Privacy Policy

This Privacy Policy describes how pluginmaker.ai collects, uses, and protects your personal information.

The data controller is PLUGINMAKER.AI sp. z o.o., os. Piastowskie 94/26, 61-162 Poznań, Poland (registered in the National Court Register under KRS 0001238740, NIP 7822969104), which operates pluginmaker.ai. You can reach the controller at office@pluginmaker.ai or at the privacy contact in section 10.

1. Information We Collect

Account Information

When you create an account, we collect your email address, name, and profile picture (if you sign in with Google).

Plugin Data

We store the plugins you create, including DSP code, UI blueprints, presets, and generated screenshots, and the audio samples you upload for Sampler plugins. This data is associated with your account.

Sampler Audio Samples

Your samples stay on your device until you agree to save them to your account: the first save asks for your agreement, and after that your edits are saved automatically. When your audio is saved, it is uploaded to our cloud storage (Cloudflare R2, see section 3) and used only to build, test and deliver your plugin; it is private to your account. Authorised pluginmaker.ai staff may access uploaded samples only for support, safety or legal reasons. Terms section 18 says what we may do with it, how long it is kept and when it is deleted.

We promise we won’t train any AI model on the samples you upload (Terms section 19).

The audio itself is never sent to an AI model. The Sampler chat does send the AI provider the names of the WAV files and folders you connect (as relative paths), the sample map you are editing (instrument and patch names, key and velocity ranges, settings such as loop points, gain and envelope, and the file name assigned to each zone) and your messages, so that it can propose a mapping or changes to the map. OpenAI (US) processes that text; if the chat runs on a Claude model, Anthropic (US) does instead. Because it is part of an AI request, it is also recorded in the logs of AI requests that we keep (section 3, OVHcloud), with the retention described under Generation traces in section 4. File and folder names can contain personal information, so please do not put any in them.

Payment Information

Payment processing is handled by Stripe. We do not store credit card numbers or bank account details. When you use the marketplace, Stripe processes and stores payment data according to their Privacy Policy.

Marketplace Data

If you sell plugins, we store your seller profile (display name, bio) and transaction history (sales, earnings). If you buy plugins, we store your purchase history.

Shopify Fulfillment Data

For fulfillment and licensing carried out on a merchant’s instructions, we process buyer data on that merchant’s behalf. The merchant determines the purposes and applicable lawful basis for that processing. Authorizing a Shopify connection does not constitute the buyer’s consent to unrelated uses of their information.

New connections automatically request reduced order data, which we verify with Shopify during connection: buyer email, Shopify order reference and update time, and line-item product identifiers from a paid order. We use those fields to match products the merchant mapped, issue the purchased plugin entitlement, prevent duplicate grants, and support fulfillment. We do not request the buyer’s name, phone number, or address.

Older installed connections keep their existing settings until staff activate and verify reduced settings. Their payload can include payment status and additional line-item details. We use only the fields needed for fulfillment and do not retain those additional details. Product identifiers from other items in a mixed order may also reach our signed webhook while we perform the mapping. We discard unrelated identifiers in the same processing pass; they are not stored or displayed.

New deliveries are not stored as Shopify order bodies. Order bodies retained by earlier delivery handling require staff review and approved cleanup; there is no automatic expiry for those older bodies.

For an issued entitlement, we retain the normalized buyer email, Shopify order reference, and granted pluginmaker.ai plugin identifiers so the buyer can keep access and we can support fulfillment. We also retain limited delivery audit data, such as a delivery identifier, outcome, and counts, to prevent duplicate grants and diagnose delivery problems.

Shopify also sends privacy-request and uninstall notifications. To handle them, we retain the request identifier, shop and installation reference, relevant customer email or identifier, specified order references, and the request’s status and deadlines. These notifications can contain additional customer or shop details; we do not retain their raw bodies or unnecessary fields such as a phone number. Privacy-request records are separate from paid-order deliveries.

Business Contacts (CRM)

We keep records of partners, creators, prospects and other business contacts in our customer-relationship tool, Attio. Besides the details we enter ourselves, on September 11, 2026 we imported details of platform accounts (name, email address, purchase status and marketing consent status) into it. Attio’s sync of our founders’ Google mailboxes and calendars also automatically creates a contact record for every person who corresponds with a founder by email or shares a calendar event with them, including people who have no business relationship with us. Such a record holds the name, email address and company, plus interaction data generated by the sync: the first and last email and calendar interaction, a relationship-strength score, and which of us has the strongest connection with you.

