Privacy

This document says what personal data SaaS Pro Max holds, who is responsible for it, where it goes and how to get it out or have it deleted. It applies to the hosted service at saaspro.dev.

Who is responsible#

SaaS Pro Max is operated by:

• Business name: Make Agent Fast (메이크에이전트패스트), a sole proprietorship registered in the Republic of Korea
• Representative: Akbarov Abdurashid Rasuljon Ugli
• Business registration number: 723-25-01901
• Address: 202-ho, 30 10yongsa 3-gil (Bansong-dong), Dongtan-gu, Hwaseong-si, Gyeonggi-do, Republic of Korea
• Business type: information and communications; application software development and supply
• Contact: hello@saaspro.dev

The operator is established in Korea, so the Personal Information Protection Act applies to us. If you are outside Korea, your own law very likely applies to the application data you send, and you remain responsible for having a lawful basis for collecting it and for telling your own visitors about it. We cannot supply that basis for you.

Two different sets of data#

SaaS Pro Max holds two kinds of data, and they are not governed the same way.

Console data is what you type into SaaS Pro Max: your name, your email address, your organization and application names, your API key metadata, your audit trail. We are the controller of that data. It is shown only to members of your organization whose role allows it.

Application data is what your own applications send through the SDKs: pageviews, custom events, person records, exceptions, metrics. You are the controller of that data and we are your processor. We handle it on your documented instructions — the settings you choose in the console and the requests you send us — and for no purpose of our own. It stays in the database we operate for the service, it is never sold or shared with a third party for their own purposes, and you can read all of it back out through the Management API, the CSV export or a scheduled export to your own storage bucket.

What the SDKs collect#

The browser SDK sends what you configure it to send. With the defaults on, that is: the page URL, path, title and referrer; UTM parameters and ad click ids from the landing URL; screen and viewport size; locale and timezone; a random anonymous id; a session id; and any events you fire yourself. By default it also reads existing Meta (_fbp, _fbc) and TikTok (_ttp) advertising cookie values when they are present on your site. Set clickIds: false in the SDK or data-click-ids="false" on the script tag to disable reading those cookies and ad click ids from the URL.

Automatic analytics does not collect keystrokes, form values or clipboard contents. Optional session replay requires a separate choice and an enabled application policy. It records page structure, masks form values and sensitive text, and excludes code and marked private content. Ordinary visible text may be recorded; site owners can enable stricter text masking. Optional diagnostics records performance and interactions with explicitly marked controls. Surveys require a separate choice; survey and feedback responses are sent only when you submit them. Do not include secrets in a response.

On this site, you can change these choices on this Privacy page or your Account page. Turning off optional collection stops future capture; it cannot retract already submitted data. Console operational analytics follows the console's existing service contract; the optional features still require your choice.

The site owner chooses whether to honour Do Not Track. The browser SDK and script tag do not honour it by default. Set respectDoNotTrack: true in the SDK or data-respect-dnt="true" on the script tag to stop measurement when the browser reports DNT: 1. The WordPress integration enables this option by default.

IP addresses#

Raw IP addresses are not stored in event records. When an event is received, the server hashes the request IP address with a keyed hash (HMAC, or hash-based message authentication code) using SPM_IP_HASH_SECRET. For an event sent with a secret key, a supplied context.ip is hashed instead. Only the resulting hash is written to the event record. The same address produces the same hash while the secret stays the same. People sharing an address also share its hash. Country, region and city come from edge headers, not from an IP lookup table.

Cookies and cookieless mode#

Cookies. By default the browser SDK writes a first-party anonymous-id cookie (spm_aid, 400 days). Opting out also writes a preference cookie (spm_optout, 400 days). The SDK can read existing advertising cookies as described in What the SDKs collect above; it does not create them.

Only after you open Ask or Start a chat, the embedded makeagent.fast chat frame loads Cloudflare Web Analytics, sends a view request to its own /api/site/view endpoint, and sets an af_vid cookie on makeagent.fast with a 365-day lifetime (SameSite=None). This also happens if you declined SaaS Pro Max analytics. None of this chat activity loads before you open it.

Browser storage. The SDK also uses localStorage for the anonymous id (spm_aid), the session (spm_sid, renewed after 30 minutes of inactivity by default), a distinct id after identify() (spm_did), first/last touch attribution (spm_attr), cached flag values (spm_flags) and the opt-out preference (spm_optout). These are browser-storage entries, not cookies.

