Makertank Privacy Policy

Effective: July 14, 2026

This Privacy Policy explains how MKRTNK LLC, a Washington limited liability company doing business as "Makertank" ("Makertank," "we," "us," or "our"), collects, uses, shares, and protects personal data in connection with makertank.com and www.makertank.com, beta.makertank.com, join.makertank.com, app.makertank.com (also reachable at portos.makertank.com), vip.makertank.com, admin.makertank.com, investors.makertank.com, shop.makertank.com, and related applications and APIs (collectively, the "Service"). This Policy should be read alongside our Terms of Service, Acceptable Use Policy, End User License Agreement, and Refund Policy, all available at app.makertank.com/legal/. Makertank is the controller of personal data described in this Policy except where noted otherwise (for example, where a connected third-party financial provider acts as an independent controller, as described in Section 5).

Questions: legal@makertank.com

1. Who We Are

Makertank is MKRTNK LLC, organized under the laws of the State of Washington. We operate the Service described above, which provides business-planning, benchmarking, onboarding, investor-relations, and commerce tools for founders and small-business operators, along with related administrative tooling for our own team.

2. Personal Data We Collect

We collect the categories of personal data described below, organized by the part of the Service through which they are typically collected. Not every user encounters every category; the data we collect about you depends on which parts of the Service you use.

2.1 Account and Authentication Data

When you create an account, we collect your email address, a securely hashed password (if you register with email and password), and, if you sign in with Google OAuth, the identifiers and basic profile information Google shares with us under that authorization (name, email, and profile image, as applicable). We store a unique account identifier, third-party authentication metadata, and account timestamps. If you are promoted to an administrative role, your account is flagged accordingly and gains access to role-gated functionality; administrative actions are logged for security and audit purposes.

2.2 Profile and Business-Context Data

Through in-app onboarding, we collect a display name and business-context fields including business stage (for example, idea, early, growth, or mature), industry, revenue range, team size, and primary goal. We track your progress through onboarding steps, which content categories you have selected or uploaded, whether you have viewed your dashboard, and when you completed any onboarding ritual.

2.3 VIP Onboarding Wizard Data (vip.makertank.com)

The VIP onboarding wizard is a roughly 13-step guided intake used to establish a business relationship with prospective platform customers or partners. Depending on where a given deployment of the wizard stands, it collects or is designed to collect: business identity information (legal business name, structure, and website); contact information (name, email, phone); business stage, industry, revenue range, and team size (as in Section 2.2); Employer Identification Number (EIN) and other business-verification ("know your business," or KYB) information used to confirm that a business is legitimately organized and operating; and documents you upload in support of your application (for example, formation documents, licenses, or financial summaries). EIN and KYB data are collected only where a given onboarding flow requires them and are used solely to verify business legitimacy and to comply with our own risk, fraud-prevention, and partner obligations; we do not use EIN or KYB data for marketing purposes.

2.4 Proposal / RFP Data (the /apply flow)

The /apply proposal-qualifier flow collects information you submit to request a proposal or scope a project, including business details, a description of the work or opportunity, and estimated project budgets. We use this information to qualify and route submissions internally and, where you consent, to follow up with you about the opportunity.

2.5 Waitlist and Quiz Data (join.makertank.com)

If you join a waitlist or take an onboarding quiz, we collect your first and last name, email address, and, optionally, a LinkedIn URL, business name or URL, and a short business description. If you arrived through a quiz, we also store your quiz responses and result (for example, an archetype label such as "Maker" or "Visionary") and any query-string parameters that identify the quiz, result type, result value, and label, along with a "gated" flag indicating whether full results require signup.

2.6 Uploaded Reports and Business Data

If you upload financial, sales, customer, marketing, or goal-related reports (for example, spreadsheet exports), we collect the file name, our system's best guess at the source system that produced it (for example, QuickBooks), detected and user-confirmed column mappings, row counts, a confidence score for automatic mapping, and a sample of the underlying row data used to build mappings and previews. We also store the field-level mapping decisions (original field, mapped field, sample value, confidence, and whether the mapping was automatic or manual) associated with each upload.