Attio also enriches company records from its own sources, adding for example a description, categories, employee range, estimated revenue, founding date, social-media handles and follower counts, location and logo. Where a company record stands for a sole trader, that information relates to a person. We do not enable enrichment of individual people.

We use these records to manage our business relationships and for individual business outreach, on the basis of our legitimate interest in running and developing our business (GDPR Article 6(1)(f)). We send marketing email to recipients in the EU or the United Kingdom only with their prior consent. Our legitimate interest does not cover the imported platform accounts or the records the sync created about people with no business relationship with us, and we have decided to remove those records. The records are not used for automated decisions. You can object at any time by writing to the privacy contact in section 10.

Content Reports

When you report content through our report form or by email, we process your name, email address, the kind of report, the link to the content, your explanation, the statements you confirm and anything else you include in an email notice. A report of child sexual abuse needs no name or email address. We use these details to assess the report, act on it and tell you our decision. Where a report points to a threat to someone’s life or safety, including child sexual abuse, we may pass it to the police or other competent authorities (EU Digital Services Act Article 18). For a notice under the EU Digital Services Act this is a legal obligation (GDPR Article 6(1)(c)); otherwise it rests on our legitimate interest in keeping the platform lawful (GDPR Article 6(1)(f)). We don’t give your name or email address to the person whose content you reported, unless a court or authority requires us to.

When someone reports your content, we record your account, the affected plugin and our decision with the report, and count upheld reports against your account, because repeat infringers lose their account. This rests on the same bases as above. If your content is removed, we tell you why and how to contest it. If you contest, we may share your reply with the person who reported the content. If you contest a copyright removal, we forward your counter-notice, including the contact details in it, to that person, so they can decide whether to go to court.

Usage Data

We collect usage data including page views, feature usage, and error reports to improve the platform. When you are logged in, this data is linked to your account. We use PostHog for analytics.

We also use Sentry for website error and performance monitoring. This can include error messages, stack traces, browser and request metadata and sampled performance data. Website Sentry monitoring is configured independently of the analytics-cookie choice and the separate installer diagnostic consent described below.

Our servers also keep a standard request log for security, abuse prevention and troubleshooting: the time, requested path and response status of each request, the network IP address it came from, the browser or plugin user-agent string, and your account identifier when the request was signed in (including white-label plugin activations). This log is retained for 30 days and processed under our legitimate interest in keeping the service secure and working (GDPR Article 6(1)(f)). It is never used for advertising or profiling.

Installer and Native Plugin Diagnostics (Opt-In, Default Off)

A pluginmaker.ai-branded installer, or a white-label installer powered bypluginmaker.ai, and every plugin you install through it can optionally send diagnostic data from your machine to help us identify crashes and installer failures. pluginmaker.ai determines the purposes and fields, receives the data, and is the data controller for this diagnostic service. The customer brand does not receive this diagnostic data. This data is not described as anonymous because a native crash report can contain technical details that may be personal data. This is off by default. The first time you open the installer, you are shown a consent dialog with two buttons (“Share crash + diagnostic data” or “No thanks”). No data is transmitted until you click one. Your choice applies to that branded installer and the plugins installed through it — one decision, one record, no per-plugin re-prompting. This consent is separate from any other consent on the pluginmaker.ai website and from a decision made in another branded installer.

When enabled, we may collect:

• Installer event name, success or failure, duration, installer version, operating system, CPU architecture, and a plugin identifier where needed to diagnose an installation
• For a failed Windows install or uninstall: failure category, random diagnostic ID, Windows error codes, retry count, lock-owner count, and the executable and application names (basenames only) of processes holding the affected plugin file
• For native plugin crashes: event time, plugin ID/type/version and brand, host-process or DAW name, OS/build, CPU architecture and device model, exception information, register values, thread names, stack frames, module basenames, and debug identifiers used for symbolication
• On Windows, the raw native minidump required for symbolication. A minidump contains process/module details and fragments of stack memory. These fragments can incidentally contain personal or sensitive information, such as parts of paths, credentials, audio or project data. We do not intentionally collect that content. Updated crash reporters remove directory parts from loaded and unloaded module names and PDB debug-file names before uploading, and use a neutral attachment filename. Older reporters may still include module paths with an account-folder name. This minimization does not remove all incidental information from stack memory.

