01Who we are
Master is operated by [Company legal name], [Registered address, ID number] ("Master", "we", "us"). We are the controller of personal data described in this policy. For apps you build on Master Cloud, you are the controller of your end users' data and we act as your processor (see the Data Processing Addendum).
Questions about privacy: [privacy contact e-mail].
02Data we collect
We collect only what we need to provide and improve Master.
- Account data: name, e-mail address, password hash, profile picture and workspace membership.
- Project data: prompts, chat messages, generated code, uploaded files, images and app settings.
- Billing data: plan, invoices and payment status. Card details are handled by Stripe and never stored by us.
- Usage data: credit consumption, feature usage, error logs, device and browser type.
- Communications: messages you send through contact forms or support.
- Advertising data: with your consent, cookie identifiers used by Meta to measure ad visits and signups.
03How we use data
We use personal data to:
- Create and secure your account and workspace.
- Run the AI builder, preview, publishing and Master Cloud.
- Measure usage, charge credits and send invoices.
- Send service e-mails such as confirmations, invites and invoices.
- Prevent fraud, abuse and security incidents.
- Measure advertising performance, only where allowed by your cookie choice.
04Legal bases
Under the GDPR we rely on: performance of a contract (providing the service), legitimate interests (security, product improvement, fraud prevention), legal obligations (tax and accounting records) and consent (advertising cookies). You can withdraw consent at any time without affecting earlier processing.
05AI processing
Prompts and project context are sent to AI model providers to generate responses. We do not use your private projects to train our own models, and we select providers that do not train on API data.
07International transfers
Some providers process data outside the EEA. Where this happens we rely on adequacy decisions or the EU Standard Contractual Clauses.
08Retention
Account and project data is kept while your account is active. When you delete a project or account, we delete the data within 30 days, except backups (rotated within 90 days) and records we must keep by law, such as invoices.
09Your rights
You can request access, correction, deletion, restriction, portability, or object to processing. You can also lodge a complaint with your local data protection authority. Many actions are available directly in Settings; for anything else contact us.
10Security
We isolate projects, encrypt secrets and restrict internal access. See our Security page for details. No system is perfectly secure, so please report suspected issues promptly.
11Children
Master is not intended for children under 16. We do not knowingly collect their data.
12Changes and contact
We will announce material changes on this page and, where appropriate, by e-mail. Contact: [privacy contact e-mail].