing of your personal information and of targeted advertising and profiling, to withdraw a consent you gave, and not to be treated differently for exercising a right.

To opt out of sale, sharing and targeted advertising: choose Reject in our banner or in "Cookie settings" in the footer, or turn on the Global Privacy Control signal — the advertising sharing that runs in your browser stops there. You can also e-mail dpo@maestra.io: we answer within the times below, point you to the browser control, and remove your business-contact details from the advertising audiences described in section 4. No account is needed. An authorized agent may opt out for you; we may ask for your signed permission.

For this or any other request, e-mail dpo@maestra.io. For access, correction and deletion we confirm your identity by matching the details you give us with the information we hold. You may use an authorized agent if you give the agent signed permission and confirm your identity to us. We answer within the time the law gives us: in the United States normally within 45 days, which we may extend once by 45 days if we tell you why; in the EEA and the UK within one month, extendable by two months for complex requests.

If we decline a request, you may appeal by replying to our decision. We answer the appeal in writing within the time your state's law sets, and in any case within 60 days, and, if we uphold our decision, tell you how to complain to your state Attorney General or supervisory authority.

Marketing e-mail: every marketing message has an unsubscribe link, and you can object at any time by e-mail. We process unsubscribe requests promptly, and in any case within the time the law requires. Service messages about your account or contract continue.

United States

Sections 2, 3 and 5 state what we collect, its sources, the purposes, who receives it and how long we keep it. The categories we share for cross-context behavioral advertising and targeted advertising, and treat as sold to our visitor-identification provider, are identifiers and internet or other electronic network activity information; the recipients are the advertising and visitor-identification providers named in the Cookie Policy. We do not sell or share sensitive personal information, and we do not use personal information to train artificial-intelligence or machine-learning models. How we respond to the Global Privacy Control and Do Not Track signals is described in section 4; how to opt out is described above.

European Economic Area and United Kingdom

Maestra B.V. is the controller. The legal basis for each purpose is in the table in section 3. You have the rights under Articles 15 to 21 of the GDPR and the UK GDPR, including the right to object at any time to direct marketing and to processing based on legitimate interest, and the right to lodge a complaint with a supervisory authority — in the Netherlands the Autoriteit Persoonsgegevens, in the UK the Information Commissioner's Office, or the authority of your habitual residence, place of work or of the place of the alleged infringement. You may also complain to us at dpo@maestra.io; we acknowledge complaints within 30 days.

12. Changes to this policy

We change this policy when the law or our practices change. A new version carries a new version number and date at the top, and the previous version is kept in the archive below. For material changes we may also notify you, for example with a notice on the Website or an e-mail to account holders.

13. Named recipients

Updated as our providers change; the date of the last update is shown below. Categories: see section 5.

Recipients list last updated: 20 October 2026.

Archived versions: Privacy Policy 3.0 (18 November 2024) · Personal Data Policy 5.2 (16 September 2026) · Personal Data Policy 5.1 · Personal Data Policy 5.0 · Personal Data Policy 4.0