1. Who we are and what this policy covers
Stashimoto, Inc., a Delaware corporation doing business as Musel Cloud (“Musel Cloud,” “we,” “us” or “our”), provides the Musel Cloud websites, applications, agents and related services (the “Service”). This policy explains how we collect, use, share and protect personal information when you visit our websites, join our waitlist, or use the Service.
The Service and our waitlist are currently offered only to people and organizations in the United States. If you visit our websites from elsewhere, the information we collect is transferred to and processed in the United States.
When an organization uses the Service, the files, boards, messages and other content its users submit (“Customer Content”) are processed on that organization’s behalf and under its instructions. For Customer Content, the organization is the controller (or “business”) and we act as its processor (or “service provider”); its own privacy notice governs, and requests about it should go to that organization. Our Terms of Service or our written agreement with the organization govern our handling of Customer Content.
2. Information we collect
Information you give us
- Account information, such as your name, email address, organization and role.
- Sign-in information, such as your password and multi-factor authentication settings, which our identity service processes to verify you. We never store passwords in plain text.
- Customer Content, including files, boards, comments, messages and prompts you give to agents.
- Waitlist sign-ups: your email address, and optionally the problem you most want solved, along with which part of our website you signed up from.
- Communications, such as support requests, feedback and survey responses.
- Payment information, if you buy a paid plan. Payments are handled by our payment processor; we do not store full card numbers.
Information collected automatically
- Device and log data, such as IP address, browser and operating system, timestamps, pages viewed and actions taken.
- Session data, such as session identifiers stored in cookies that keep you signed in, and session start, activity and end times.
- Security and audit records, such as who viewed, changed, shared or exported what, when, and on whose behalf, including actions agents take for you.
Information from others
- Your organization, when an administrator invites you, assigns your role or manages your account.
- Other users, when they share boards with you or mention you.
- Services you connect to the Service, such as file storage, according to your settings.
4. How we use information
We use personal information to:
- provide, operate and maintain the Service, including AI Features you choose to use;
- authenticate users, enforce permissions and keep audit records;
- secure the Service, detect and prevent fraud, abuse and security incidents, and enforce our Terms;
- provide support and send service, security and account messages;
- send waitlist updates, product news and marketing, which you can unsubscribe from at any time;
- understand how the Service is used and improve it, using usage data and de-identified or aggregated data;
- comply with legal obligations, respond to lawful requests, and establish or defend legal claims; and
- carry out a merger, acquisition, financing or sale of assets.
AI Features
When you use AI Features, your prompts and the content needed to answer them are sent to AI model providers that act as our service providers, to generate output and carry out the actions you request. We do not use Customer Content to train generalized AI models offered to other customers without permission.
5. Legal bases for processing
Where the GDPR, UK GDPR or similar laws apply, we rely on these legal bases:
- Contract, to provide the Service you or your organization requested;
- Legitimate interests, to secure and improve the Service, prevent abuse, communicate with business contacts and defend legal claims, where those interests are not overridden by your rights;
- Consent, for marketing where consent is required, which you may withdraw at any time; and
- Legal obligation, where the law requires us to process information.
7. How long we keep information
We keep personal information for as long as needed for the purposes in this policy, including to provide the Service, comply with legal obligations, resolve disputes and enforce our agreements, and then delete or de-identify it. For example, account information is kept while your account is active; security audit records are kept for 90 days unless a longer period is required by law or a legal hold; and waitlist information is kept until you unsubscribe or ask us to delete it. Customer Content is kept and deleted according to your organization’s instructions and our agreement with it. Copies in backups are deleted on our regular backup cycle.
8. Security
We use administrative, technical and organizational measures designed to protect personal information, including encrypted connections, encryption of sign-in credentials and audit records, multi-factor sign-in, role-based permissions and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. International transfers
We are based in the United States, and we and our service providers may process personal information in the United States and other countries whose data protection laws may differ from those where you live. Where the law requires it, we protect transfers with appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK’s International Data Transfer Addendum.
10. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information; to object to or restrict certain processing; to withdraw consent; and to appeal our decision on your request. To exercise these rights, email privacy@muselcloud.com. We will verify your request before acting on it, and we will respond within the time the law requires. You may use an authorized agent where the law allows, and we will not discriminate against you for exercising your rights.
You can unsubscribe from marketing emails using the link in any of them; we will still send service and security messages. If you are in the European Economic Area or the United Kingdom, you may also complain to your local data protection authority.
For Customer Content in an organization’s workspace, please contact that organization. We will help it respond to your request as our agreement with it requires.
11. Notice to U.S. state residents
In the past 12 months we have collected these categories of personal information, from the sources and for the purposes described above: identifiers (such as name, email address and IP address); customer records; commercial information (such as plan and purchase history); internet or other electronic network activity (such as log, session and audit data); professional information (such as organization and role); and account sign-in credentials, which we use only to authenticate you and secure your account.
We disclose these categories to service providers and the other recipients described in “How we share information” for business purposes. We do not sell or share personal information for cross-context behavioral advertising, and we do not use or disclose sensitive personal information to infer characteristics about you. We honor Global Privacy Control signals as a request to opt out of sale or sharing where the law requires it.
12. Children
The Service is not intended for anyone under 18, and we do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact privacy@muselcloud.com and we will delete it.
13. Changes to this policy
We may update this policy from time to time. We will post the updated policy with a new “Last updated” date and, if the changes are material, notify you by email or in the Service before they take effect.
14. Contact
Stashimoto, Inc., doing business as Musel Cloud. Privacy questions and requests: privacy@muselcloud.com. Legal notices: legal@muselcloud.com.