Legal
Privacy Policy
1. Who we are
MuseMill is run by PROJECT VELAR S.R.L., Bd. Theodor Pallady nr. 4, bl. M2, sc. D, ap. 168, Sector 3, Bucharest, Romania (Trade Register J2021020594403, CUI 45265695). For the personal data described here we are the controller. Questions or requests: privacy@musemill.ai. The person in charge of privacy at MuseMill can be reached at the same address.
When we process personal data inside your content on your behalf (for example names or photos of your staff, customers or followers), your business is the controller and we are its processor under our Data Processing Addendum. If you are one of those people, please contact the business first; we will help it answer you.
2. What we collect and why
| Data | Why we use it | Legal basis (EU/UK GDPR) |
|---|---|---|
| Account: name, email, sign-in method (email code, Google or Apple), business name, team members and roles | Create your account, sign you in, and run your workspace | Contract |
| Brand materials: your website address and public content we read from it, a screenshot of it, logos, colours, fonts, photos, facts about your business | Learn your brand and create posts that match it | Contract |
| Posts and activity: generated images and captions, edits, approvals, schedules, autopilot settings | Create, review, schedule and publish your posts; keep a version history | Contract |
| Connected social accounts: account names and IDs, connection status, post results and statistics from the platforms | Publish to your accounts and show how posts perform | Contract |
| Billing: plan, subscription status, Stripe customer ID, invoices. Card details are handled by Stripe, not us | Take payment, invoice, prevent fraud, keep accounts | Contract; legal obligation (tax and accounting) |
| Free preview (before you sign up, on the website or in the app): the website address you enter and what we read from it, a cover we create, and a one-way hash of your IP address. In the app, also a random code kept on your phone that links the preview to you. We store only a one-way hash of it. Apple or Google also confirm, through Firebase App Check, that the request comes from the real MuseMill app | Show you a first post, and stop abuse of the free preview | Legitimate interests (showing what we do; preventing abuse) |
| Device and usage: IP address, browser and device type, app version, push-notification token, error and security logs | Keep the Service secure and working, send notifications you turned on, fix problems | Legitimate interests (security and reliability); consent for push notifications |
| Website analytics (only if you allow it in the cookie banner): pages you visit on musemill.ai, clicks, browser and device type, rough location from your IP address (the IP address itself is not stored) | Understand how people use the website and where the sign-up steps are unclear, so we can improve them | Consent (you can withdraw it any time in Cookie settings) |
| QR page visits (pages behind our QR codes, like musemill.ai/go/laptop): that the page was opened or a button tapped, your device type and rough location (city, country). No cookies, nothing stored on your device and no IP address kept. Each count gets a new random ID, so it can't be linked to you | Count how many people scan our codes and which links they use | Legitimate interests (simple, anonymous counting) |
| Coffee requests (when you ask for a coffee on musemill.ai/go/laptop/coffee): your first name, the drink you pick, whether you're curious about MuseMill or just up for a chat, your business's Instagram name if you add it, whether you said you posted our Story picture (for a cupcake), and a one-way hash of your IP address. Your ticket is kept only in the page's web address, not on your device. The Story picture is made on your phone and never sent to us | Tell our founder you're coming and which drink to get (sent to the founder's phone through Telegram); stop one phone from asking many times | Legitimate interests (answering your request for a coffee; preventing abuse) |
| Agreement record: when you accepted our Terms, which versions, and one-way hashes of your email and IP address | Prove what we agreed with your business | Legitimate interests (establishing and defending legal claims); legal obligation |
| Messages: emails and support requests you send us | Answer you and improve the Service | Legitimate interests; contract |
| Waitlist and updates sign-ups: your email address, the business website if you add it, the date, your browser type and a one-way hash of your IP address | Email you when MuseMill opens (waitlist) or send the updates you asked for; stop bots signing up many times | Consent (ask us to remove you any time); legitimate interests (preventing abuse) |
| Product updates (only if you opt in) | Send tips and news about MuseMill | Consent (unsubscribe any time) |
We don't ask for sensitive data (such as health information), and you shouldn't put it in MuseMill. Health care providers must not enter patient information (see our Terms).
