Privacy notice

Who we are and what this notice covers

MuroAXO is operated by Maykesh Saravanan, a sole trader established in England and Wales, trading as MuroAXO (“we”, “us”, “our”). We are the data controller for the account, workspace and service data described in this notice.

This notice explains what personal data we collect, why we use it, who we share it with and the rights you have. It covers the MuroAXO website, app, project tools, model integrations, previews, support and billing. It does not cover GitHub, your chosen model provider, Stripe, MagicAds or other third-party services that you use under their own terms.

Our data protection registration with the UK Information Commissioner’s Office is in progress. The registration number will be published here as [ICO_NUMBER_PENDING] once issued.

Summary

• We use your account and workspace data to provide MuroAXO, connect your GitHub repositories and route your requests to the model provider you choose.
• We use Stripe for paid subscriptions and Resend to send sign-in codes.
• We load MagicAds only on eligible free workspaces, for adults, and only after you press “Accept All” in the cookie banner. We do not load advertising before that choice.
• We do not sell your personal data or use Your Content to train our own models.
• You can ask for access, correction, deletion or a copy of your data, and you can withdraw consent for optional advertising at any time.

Information we collect and why

Account and authentication. We collect your verified email address, account and workspace identifiers, full name and date of birth (for age assurance and age-appropriate advertising), GitHub username and installation identifiers, account tier and role, and authentication events. We set a first-party session cookie after sign-in. We use this information to create and secure your account, verify your age, connect GitHub and provide the Service.

Workspace and project data. We process project names, repository identifiers, file paths and contents, prompts, messages, attachments, model settings, tool calls and results, preview state and proposed file changes. Hosted project files are stored in the GitHub repositories you connect. A pending review may be held temporarily in Cloudflare D1 for up to ten minutes so you can approve or reject it. We use this information to run the workspace and carry out your requests.

Model provider requests. When you send a message, we send your prompt, the selected project context, any images you attach, tool results and, if you enable it, code-execution content to the provider and model you configured. The provider receives this information to answer your request. Depending on the provider and your account settings, it may act as an independent controller for its own model improvement, abuse prevention and retention. We do not control its practices; review its privacy terms before sending confidential or regulated information.

Billing. If you start a paid plan, Stripe processes your payment details. We receive your plan, subscription status, Stripe customer and subscription identifiers, transaction history and limited billing contact details. We do not receive or store your full card number. We use this information to provide the plan, take payments, prevent fraud and meet accounting and tax obligations.

Advertising and consent. On eligible free workspaces, if you press “Accept All”, we load MagicAds placements in the app shell. We record your consent choice in your browser. MagicAds and its partners may receive technical information such as your IP address, browser and device signals, approximate region, the page and placement, and impression or click events, and may store identifiers in their own frame. We do not pass your prompts or project files to MagicAds. Pro workspaces and accounts flagged as minors do not load advertising. See the Cookie Policy for details.

Device preferences. If you choose to save preferences on this device, we store your model preferences, theme and recent conversation history in your browser’s local storage. Provider API keys are excluded from that saved data. The storage choice cookie records your allow or deny decision and an account scope.

Security, operations and support. Our infrastructure providers may process IP address, user agent, request path, timestamps, error and diagnostic data, authentication events and rate-limit records. We use this information to deliver the Service, keep it secure, investigate abuse and faults, and enforce our terms. If you contact us, we process your message and contact details to respond.

We do not intentionally collect special category data (such as health, ethnicity, religion, sexual orientation or biometric data). Please do not submit it, or another person’s personal data, unless you have a lawful basis and have checked your provider’s terms.

Legal bases

• Contract: we process account, workspace, provider-request and billing data to provide the Service you asked for and to administer your account.
• Legitimate interests: we process security, diagnostic, abuse-prevention and service-improvement data to keep MuroAXO available and safe, provided your rights and interests do not override ours. We also process limited data to establish or defend legal claims.
• Consent: we load optional advertising and save optional device preferences only after you consent. You can withdraw consent at any time without affecting the core Service.
• Legal obligation: we process billing and tax records, age-assurance records and data needed to respond to lawful requests where the law requires it.

We do not use solely automated processing to make decisions that produce legal or similarly significant effects about you. AI output is an aid to your judgement, not an automated decision about your rights.