2.7 Financial-Data Connections

If you choose to connect a third-party accounting system, currently including QuickBooks Online via Intuit's OAuth flow, we retrieve financial reports such as profit-and-loss statements, balance sheets, accounts-receivable and accounts-payable aging, invoices, and related summaries, strictly on a read-only basis. We store encrypted authentication tokens needed to maintain the connection; we do not store your accounting-platform login credentials directly, and we never request or use write-level access to modify your books. You may revoke this connection at any time, as described in Section 6 of our Terms of Service and Section 9 below.

2.8 Actions, Plans, and Reflections

We collect data reflecting your use of in-app planning tools: action items and their status (for example, to-do, in progress, done) and any action-specific payload data you enter; blueprint and module-improvement progress, including completed action keys and any measured "lift" from improvements; and free-text reflections or notes you choose to save.

2.9 Video and Audio Recordings (Cascade Recorder)

If you use Cascade Recorder, we collect video and audio you capture through your device's camera and microphone and upload to our storage. You control when recording starts and stops, and the Service will request your device's permission before accessing camera or microphone hardware. If a recording includes other identifiable people, you are responsible for obtaining their consent before recording or uploading, as described in our Acceptable Use Policy. You retain ownership of recordings you upload; we process and host them under the content license described in Section 8 of our Terms of Service, for purposes including transcription, AI-assisted analysis, and delivery of the specific feature you requested (for example, generating a highlight or brief from your recording).

2.10 Billing Data

We store subscription status, plan tier, the Paddle-issued subscription, customer, product, and price identifiers, billing-period dates, and whether a subscription is set to cancel at period end. For one-time module unlocks, we store the module identifier, the Paddle transaction identifier, and the unlock timestamp. We do not receive or store your full payment card number; Paddle, as Merchant of Record, collects and stores full payment data, along with billing name, address, country, and tax identifiers where required, under its own privacy policy.

2.11 Shop Orders (shop.makertank.com)

If you purchase a physical good, such as an art print, we (or Paddle, as applicable) collect your shipping address, order contents, and order status, and share the shipping address and relevant order details with the shipping carrier fulfilling your order.

2.12 Communications and Support

If you contact support, we collect the content of your message, your email address, and any attachments you provide, in order to respond to your request and maintain a support history.

2.13 Usage, Device, and Log Data

We and our analytics provider, PostHog, collect usage and telemetry data including pages and features viewed, in-app events (for example, waitlist views and submissions, form starts, completions, and errors), device and browser type, IP address, approximate location derived from IP address, and error logs generated by the Service.

2.14 Email Delivery and Compliance Records

To send account, transactional, and marketing email through Resend, we maintain a send log recording message identifiers, template names, recipient email addresses, delivery status (pending, sent, suppressed, failed, bounced, complained, or dead-lettered), and related metadata. We maintain a suppression list of addresses that have unsubscribed, bounced, or complained, and unsubscribe tokens used to process opt-out requests.

3. Sources of Personal Data

We collect personal data directly from you when you register, complete onboarding, submit a proposal or application, upload files, connect a financial-data source, make a purchase, or contact support. We collect data automatically through your use of the Service (usage and device data described in Section 2.13). We receive data from third parties including Google (if you sign in with Google OAuth), Intuit (if you connect QuickBooks Online), and Paddle (billing and transaction confirmations).

4. How We Use Personal Data and Our Legal Bases

We use personal data to provide and operate the Service, including creating and maintaining your account, powering dashboards and AI-assisted analysis and recommendations, processing payments and fulfilling orders, and providing customer support (performance of a contract with you). We use data to maintain the security and integrity of the Service, prevent fraud and abuse (including verifying KYB information submitted in onboarding), and enforce our Legal Documents (our legitimate interests, balanced against your rights, or, in relevant jurisdictions, legal obligation). We use aggregated and de-identified usage data to improve the Service and to develop new features (legitimate interests). We use billing and tax-related data to comply with our accounting and tax obligations (legal obligation). Where required by law, we rely on your consent for specific processing, such as marketing email or camera and microphone access for Cascade Recorder, and you may withdraw that consent at any time as described in Section 8.

5. How We Share Personal Data

We share personal data with the service providers and subprocessors described in the table below, each acting either as our processor (performing services on our instructions) or, where noted, as an independent controller of the data it receives.

We may also disclose personal data to professional advisers (legal, tax, and accounting), to a successor entity in connection with a merger, acquisition, or sale of assets, and to government authorities or other third parties where required by law, subpoena, or legal process, or to protect the rights, property, or safety of Makertank, our users, or the public. We do not sell personal data, and we do not share personal data with third parties for their own independent marketing purposes.

