Privacy

Draft — last updated 28 September 2026.

Who we are

OnShow is a trading name of MAKE MY AI LTD, a company registered in England and Wales, company number 17415404. Registered office: Hampden House, 76 Durham Road, London, SW20 0TL.

MAKE MY AI LTD is the data controller for the personal data described in this notice.

What we collect and why

• Public Instagram content for the handle you paste — bio, captions and photos — used solely to build your preview and (if you publish) your site.
• Website enquiries — when enquiry forms are enabled, we collect the details you submit (such as your name, email, chosen service and message) and share them with the business's verified recipient. OnShow stores a copy for up to 30 days so the business can read it even if an email fails. The business may keep its own email copy. Enquiries do not subscribe you to marketing.
• Booking providers — a booking window identifies the external provider before it loads. Choosing to load it connects your browser to that provider, whose privacy and cookie choices apply. Availability, details you enter and booking payments are handled by the provider. We do not forward your enquiry answers into booking calendars. You can open the provider directly instead.
• Your email when you buy (via Stripe) or join the waitlist — used for receipts, secure sign-in and service messages. No marketing without your say-so.
• Publishing permission — we record your purchase email, the declaration you accepted and its date when you confirm permission to publish. This is separate from Instagram ownership verification and marketing consent. Historical verification records and any evidence you provide for a content dispute are used to handle account safety and support.
• Abuse-prevention counters — we count requests per network address using a salted hash; we do not store raw IP addresses for this.
• Optional measurement — with your permission, a first-party cookie connects a visit to preview requests, saved links, verification, checkout and purchase. We retain campaign labels and a random journey identifier, rather than your private preview URL. If advertising measurement is enabled and you separately accept it, we also use the Meta click identifier from your ad link and your browser type to report ad outcomes to Meta. We do not include your Instagram handle, email, preview token or IP address in those reports.

How long we keep things

Preview links expire after 14 days. Preview source data is retained briefly for quality and abuse review, then removed on request or on a rolling basis. Published-site content is kept while your site is live. Payment records are kept as required for accounting. Optional measurement records are removed after 90 days by our hourly retention process. The journey cookie lasts 24 hours, and your privacy choice is remembered for 180 days.

Who touches the data

Our processors: Stripe (payments), Supabase (database and storage), Vercel (hosting), Cloudflare (bot protection), Anthropic (the AI that reads your public profile to draft your site). When you accept advertising measurement, Meta also receives the limited ad-event data described above, subject to its own privacy policy. We don't sell data to anyone.

Deleting your data

Ask us to delete everything at any time — see delete your data for exactly what goes and how to request it. If you bought a site we must keep the sales record (amount, date, payment references) for HMRC, but not the identity attached to it: your email, Instagram handle and web address are replaced with random placeholders that cannot be reversed. If you remove our app from your Instagram account, Meta notifies us and the deletion runs automatically.

Your rights

Want a preview or any of your data removed? Email hello@onshow.ai — removal requests are honoured within 24 hours, whether or not you're a customer.

Cookies

Essential cookies support services such as bot protection and remembering your privacy choices. When you start a preview or return through its email link, a functional cookie remembers a shortcut to it in this browser for up to 30 days. This does not extend a preview's expiry or grant editing access. After you provide an email for a preview, an essential cookie remembers editor access in this browser for up to 30 days. It contains no email address and does not verify ownership of an Instagram account. After payment, an essential cookie lets the purchasing browser finish setup and manage that purchase for up to 30 days. On another device, use secure purchase-email sign-in. Optional analytics and advertising measurement remain off until you agree. Use “Privacy choices” below to change your decision or withdraw consent at any time. You can return here from the Privacy link in our footer. Rejecting optional cookies does not affect building or buying your website.