We do not intentionally collect through this diagnostic feature:

• Audio buffers, MIDI streams, or any sample content
• Project content or preset names you have typed
• License keys, payment data, authentication tokens, command lines, MAC addresses, disk serials, or machine UUIDs
• Account IDs, operating-system usernames/hostnames, full file paths, or process IDs in installer diagnostic events. The client removes these fields and redacts paths, email addresses, IP literals, and token-like values before sending those events.

Our infrastructure and diagnostic providers necessarily process the network IP address used to deliver and protect a request. We do not add it to the installer diagnostic payload or use it as an installer identifier. As explained above, native Windows crash data can still contain module paths with an account-folder name.

Lawful basis: your explicit consent under GDPR Article 6(1)(a) and the ePrivacy Directive Article 5(3). You can revoke this consent at any time from the installer’s Settings panel (toggle “Share crash + diagnostic data”), or by deleting its telemetry_consent.json file. The flagship installer stores that file in the pluginmaker.ai user-data folder (%APPDATA%\PluginMaker\ on Windows, ~/Library/Application Support/PluginMaker/ on macOS). A white-label installer uses the same locations under its immutable storage-folder name, which may differ from its displayed product name. Updated installers show the exact consent-file path in Settings and can reveal it in Finder or File Explorer. If your installed version does not show these controls, use the locations above; contact support if you need help finding the branded folder. The Settings switch stops future installer uploads immediately. After manually deleting the file, restart the installer to ensure older versions stop sharing. Close and reopen running plugins or your DAW so they reload the choice. Reports already sent are not erased by withdrawal; you can request their deletion using the privacy contact in section 10.

Local installer logs stay on your computer. Updated installers show the exact main.log path in Settings. In older versions, use the locations below. For the flagship installer it is in~/Library/Logs/PluginMaker Installer/ on macOS and%APPDATA%\PluginMaker Installer\logs\ on Windows. Branded installers use their storage-folder name; older versions can use their historical product name. The log rotates at 10 MiB and keeps one previous main.old.log, with no age-based expiry. On Windows, recent failure records are in diagnostics/install-failures.jsonl beside main.log; on a later failure, records older than 30 days are removed and the latest 100 are kept. Local logs can contain account details and full file paths. Review them before sharing with support. If you no longer need these logs, close the installer before deleting the log files. This does not uninstall plugins or change consent.

Updated Windows crash reporters keep local raw dumps in%LOCALAPPDATA%\PluginMaker\CrashDumps\ for up to seven days while the reporter is running, and remove a copy after delivery or after saving a minimized retry copy. Raw dumps are also limited to 20 files and 50 MiB in total. Pending retry copies in%APPDATA%\PluginMaker\CrashReporterV2\queue\ expire after seven days, including interrupted writes. Cleanup runs when the reporter starts and during its regular retry checks. If the reporter is stopped, remaining files are cleaned on its next start; older reporters may keep files longer. Close the reporter before manually deleting local dump or retry files you no longer need. This does not erase crash events already sent to Sentry.

Structured installer diagnostic logs are retained for 30 days. Native crash events are stored by Sentry (Functional Software, Inc.) in its EU region for the retention period configured for our project, no longer than 90 days. Aggregated operational counters may be retained longer when they no longer contain event-level diagnostic details.

2. How We Use Your Information

• To provide and maintain the platform
• To process marketplace transactions
• To send important account notifications
• To manage our relationships with partners, creators and other business contacts, including individual business outreach
• To improve the platform based on usage patterns
• To prevent fraud and abuse
• To handle reports of illegal content and meet our legal obligations

Direct installer support

pluginmaker.ai runs the support chat in the pluginmaker.ai installer and in branded installers. In a branded installer the chat carries the brand’s name, for example “Song Athletics support”, but your messages still go to pluginmaker.ai. We receive your messages, account name and email address, and which installer and brand you wrote from, so our support team can respond. pluginmaker.ai is the controller for this direct support service. The brand’s support team also reads and answers the conversation in its Brand Console, where it sees your name, email address, messages, screenshots and any installer details shared with the conversation. Please avoid including audio, project files, passwords or license keys in your message.

