Privacy Policy

Mashu is operated by Yurumi, which is the data controller for the personal data described here:

• Legal name: Yurumi
• Organisation number: 971102-5701
• Registered address: Borgg. 5, Ske-hamn, Sweden
• Contact for privacy matters: hey@mashu.io

We have not appointed a Data Protection Officer, as we are not legally required to. You can raise any data question at the address above.

This policy covers personal data we process about the people who visit our site, create an account, or use Mashu. It should be read together with our Terms of Service.

When you connect a third-party account (for example Google Analytics or Instagram), we also process data from that account as described in section 5. Those third parties have their own privacy policies that govern their handling of your data.

We collect:

• Account data — your name, email address, and login credentials (including via Google sign-in, if you use it).
• App & content data — the URLs and app details you submit, the goals and answers you enter, and the tasks, drafts, notes and progress you create in Mashu.
• Connected-account data — metrics and profile data we read from analytics and social accounts you choose to connect, plus the access tokens needed to do so.
• Payment data — handled by our payment processor Stripe. We receive limited billing details (such as plan, status, and the last digits of your card); we do not store full card numbers.
• Usage & device data — how you interact with Mashu, IP address, browser and device information, and cookie identifiers (see section 6).
• Communications — messages, feedback and support requests you send us.

We process personal data only where we have a lawful basis under the GDPR:

• To provide Mashu — running your reviews, plan, tasks, integrations and benchmark, and managing your account and subscription. Basis: performance of our contract with you (Art. 6(1)(b)).
• To take payment — billing and preventing fraud. Basis: contract, and our legitimate interest in secure payments (Art. 6(1)(b), (f)).
• To improve and secure the Service — analytics, debugging, and protecting against abuse. Basis: our legitimate interest in a reliable, secure product (Art. 6(1)(f)).
• To communicate with you — service messages, and (only with your consent) marketing. Basis: contract, legitimate interest, or consent (Art. 6(1)(a)).
• To meet legal obligations — accounting, tax and responding to lawful requests. Basis: legal obligation (Art. 6(1)(c)).

Providing your account and payment data is necessary to enter into and perform our contract; without it we cannot provide paid features. You can object to processing based on legitimate interests, or withdraw consent, at any time (see section 10).

If you connect a third-party account — such as Google Analytics, Google Search Console, or Instagram — we access only the data needed to ground your plan and benchmark (for example traffic, search and engagement metrics), and we store the access tokens securely. We use this data solely to provide Mashu to you; we do not use it for advertising and do not sell it.

You can disconnect any integration at any time from your workspace settings, which revokes our ongoing access. Your use of those services remains governed by their own terms and privacy policies (for example Google's and Meta's).

We use cookies and similar technologies that are necessary to run the site and keep you signed in, and — where required, with your consent — analytics cookies that help us understand and improve usage. For our own website analytics we use Google Analytics; these analytics cookies are set only with your consent, and you can manage non-essential cookies through our cookie controls and your browser settings.

We also use Google Search Console to understand how our own site performs in Google Search. Search Console reports on Google's own search data about our site and does not place cookies on your device.

We do not sell your personal data. We share it only with service providers (processors) that help us run Mashu, under contracts that require them to protect it and use it only on our instructions:

• Base44 (Base44, Inc., a US company) — our application platform, hosting, storage and AI infrastructure. Your Mashu account and app data are stored in Base44's EU region (see section 8). Base44 acts as our processor and engages its own sub-processors (including MongoDB, Google Cloud, OpenAI and Anthropic for AI, and SendGrid for email). See Base44's Data Processing Agreement, sub-processor list and security measures.
• Stripe (US) — payment processing.
• Google Analytics (US) — measures how visitors use our own website so we can improve it (see section 6).
• Google & Meta — only where you connect those accounts, to read the metrics you authorise.

We may also disclose data where required by law, to protect our rights, or as part of a corporate transaction (such as a merger), with appropriate safeguards.

Your Mashu account and app data are stored on servers in the European Union. We use our platform's EU data-residency option so that the personal data you and your users put into Mashu is hosted within the EU/EEA.

A limited part of the processing is still carried out by specialised providers located outside the EU/EEA, primarily in the United States — for example AI/LLM providers (which generate reviews, tasks and drafts), email delivery, and product analytics. Where personal data is transferred outside the EU/EEA for these purposes, we rely on the safeguards required by the GDPR — such as the European Commission's Standard Contractual Clauses, the EU–US Data Privacy Framework, or a transfer to a country with an adequacy decision. You can request more information about these safeguards using the contact details in section 15.

We keep personal data only as long as needed for the purposes above. Account and content data are kept while your account is active and for a reasonable period afterwards; when you delete your account we delete or anonymise your data, except where we must retain certain records (for example invoices for accounting and tax law, typically seven years in Sweden). Backups are deleted on a rolling schedule.

Under the GDPR you have the right to: access your data; have it corrected or deleted; restrict or object to processing; receive your data in a portable format (portability); and withdraw consent at any time (without affecting processing already carried out).

To exercise any of these, email hey@mashu.io. We will respond within the time limits set by the GDPR (normally one month). If you believe we have handled your data unlawfully, you also have the right to lodge a complaint with the Swedish Authority for Privacy Protection — Integritetsskyddsmyndigheten (IMY), imy.se — or your local supervisory authority.

We and our providers use industry-standard technical and organisational measures — including encryption in transit, access controls, and secure hosting — to protect personal data against unauthorised access, loss or misuse. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authority of a data breach where the law requires.

Mashu is not intended for children. You must be at least 16 to use it, and at least 18 to purchase a paid plan. We do not knowingly collect personal data from anyone under 16; if you believe a child has provided us data, contact us and we will delete it.

Mashu uses AI models (provided through our infrastructure partners) to generate reviews, tasks, drafts and recommendations from the data you provide. This processing supports your decisions; we do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Your content may be sent to these AI providers to generate outputs, but is not used by us to train third-party models for their own purposes.

We may update this policy from time to time. We will post the updated version here and, for material changes, give you reasonable notice by email or in-app. The “last updated” date shows when it last changed.

Questions or requests about your data? Email hey@mashu.io, or write to Yurumi, Borgg. 5, Ske-hamn, Sweden. You may also contact IMY (imy.se), the Swedish data-protection authority.