3. AI and automated processing
MuseMill uses AI (Google's Gemini and image models, through Google Cloud) to write captions and create images from your brand materials. Google processes this data on our behalf and does not use it to train its models. We don't train AI models on your content either.
Automated checks flag posts that may contain unverified claims so a person can review them. We don't make decisions about people that have legal or similarly significant effects based solely on automated processing.
5. International transfers
We are based in the EU, and several of our providers store or process data in the United States and elsewhere. When personal data leaves the EEA, UK or Switzerland, we protect it with the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) and, where the provider is certified, the EU-US Data Privacy Framework. You can ask us for a copy of the relevant safeguards.
6. How long we keep data
- Free previews that are not turned into an account: deleted after 7 days.
- Your account and workspace: while your account exists. After your plan ends we keep your workspace so you can come back or export it; you can delete it any time. If an account has had no plan and no sign-in for 24 months, we email you and delete it 30 days later unless you sign in.
- When you delete your account: we delete your workspace, content and connected-account data straight away, and remove it from backups within 30 days.
- Billing and tax records: as long as Romanian tax and accounting law requires (up to 10 years).
- Coffee requests: your first name and Instagram name are deleted after 90 days; what's left (drink, date, ticket number) can't identify you.
- Security and error logs: up to 90 days, unless needed to investigate an incident.
- Waitlist and updates sign-ups: until you ask us to remove you. Waitlist emails that don't become an account are deleted 12 months after MuseMill opens.
- Support emails: up to 3 years after the conversation ends.
- Agreement records (hashed, no email address): 3 years after your account ends.
8. Security
We protect data with encryption in transit (HTTPS) and at rest, strict access controls that keep each customer's data separate, least-privilege access for our team, hashing of identifiers we don't need to keep (like IP addresses for previews), and monitoring. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.
9. Your rights
Wherever you live, you can ask us to:
- access your data and get a copy, in a portable format;
- correct it, or delete it;
- restrict or object to how we use it, including to processing based on legitimate interests, and to any direct marketing;
- withdraw consent at any time (it doesn't affect what we did before);
- not be treated differently for using your rights.
Most of this you can do yourself: export and delete are in the app (Settings → Account) and on the web dashboard (Settings → Data & privacy). Otherwise write to privacy@musemill.ai from the email on your account. We answer within one month (GDPR) or the shorter or longer period your local law sets, and may need to confirm your identity first. You can use an authorised agent where your law allows.
Complaints. You can complain to a data protection authority. Ours is Romania's Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP); you can also contact the authority where you live or work. We'd appreciate the chance to fix things first.
10. Extra information for your region
United States. Depending on your state (for example California, Colorado, Connecticut, Virginia, Texas, Oregon), you have the rights in section 9 to know, access, correct, delete and port your data, and to opt out of sale, sharing for targeted advertising, and profiling. We don't sell or share personal data and don't do such profiling, so there is nothing to opt out of; we honour Global Privacy Control signals anyway. In the last 12 months we collected the categories in section 2 (identifiers, commercial information, internet activity, and professional information), from you, your devices and public websites you asked us to read, for the purposes listed there. If we deny a request you can appeal by replying to our answer; if you remain unhappy you can contact your state attorney general.
United Kingdom and Switzerland. You have the rights in section 9 under the UK GDPR and the Swiss FADP, and can complain to the UK ICO or the Swiss FDPIC.
Canada (including Quebec). Our privacy lead, reachable at privacy@musemill.ai, is responsible for protecting your personal information. Your data may be stored outside Canada, where it may be accessible to local authorities.
Brazil. You have the rights under the LGPD (art. 18). Our contact for data protection matters (encarregado) is reachable at privacy@musemill.ai.
Australia. We handle personal information under the Australian Privacy Principles. We do not use automated decisions that significantly affect your rights or interests.
India and other countries. You can exercise the rights your local law gives you by writing to privacy@musemill.ai.
11. Children
MuseMill is for businesses and is not meant for anyone under 18. We don't knowingly collect children's data; if you think we have, tell us and we will delete it.
12. Changes to this policy
If we change this policy in a meaningful way, we will email account holders and update the date at the top before the change takes effect.