You can attach screenshots. They are never copied into Slack. They are stored privately with our storage provider (Cloudflare R2, listed below), hidden file information such as location data is removed when you upload them, and they are visible only to you, our support team and, in a branded installer, that brand’s support team. They are deleted together with the conversation — 12 months after its last message, or earlier on request. Please don’t include passwords, licence keys, payment details or other people’s personal data.

When you start a support conversation, the installer adds your operating system and version, the installer version, and the ID and version of the plugin you selected, so our team can diagnose your problem; the chat panel shows this before you send. We process these details because they are needed to provide the support you asked for (GDPR Art. 6(1)(b)), and reading them from your device is strictly necessary for that service. You can remove them from the conversation with ‘Remove shared details’. This does not enable crash reporting or change your diagnostic preferences.

Our team may handle your messages in a private Slack support channel. Device details remain in our support system and are not copied into Slack. We delete a support conversation, with every message and screenshot in it, 12 months after its last message, or earlier if you ask us to. Contact us to request deletion of a conversation, including its Slack copy. If Slack or storage is temporarily unavailable, we keep only the references needed to retry removal and delete those references once removal is confirmed. An unresolved copy remains subject to your deletion request; contact us if you need its status.

3. Data Sharing

We share your data with the following third-party services. Some of these services are based in the US, which means your data may be transferred outside the EU/EEA.

To ask which safeguards apply to a transfer of your personal data outside the EU/EEA, or to request a copy of them, use the privacy contact in section 10.