Who we share with

We share personal data only as needed to run MuroAXO:

• Cloudflare hosts the application, database and security layer.
• GitHub provides sign-in and stores your project repositories.
• Your chosen model provider (for example OpenAI, Anthropic, Google or a compatible endpoint you configure) receives the request and context needed to answer it. Its terms and privacy notice apply to its processing.
• Stripe processes payments and subscription billing.
• Resend delivers sign-in codes and service emails.
• MagicAds provides optional advertising on eligible free workspaces after you consent.
• Professional advisers, regulators, law enforcement or a successor business where required by law, needed to protect rights or safety, or in connection with a restructuring or sale. We will take reasonable steps to ensure a successor handles your data consistently with this notice.

We do not sell personal data. We do not share your prompts or project files with advertisers. Our processors act under contracts that require appropriate confidentiality and security. Some providers act as independent controllers for their own purposes; their privacy notices govern that processing.

International transfers

MuroAXO uses global infrastructure and model providers, so your data may be processed outside the UK or European Economic Area, including in the United States. Where required, we rely on the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses, together with appropriate safeguards. The exact locations depend on the infrastructure and provider settings in use. Contact us if you would like more information about the safeguards for a particular transfer.

How long we keep data

• Account and GitHub-link data: while your account is open. When you delete your account, we remove the active account, link metadata and pending reviews, subject to the retention below.
• Pending reviews: up to ten minutes, unless you approve, reject or delete them sooner.
• Session data: the session cookie lasts up to 14 days; the server stores only a hash of the session token.
• Billing and tax records: generally six years after the end of the relevant tax year, as required for accounting.
• Support correspondence: generally up to 24 months after the matter is closed.
• Security and diagnostic logs: generally up to 90 days, or longer where needed to investigate a security incident or legal claim.
• Consent records and device preferences: until you change them, clear your browser data or they are no longer needed.
• Project files: stored in your GitHub repositories under your control. Deleting your MuroAXO account does not delete those repositories.
• Provider data: retained by your model provider under its own terms and your account settings.

We may retain limited records where necessary to comply with law, resolve disputes, prevent fraud or enforce our terms. Backups and logs may persist for a short period after deletion before they are overwritten or expire.

Your rights

Depending on your location and the circumstances, you may have the right to:

• access a copy of your personal data and information about how we use it;
• correct inaccurate or incomplete data;
• erase data where there is no continuing lawful reason for us to keep it;
• restrict or object to processing, including processing based on legitimate interests;
• receive data you provided in a portable, machine-readable format;
• withdraw consent for optional advertising or saved preferences at any time.

To make a request, email info@leanopsstudio.co.uk. We will respond within one month, though we may extend that period by up to two further months for complex requests. We may ask for information to verify your identity. Requests are normally free.

Withdrawing advertising consent stops new optional advertising from loading. It does not affect the lawfulness of processing carried out before withdrawal, and it does not prevent us from using essential storage or providing the core Service.

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. Our ICO registration number is pending and will be published as [ICO_NUMBER_PENDING].

Security

We use technical and organisational measures designed to protect personal data, including encrypted connections, HttpOnly and SameSite session cookies, hashed session tokens, encrypted GitHub grants, restricted access, rate limits and security monitoring. No system is completely secure. You are responsible for keeping your sign-in email, device and provider credentials secure, and for reviewing the security of code before you deploy it.

Children

MuroAXO is intended for users aged 13 and over. If you are under 18, you may use the Service only with the involvement and consent of a parent or guardian. Paid plans may be purchased only by an adult. We use date of birth to apply our age rules and to exclude known minors from unrestricted advertising. If we learn that a child under 13 has created an account, we will take steps to delete it. If you believe a child has provided us with personal data, contact us.

AI features and automated processing

MuroAXO coordinates models and tools; it does not make solely automated decisions about you. Model output may be inaccurate or incomplete and must be reviewed by a human before it is relied on. We do not use Your Content to train our own models. Your chosen provider may process requests under its own terms, including for service operation, abuse prevention or model improvement where its settings permit. Check the provider’s privacy controls before sending sensitive information.

Cookies and advertising

We use essential cookies and storage to sign you in, keep the Service secure and remember your cookie choice. Optional preferences and MagicAds advertising load only after the relevant choice or consent. We do not load the advertising frame before you press “Accept All”. The Cookie Policy lists the cookies and storage we use, their purposes and how to change your choice.

Changes to this notice

We may update this notice when the Service, our providers or the law changes. The effective date at the top will change with a material revision. Where appropriate, we will notify you in the app or by email. Continue to check this page for the current version.

Contact and complaints

For privacy questions, requests or complaints, contact Maykesh Saravanan, trading as MuroAXO, Hardwick House, Masons Hill, Bromley, BR2 9GW, England, UK, or email info@leanopsstudio.co.uk. We will try to resolve your concern promptly. You can also complain to the Information Commissioner’s Office.