Privacy Policy

1. Scope and contact

Munito AI France operates Munito. It is a French SAS with a share capital of €1,000, registered with the RCS Paris under number 131 309 247, at 229 rue Saint-Honoré, 75001 Paris, France. This policy covers the Munito website, account services, console, and inference API.

For privacy questions or rights requests, contact legal@munito.ai.

Munito AI France acts as controller for account, security, support, and usage data. For customer content processed on your instructions, it acts as processor.

2. Information and purposes

• Account information: your email, password hash or sign-in provider identifier, organization details, and verification status support account access.
• Social sign-in: Google or GitHub provides an account identifier, email, and email verification claim. Munito does not receive your social account password.
• Phone verification: when required, your number, verification status, and delivery metadata support verification and abuse prevention. Twilio receives the number for carrier checks and SMS delivery. Munito stores a keyed number hash and the last four digits.
• Security information: session identifiers, IP addresses, device information, and access events help protect accounts and investigate abuse.
• Usage information: model IDs, timestamps, token or page counts, request status, and key identifiers support metering and service operation.
• Support information: messages and contact details let us respond to your requests. Do not include API keys or passwords in support messages.
• Billing information: where a paid offer applies, agreed fees and transaction records support billing and legal obligations.
• Visit information: the pages that you open and, on the public sites, the links and buttons that you click show how visitors use the sites. Section 7 explains how Munito counts visits without cookies.
• Sign-up source: when you create an account after a visit to munito.ai or the documentation, Munito records the page that you came from, the name of the site that linked to it, and any campaign tags in its address. Munito uses this to measure which pages bring new customers. It records no full referring address and no IP address for this purpose.

Required account fields enable access. If you decline a required verification step, access remains restricted. Optional sign-in methods remain your choice.

3. Inference content and your region

Munito processes prompts, documents, images, and outputs to fulfill your requests. Munito does not use this content to train models.

Zero data retention is the default for transient inference. Munito removes temporary request artifacts after delivery.

For requests that select EU or US residency, Munito performs model inference and stores customer content in that jurisdiction. Global requests have no geographic restriction.

When you opt in to overflow with the munito-overflow header, an inference provider that Munito selects can process a chat request that Munito’s own capacity cannot serve. For an EU request, that provider is a company based and regulated in the EU. It keeps no request content and does not use it to train models.

Cloudflare provides only DNS for Munito’s domains. Website, console, and API traffic goes directly to Munito’s servers, and TLS terminates there: in the EU for the website, the console, and the EU and global endpoints, and in the US for the US endpoint. Cloudflare does not receive or decrypt request content.

Account, verification, security, support, and usage records have separate purposes, locations, and retention criteria.

Features that explicitly store content, such as reusable files or stored responses, have separate lifecycles. Check the selected feature before you submit data.

When Munito processes personal data on your behalf, the Data Processing Agreement applies. It forms part of the Terms of Service. Your lawful instructions and that agreement govern processor activities.

4. Legal bases

Where the GDPR applies, account and service delivery rely on steps you request before a contract or performance of that contract.

Security, abuse prevention, visit counts, and necessary operational records rely on legitimate interests, subject to your rights. Measuring which pages bring new accounts relies on legitimate interests. Applicable legal obligations can require specific records or disclosures.

Optional activities that require consent use a separate choice. You may withdraw consent without affecting lawful processing before withdrawal.

Reading this policy is not consent to unrelated marketing or optional data use.

5. Providers and disclosures

Infrastructure, network security, transactional email, and support providers process information needed to deliver their services.

Google or GitHub processes information under its own policy when you choose social sign-in. Azure Communication Services processes verification email delivery information. Twilio processes SMS delivery information. PostHog counts visits to the sites in its EU region, as section 7 explains.

Munito may disclose information when the law requires it or when necessary to protect rights and security. Munito does not sell personal data.

Cloudflare Turnstile runs abuse checks on sign-up, sign-in, phone verification, and the contact and support forms. It processes browser and network signals, not inference content. Turnstile and account or verification services can process data outside the selected inference jurisdiction. Any restricted international transfer requires an applicable legal mechanism and appropriate safeguards.

Contact support for information about the providers, processing locations, and transfer safeguards that apply to your service.

6. Retention and deletion

• Inference content: follows the selected retention mode and the lifecycle of any storage feature you use.
• Account information: remains while needed to provide your account. After closure, only information needed for legal duties, security, or disputes should remain.
• Verification and security records: remain for the period needed to prevent abuse, protect accounts, and investigate incidents. A keyed number hash remains after account closure to prevent and investigate free-tier abuse.
• Usage, billing, and support records: remain as needed for service administration, applicable record duties, and unresolved requests or disputes.
• Visit counts: PostHog keeps the visit events for up to 7 years. They hold no visitor ID that lasts beyond one day.

An organization owner can delete the organization and their account in the console settings. Account data leaves active systems within minutes and leaves backups within 30 days. Stored files and responses expire within 30 days, and leave backups within 30 more days. Usage and billing records remain without your email address.

7. Cookies and browser storage

Session and security cookies support sign-in and protect account actions. The site also stores interface preferences, such as your theme, in your browser.

The playground keeps your chats and their attachments in this browser, so they remain across reloads. You can delete a chat, or clear the whole history, in the playground.

Browser copies are separate from server retention. Clear the playground history or the site’s browser data to remove those copies.

Authentication can use an anti-abuse check. Its provider may process technical information to distinguish automated abuse from legitimate requests.

Munito sets no advertising or analytics cookies. Each cookie and storage key below is needed for sign-in, security, or a setting that you use, so none requires your consent.

Munito counts visits to its sites with PostHog, in PostHog’s EU region in Frankfurt, without cookies or browser storage. PostHog makes an anonymous visitor ID from a hash of your IP address, your browser’s user agent, the site’s host name, and a random value that changes each day. PostHog deletes that value after the day, so the ID cannot link your visits across days. Munito does not link a visit to your account.

On the public sites, the count includes the pages that you open and the links and buttons that you click. In the console, it includes the pages that you open, and each sign-up with its method, new API key, and credit purchase. Each event also carries the referring site, your browser and operating system, your screen size, your language, and your time zone. Page addresses leave your browser without their query strings, except campaign tags. If your browser sends Do Not Track or Global Privacy Control, Munito does not load the counter.

8. Your rights

Depending on applicable law, you can request access, correction, deletion, restriction, or a portable copy of your personal data.

You may object to processing based on legitimate interests and withdraw consent for consent-based processing. Rights can have legal conditions or exceptions.

Delete your account in the console settings, or email support to submit a request. We may request proportionate information to confirm your identity before disclosure or deletion.

Where the GDPR applies, we will respond within one month or explain a permitted extension within that period.

You can complain to a competent data protection authority. The European Data Protection Board lists EU authorities.

If your request concerns content another organization submits, contact that organization as controller. We will assist it where required.

9. Security and eligibility

Munito uses encrypted connections, access controls, password hashing, and restricted administrative access. No security measure eliminates all risk.

Required incident notices follow applicable law. Contact support promptly if you suspect a security issue.

Accounts are intended for adults aged 18 or over. Contact support if a child provides account information.

10. Changes

Material changes will carry a revised date and notice where required. This includes changes to the operator, data purposes, or relevant providers.