• Slack (US) — our private support inbox for installer messages, handled by our support team. Optional device details are not sent to Slack.
• Google (US) — authentication via Google Sign-In, and our company email (Google Workspace). Receives your email, name, and profile picture when you log in with Google, and the emails you exchange with us, including content reports sent by email, our decisions and any challenges or counter-notices
• Stripe (US) — payment processing and seller payouts. Receives your name, email, and payment information
• Anthropic / OpenAI (US) — your plugin descriptions and prompts, and reference images you attach for interface mockups, are sent to AI providers for generation. In the Sampler chat they also receive the names of the files and folders you connect and your sample map, never the audio itself (see Sampler Audio Samples in section 1). In Pro mode (paid plans) the main plugin-generation steps (sound engine, interface, presets and interface mockups) run on Anthropic’s Claude models, reached through OpenRouter, Inc. (US); from 23 September 2026 until Fast mode was introduced, every generation ran this way. OpenRouter forwards requests to the provider hosting the selected model (currently, for example, Google Cloud Vertex AI), under zero-data-retention settings: on every request we instruct it to use only hosts with a zero-data-retention policy that do not collect or train on prompts. OpenRouter’s data processing agreement incorporates the EU Standard Contractual Clauses for our transfers to OpenRouter, and the model hosts act as its sub-processors; OpenRouter publishes its own sub-processor list at openrouter.ai/authorized-sub-processors. In Fast mode, and for the plugin-builder chat and the planning steps behind it in both modes, requests are sent to OpenAI directly. Earlier, OpenRouter also routed some generations to other model hosts, including Google (Gemini) and the host of the GLM models: the default model set used them between 18 June and 11 July 2026, customers could select OpenRouter-routed models until 18 September 2026, and on 23 September 2026 the chat also ran through OpenRouter for about an hour (12:24–13:24 CEST)
• FoundryLabs, Inc. (E2B) (US) — ephemeral cloud sandboxes in which the coding agent writes and builds your plugin; receive your prompts and the generated source code for the duration of a generation
• GitHub, Inc. (GitHub Actions) (US) — hosted test runners that install plugins built for our enterprise (white-label) brand customers and test them automatically. They receive the built plugins and, for Sampler plugins, the sample library, only for the length of one test run; the test results and logs they produce are kept by GitHub for up to 90 days
• Cloudflare, Inc. (R2) (US provider) — stores plugin files and assets linked to your account, the audio samples you save for Sampler plugins, screenshots attached to support conversations, and encrypted backups of our generation traces. Our storage buckets are placed in Cloudflare’s Eastern-Europe region (a location hint, not an EU-jurisdiction restriction) and downloads are delivered through Cloudflare’s global network
• PostHog (EU) — analytics. Collects usage data linked to your account when you are logged in. Only active if you accept analytics cookies
• Hetzner Online GmbH (Germany/EU) — hosted our self-managed Langfuse instance until September 22, 2026 and receives no new traces. The generation traces it recorded up to that day were archived on September 23, 2026 on our OVHcloud server in France and in an encrypted backup in our Cloudflare R2 storage; the Hetzner server, which still holds its copy, is being decommissioned
• Plausible (EU) — cookieless, aggregated web analytics on our pages; visitor IP addresses are processed transiently for counting and are not stored
• Resend, Inc. (US) — transactional email. Receives your email address and the content of the account and support emails we send you, including the confirmation of a report sent through our report form
• Linear Orbit, Inc. (US) — our issue tracker. Receives the content reports you send us, with the account, plugin and decision they concern and any challenge or counter-notice; the feedback you send from the app, together with your name, email address, account ID and the plugin it is about; and, when a generation fails, your account ID, the plugin’s ID and name, the error and the first 500 characters of your prompt, so our team can handle them
• Functional Software, Inc. (Sentry) (US provider; installer/native event storage in Germany, EU) — website error and performance monitoring, plus installer and native plugin crash diagnostics. Installer and native reporting requires your diagnostic opt-in. Native Windows minidumps can include module paths and process details; installer events are redacted and bounded before transmission
• Vercel (US provider, global delivery network) — hosts the production website and forwards web authentication requests to our backend. Processes network/request metadata and authentication data in transit, including the credentials, codes and tokens used by the relevant sign-up or sign-in flow
• Slack (Salesforce) (international processing, including the US) — internal notifications and support coordination. New Shopify sale alerts use brand/operator labels, plugin names and buyer counts without buyer emails or Shopify order references. Older alerts contained buyer emails and order references and may remain in message history; relevant support messages and historical copies are included in deletion-request handling
• OVHcloud (Germany and France/EU) — server infrastructure hosting the backend, build services, monitoring services, and structured installer diagnostic logs. Since September 22, 2026 it also hosts our self-managed Langfuse instance (in France), the observability store that logs AI generation requests and responses (your prompts and the generated code, and for the Sampler chat the file and folder names you connect) to monitor and improve the platform
• Neon — managed database hosting for account, plugin and licensing data. Our production database is hosted in Frankfurt, Germany (EU)
• Attio (Attio Limited, UK, covered by the EU adequacy decision for the United Kingdom; our workspace is hosted on Google Cloud in Dublin, EU, with US sub-processors under Attio’s data processing addendum, which incorporates the EU Standard Contractual Clauses) — customer relationship management. Holds business-contact and customer-account details (name, email address, purchase status and our correspondence with you), the contact records created by its mailbox and calendar sync, and the company information added by its enrichment, used for support, sales follow-up, business outreach and consent tracking. Its enrichment providers, including a third-party logo service, act as Attio’s sub-processors. It never receives your plugin content, prompts or generated code

We do not sell your personal data to third parties. Marketplace seller display names are publicly visible on plugin listings.

Shopify is selected and operated by the connected merchant. Shopify sends paid-order data to our backend; the infrastructure and database providers listed above process it only as needed to operate the fulfillment service. Connected merchants can also review the current sub-processor information.

4. Data Retention

We retain your account data and plugins as long as your account is active. You can request deletion of your account and associated data at any time by contacting us.

Generation traces. The records of your AI generation requests — your prompts, the model’s outputs and the generated code, together with the user, session and account identifiers that link them to you — are kept in full for as long as the purposes that justify them require: debugging, quality work, investigating abuse and cost, and evaluating our prompts and models. Building and delivering the plugin itself is covered by our contract with you (GDPR Article 6(1)(b)); keeping the trace afterwards for the purposes just listed rests on our legitimate interest in supporting, securing and improving the service (GDPR Article 6(1)(f)). Older traces are then moved to an anonymised archive, which we keep without a time limit. Anonymising a trace removes the user, session and account identifiers and scrubs identifiers from inside the free-text prompts and outputs, and we keep no re-identification key or lookup table. If you ask us to erase your data we delete the full traces that relate to you, and we treat any archived entry that can still be connected to you as covered by that request. We adopted this on September 22, 2026 and are still implementing both steps, so for now traces are retained in full, with no automatic age-based expiry.