Set cookieless: true (or data-cookieless on the script tag) and it uses localStorage only and writes no cookies. Set consent: "pending" and it writes nothing and sends nothing until you call spm.consent("granted"). spm.optOut() stops collection for that browser.

The console itself sets spm_session, spm_csrf, spm_theme, spm_skin and the current organization and environment. All of them are functional; none of them are advertising cookies.

Personal data in the console#

Emails, names and IP hashes are shown only to members whose role carries the people.pii.read permission. Provider secrets, connector private keys and destination tokens are envelope-encrypted in the vault, are never returned to the browser, and are decrypted server-side for exactly one outbound call.

Who else processes the data#

We use as few sub-processors as the service can run on, and each one does one job:

No email delivery provider is in use: the service does not send email at present.

Two more things involve a third party only because you asked for them. Signing in uses your Google account, so Google sees the sign-in itself. The in-console AI assistant sends the question and the query results it needs to a model provider when a member with the ai.use permission asks it something — your organization's own credential if you stored one, otherwise the provider configured for the service. Nothing goes to a model unless someone asks it a question.

Scheduled exports write to a storage bucket you own and control. What happens to the data there is between you and your storage provider.

The console measures itself with its own SDK. The optional support chat loads third-party analytics only after you open it, as described above.

The public site offers a support chat run on makeagent.fast. It is not part of any page as it loads: nothing from makeagent.fast is requested until you press Ask or Start a chat, so until then it receives nothing and stores nothing in your browser. Once you press it, its script loads from makeagent.fast, and what you type into the chat goes there to be answered, together with what any browser request carries, such as your IP address and browser version. The console never loads it. If you would rather not use it, write to hello@saaspro.dev instead.

Retention and deletion#

Each application carries a retention window that you set in Settings → Data collection, bounded by your plan: up to 30 days on Free, 365 on Starter and 1,095 on Business. Events older than the window are deleted.

Deleting an application deletes its events, people and issues; deleting an organization removes every application, key and record it owns. Both require a request with the target slug and a reason, followed by confirmation in Jobs and approvals. The confirming member needs approvals.decide and apps.delete or org.delete, as appropriate. The requester can confirm their own request, including in a single-member organization; a second member is not required. Both steps require a reason and a passkey verified within ten minutes. An unapproved request expires after seven days.

Console data is kept for as long as the account exists. The audit ledger is append-only by design — a database trigger rejects UPDATE and DELETE on it — so an entry is never rewritten; it goes when the organization goes.

Deleted records can survive in a database backup until that backup is rotated out of use.

Security#

• Google identity plus a WebAuthn passkey on every sign-in; eight-hour absolute and thirty-minute idle sessions; a fresh passkey for high-risk actions.
• Authorization resolved server-side on every page and API handler, so an organization id from a browser grants nothing.
• Provider secrets, connector keys and destination tokens envelope-encrypted in a vault and decrypted server-side for exactly one call. The vault master key is not in the database backup.
• An append-only, hash-chained audit ledger. A database trigger rejects UPDATE and DELETE.
• IP addresses HMAC-hashed at ingest; emails, names and hashes gated behind a separate permission.
• HTTPS on every connection to the console and the ingest endpoint, and a nonce-based Content Security Policy. The console loads no third-party script; the public site loads one, the support chat, and only on request.

No system is perfectly secure. If we learn of a breach affecting your data we will tell you, and where the law requires it we will notify the regulator.

Your rights#

For console data, where we are the controller, you can ask us to give you a copy, correct it, delete it, or restrict or object to how we use it. Most of it you can do yourself: your Account page edits your own details, and the console edits your organization. Anything else goes to hello@saaspro.dev and we answer within thirty days.

For application data, the person whose data it is should ask you, not us — you are the controller there. We help you answer: the Management API and the CSV export read the data back, retention and application deletion remove it, and we will act on a documented instruction from you about a specific record.

Depending on where you live you may also have the right to complain to a supervisory authority. In Korea that is the Personal Information Protection Commission.

Children#

SaaS Pro Max is a tool for people who build software. It is not directed at children, and we do not knowingly collect personal data from anyone under 16 through the console. Do not use the SDKs to collect data from children without the consent your own law requires. If you believe a child's data reached us through the console, write to hello@saaspro.dev and we will delete it.

Changes#

We can change this document. The changed version is published here with a new date, and where a change is material we tell organization owners by email or in the console. If a change to how we process application data affects you as a controller, you will have the chance to export and leave before it takes effect.

Contact#

Questions, requests and complaints go to hello@saaspro.dev.