AI model providers process your inputs under contractual confidentiality commitments and do not use your inputs to train their general-purpose foundation models, except where you have separately agreed to such use.

6. Video and Audio Recordings

Recordings you capture through Cascade Recorder are stored in our infrastructure (hosted via Supabase Storage and Cloudflare) and are accessible to you and to Makertank personnel and processors who need access to provide the recording-related feature you requested (for example, AI-assisted transcription or summarization). We do not use your recordings to train third-party foundation models beyond what is necessary to generate the specific output you requested, consistent with Section 5. You may delete a recording at any time from within the Service; deletion removes the recording from active storage and it is purged from backups on the rotation schedule described in Section 7.

7. Data Retention

We retain account and uploaded data for as long as your account is active, plus a 30-day grace period following account deletion, during which your data is marked for deletion (soft-deleted) but recoverable if you contact support@makertank.com. After that grace period, an automated process permanently deletes accounts and cascades deletion to linked data, including subscriptions, unlocks, uploaded reports, actions, and recordings. Billing and tax records are retained for as long as required by applicable law, typically up to seven years. Backup copies of the database are rotated and fully purged within 90 days. Email delivery logs and suppression records are retained as needed to honor unsubscribe requests and demonstrate compliance with anti-spam law. We provide a data-export window of at least 30 days following account deletion so you can request a copy of Your Content before it is permanently removed.

8. Your Rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct inaccurate data, delete your data, restrict or object to certain processing, receive a portable copy of data you provided to us, and withdraw consent for processing that relies on consent (such as marketing email or camera and microphone access). Residents of the European Economic Area and United Kingdom have these rights under the GDPR and UK GDPR and may lodge a complaint with their local data-protection authority. Residents of California and other U.S. states with comprehensive privacy laws have rights under the CCPA/CPRA and similar state laws to know what personal information we collect, request deletion, correct inaccurate information, and opt out of the sale or sharing of personal information (though, as noted in Section 5, we do not sell personal data). To exercise any of these rights, contact legal@makertank.com; we will verify your identity before fulfilling a request and will respond within the time required by applicable law.

9. Managing Your Financial-Data Connection

You may revoke a connected financial-data source (for example, QuickBooks Online) at any time from within the Service's connection settings or directly from your accounting provider's third-party app permissions. Revocation stops future data retrieval immediately. Data already retrieved and stored by Makertank before revocation remains subject to this Policy and our retention schedule until deleted, and you may request earlier deletion by contacting legal@makertank.com.

10. Security

We use commercially reasonable technical and organizational measures to protect personal data, including encryption of data in transit (TLS) and at rest, row-level security policies in our database that restrict each user's access to their own data (with elevated access limited to designated administrative roles), role-based access controls, encrypted storage of financial-connection authentication tokens, and periodic security review of our infrastructure and subprocessors. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach of security affecting your personal data, we will notify you and, where required, the relevant regulators, in accordance with applicable law.

11. Cookies and Analytics

The Service uses strictly necessary cookies to operate core functionality (such as keeping you signed in) and analytics cookies and similar technologies, primarily through PostHog, to understand how the Service is used and to improve it. You can control non-essential cookies through your browser settings; blocking essential cookies may prevent parts of the Service from functioning. We do not currently respond to browser "Do Not Track" signals because there is no common industry standard for interpreting them, but we honor opt-out requests made directly to us at legal@makertank.com.

12. Children

The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13, consistent with COPPA. If you believe a child under 13 has provided us personal data, contact legal@makertank.com and we will investigate and delete the data as appropriate.

13. International Data Transfers

Makertank and our infrastructure providers are based in the United States, and personal data we collect is generally processed and stored in the United States, though our providers may process data in other countries as part of their global infrastructure. Where we transfer personal data out of the European Economic Area, United Kingdom, or Switzerland, we rely on recognized transfer mechanisms, including adequacy decisions and standard contractual clauses, to protect that data consistent with applicable law.

14. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Service, or applicable law. If we make a material change, we will update the effective date above and, where practicable, notify you through the Service or by email. Your continued use of the Service after a material change takes effect constitutes acceptance of the revised Policy.

15. Contact

Makertank is MKRTNK LLC, a Washington limited liability company. For privacy questions, requests, or complaints, contact legal@makertank.com. For general account or billing support, contact support@makertank.com.