Business contacts (CRM). We keep a business contact’s record for as long as the relationship lasts and 3 years after the last interaction, and then delete or anonymise it. If you never replied to our outreach, we keep your record for 12 months from our last contact. If you object, we keep only a hashed copy of your email address on a suppression list, so that we do not contact you again.

Support conversations. We delete a support conversation, with every message and screenshot in it, 12 months after its last message, or earlier if you ask us to.

Content reports. Reports, our decisions, any challenges and the emails about them are kept in our issue tracker and our company mailbox for as long as we need them to handle the report and any challenge, to count repeat infringements and to defend legal claims. They do not currently have an automatic age-based expiry; they are included in privacy-request handling.

Shopify purchase records are retained while needed to provide the merchant’s ongoing licensing and support service, or for a specific legal retention requirement. Delivery audit records support duplicate prevention and troubleshooting. They do not currently have an automatic age-based expiry; they are included in privacy-request and service-termination review. Approved store redaction removes delivery history.

Disconnecting a Shopify store stops future order processing but does not revoke entitlements already issued. Shopify deletion requests await staff review and explicit administrator confirmation before database erasure. Approved customer redaction removes purchase records for the specific orders listed in that request, preserving other purchases. Approved store redaction removes the uninstalled connection, mappings and delivery history; it cannot delete a newer reconnection. Staff separately review account records, issued licenses and any required retention.

Shopify privacy requests are recorded before acknowledgement and placed in a staff queue. Receiving a request or retrying a background job does not authorize deletion. After disconnection, we keep an encrypted copy of the Shopify app secret, with the store and installation identifiers, to verify later Shopify privacy notifications. This verification record contains no store access token. It remains while Shopify purchases, brand customer accounts or unresolved privacy requests exist; staff completion removes it once none remain. We track Shopify’s 30-day completion deadline and clear the scoped customer identifiers from the request record after completion. Access requests require secure delivery to the merchant. Completion includes review of queues, logs, Slack, subprocessors and backups under the retention policy.

After Shopify reports an uninstall, fulfillment stops and the disconnected configuration, including the encrypted token revoked by Shopify, remains until approved cleanup. A completed disconnect initiated in our application clears that token immediately.

We keep a keyed, pseudonymous reference for erased Shopify orders while the brand exists to prevent late deliveries from granting access again. Questions about access or deletion can be sent to the contact address below.

Backups and retained database copies may contain earlier versions of records removed from the active database. Some retained copies have no automatic expiry. Our procedure requires review of whether they are still needed. Staff handle these copies manually when addressing a valid deletion request, recording the action and completion deadline for each relevant copy. Some snapshots cannot be edited one record at a time and require controlled replacement or deletion of the whole snapshot. Where immediate erasure is not possible, any temporary retention must have a recorded justification and deletion deadline consistent with applicable law and our agreement with the merchant; the affected data is kept out of use until then. We explain any remaining retention to the authorized requester. Our recovery procedure requires approved deletions to be reapplied before a restored system resumes service.

5. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Request restriction of processing where applicable
• Export your data in a portable format
• Object to processing of your data
• Withdraw consent at any time
• Lodge a complaint with a data protection supervisory authority

To make a request about your personal data, contact us at privacy@pluginmaker.ai.

You can lodge a complaint with a supervisory authority in the EU/EEA, particularly where you usually live, where you work, or where you believe the infringement happened. In Poland, this is the President of the Personal Data Protection Office (UODO); see UODO’s contact and complaint information.

6. Cookies

We use essential cookies for authentication and session management. We use PostHog for analytics which may set tracking cookies. Stripe may set cookies during the checkout process.

7. Security

We use industry-standard security measures including HTTPS, encrypted database connections, and secure authentication. However, no system is 100% secure.

8. Children

pluginmaker.ai is not intended for children under 18. We do not knowingly collect data from minors.

9. Changes

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on the platform.

10. Contact

Controller: PLUGINMAKER.AI sp. z o.o., os. Piastowskie 94/26, 61-162 Poznań, Poland — office@pluginmaker.ai

Privacy requests (data-subject rights, data-protection questions): privacy@pluginmaker.ai — this address reaches both members of the management board.