Privacy policy

Last updated 4 October 2026

This explains what Maltira collects, why, and what you can do about it. It is written to be read rather than to be technically survivable in court, and if anything here is unclear, ask and we will explain it properly.

Maltira is operated from the United Kingdom. For the purposes of UK GDPR, Maltira is the data controller for information about our own clients and website visitors, and a data processor for the enquiry data we handle on behalf of a client's business.

If you fill in the form on this website

We collect your name, email address, phone number if you give one, and what you write. We use it to reply to you and to keep a record of the conversation. We do not add you to a mailing list, we do not sell it, and we do not pass it to anyone for marketing.

That enquiry is stored in Maltira itself, the same system we would use for your business. Alongside it we keep where your visit came from, as described under How we count visits to this website: the page you arrived on, the name of the site that sent you, and any campaign tags in the link. It stays until you ask us to delete it, or until we have no reason to keep it.

If you are a Maltira client

We hold what you would expect: your business details, your opening hours and services, the enquiries that come through your website, replies you write, posts you write, and figures about visits to your website.

We also hold credentials that let Maltira act on your behalf. For example, an application password for your website, or an access token for your Facebook page. These are encrypted before they are stored, using a key that is not kept in the same place as the database. We never ask for your account passwords, and every credential you give us can be withdrawn by you at any time from the platform it belongs to.

People who visit your website

If you are a Maltira client, we count visits to your website so we can show you visitor figures. We record the page, where the visit came from, and a short-lived identifier so the same person is not counted twice. We do not use advertising cookies and we do not track anyone across other websites. Visit records are deleted automatically after 400 days.

How we count visits to this website

We want to know how people find this website and whether it leads to anybody getting in touch, so Maltira counts that itself. There is no Google Analytics, no advertising pixel and no other company's tracker on this site.

When you load a page, click one of the buttons to get in touch, start typing in the contact form, or a form send fails, your browser tells Maltira:

• which of those it was, and which page or button;
• the name of the website that linked you here, such as google.com, and not the full address of the page you came from;
• any campaign tags in the link you followed (the utm_ part of an address, which says something like "from our Facebook post");
• a random number made up when the page loads and held only while it is open, so those steps can be counted as one visit. It is not stored on your device, and it is forgotten when you close or reload the page.

It does not include anything you type into the form, your IP address (it is used for a moment to stop the counter being flooded and is not kept), or anything about your device. We cannot use it to recognise you on a later visit or on any other website. We use it because we have a legitimate interest in knowing which of our efforts bring enquiries. If you would rather it did not happen, blocking scripts on this site stops it, and you can still reach us at hello@maltira.co.uk.

These visit records are deleted automatically after 400 days.

Cookies

This marketing site sets no cookies and stores nothing on your device, so there is nothing to accept or decline.

The Maltira application at app.maltira.co.uk sets one cookie, which keeps you signed in. It is strictly necessary for the service to work and is not used for anything else.

Other companies involved

We keep this list short on purpose, and it is complete:

• Hetzner: hosting. Our server and database sit on their infrastructure in the EU.
• Google Fonts: the typefaces on this page are loaded from Google's servers, which means Google receives your IP address when the page loads. That is the only request this website makes to another company, and we mention it because it is true, not because it is unusual.
• Resend: sending email, such as a reply to an enquiry.
• The platforms you connect: for example WordPress hosting, Meta (Facebook) or Google Business Profile. Maltira sends them only what is needed to make the change you asked for.

We do not use any advertising or analytics company.

How long we keep things

Operational workspace data is kept while you are a client, then retained for one year after closure or an unresolved failed payment so you can return. Before permanent operational deletion, Maltira makes a final export available to you. Deleted workspace data cannot be recovered; returning afterwards requires a new workspace.

Records Maltira must keep for legal, accounting, tax or compliance reasons are retained separately. Only a minimal former-customer record is kept to identify the former account and prevent a false promise of recovery: business name, account identifier, closure and deletion dates, and the warning that the old workspace cannot be restored. These records are not a recoverable workspace.

Visit records, for your website and for this one, are deleted automatically after 400 days unless removed earlier with operational deletion. An enquiry keeps its source information for as long as the enquiry is kept. Requests to delete data are considered alongside any applicable legal record retention requirements.

Your rights

Under UK GDPR you can ask us for a copy of everything we hold about you, ask us to correct it, ask us to delete it, or object to how we are using it. Maltira has a built-in export that produces everything held for a workspace, so this is a request we can answer quickly rather than a process.

Email hello@maltira.co.uk and we will reply within a few days. If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk.

Security, honestly

Credentials are encrypted at rest. Traffic is over HTTPS. Each client's data is kept separate both in what you see on screen and underneath, in the system itself, and we test that separation deliberately, by trying to reach one business's data from another and checking we are refused. Passwords are stored hashed and cannot be read back by us.

No system is perfect, and we will not claim ours is. If something goes wrong that affects your data, we will tell you what happened rather than quietly fixing it.

Changes

If this policy changes in a way that matters, we will tell clients directly rather than relying on you noticing a new date at the top.

Contact

Maltira, United Kingdom. hello@maltira.co.uk