Privacy Policy

When you sign in to Maowl, we store your account and online models within the EU. If you don't sign in, your models never leave your browser. Some other data, such as payments and email, is handled outside the EU, as we explain below.

Who is responsible

Maowl is run by Lantz Hedström Consulting AB (company registration number 559215-6557, VAT number SE559215655701), Fiskarfjärdsstranden 36, 127 41 Skärholmen, Sweden. We're the data controller for the personal data described on this page. You can send any request about your data to this postal address or to hello@maowl.app. We haven't appointed a data protection officer.

If an organization has bought a Team plan, it's the data controller for the personal data in its team models, and we process that data on its behalf under our Data Processing Agreement. To exercise your rights over data in a team model, contact that organization first.

If you sign in

We store the following:

• Your email address and the time your account was created. We use your email address to sign you in, to show who has access when a model is shared, and to email you sign-in codes, sharing notifications, and messages about your plan. If you continue with Google or Microsoft, or with your company's single sign-on, that provider gives us your email address and confirms it's yours; we ask for nothing else from your account there and store nothing else from it. We also store when you last signed in and how.
• Your sign-ins: for each browser you're signed in on, a hash (an irreversibly scrambled form) of the key that keeps you signed in, plus when you signed in and when the sign-in was last extended. Signing out of a browser deletes its sign-in.
• The models you save online: their name and everything in them, when they were created and last changed, and who changed them. A model can be opened only by you, the people you share it with, the AI assistants any of you have connected, and, for a team model, the person who manages the team. We can technically access models stored online, but we don't open or read them unless you ask us to, a report of illegal content makes it necessary, or the law requires it. Models you keep on your device stay in your browser.
• Earlier versions of those models, which you can view and restore. With each version, we store the time of its last change and the email addresses of the people who changed the model since the previous version.
• Your folders: the names of the folders you create in My models and which online models you've put in each one. Only you can see your folders.
• Comments and review status: the comments you and others write on a model online, who wrote each one and when, and who resolved a thread. For each model, its review status, who set it and when, who approved it, and the reviewers its owner named. Comments are stored beside the model, never in it, so they don't appear in its files or exports.
• Notification emails: when someone mentions you, replies in a thread you're in, or changes a model's review status, we keep a note of it until we email you, bundled into at most one email per model every 10 minutes. These emails name the person and link to the model; they never include the model's name or what a comment says. We also store the models you've turned these emails off for, or that you've turned them off for every model. Every email has a link to stop them.
• A Slack or Microsoft Teams channel, if a model's owner connects one: the channel's webhook address, encrypted, and when we last posted there. We post a short message when someone saves a new version, comments, or changes the review status. It contains the model's name, the email address of the person who did it, and a link to the model, and nothing else from the model.
• Your GitHub or GitLab connection, if you connect one to keep a model in a repository: your account name there and the access it granted us, encrypted. We never show that access to anyone, and Disconnect deletes it. For each model you link, we keep the repository, branch, and folder, and the address of the last pull or merge request.
• A live embed, if a model's owner turns one on: a secret address, encrypted, who turned it on and when, and the latest picture of the model. Anyone the owner gives the address to can see that picture, without signing in, but never the model itself. The owner can turn it off or get a new address at any moment, and the old address stops working at once.
• Who you share a model with: the email addresses you invite, and whether each person can edit or only view. Each person you invite receives one email letting them know you've shared a model with them, so please invite only people who expect to hear from you.
• AI assistants you connect: the name each assistant gives itself, the web addresses we send you back to after you allow it, when you allowed it, when it was last used, and hashes of the keys it uses. An assistant you allow works with your permissions: it can view your online models and the models shared with you, create models, and change the ones you can edit. Whatever it reads goes to the company behind the assistant (for example, Anthropic for Claude or OpenAI for ChatGPT) and is handled under that company's terms. We never send that company anything from your models except in answer to the assistant's requests. You can disconnect an assistant under Account.
• Abuse-prevention counters: how many sign-in codes were recently requested, how many sign-in attempts were made, and how many invitations were sent. They're stored under a hash of the email address or IP address, never the address itself, and they're deleted within two days.

Your account has no password. We don't store your IP address or how you use the app. When several people have the same model open, they see each other's selections and pointers live; we relay those but never store them.

If you don't sign in

Your models stay in your browser on your device, and nothing from a model is ever sent to our server. We don't set any cookies. If someone shares a model with you or gives you a Team seat, we store the email address they used.

If something goes wrong in the app, Maowl sends our server a short error report, whether or not you're signed in. The report contains the type of error, where in Maowl's code it happened, and your browser's name and version, such as “Chrome 141”. It never includes anything from a model, the error text, or anything that identifies you, such as your account, a cookie, or your IP address. Reports are deleted after 30 days, and nothing is sent to any other company. We also count how many models are created each day, and that count says nothing about who created them. Beyond that, there are no analytics, no tracking, and no ads.

If you buy a plan

Payments and invoices are handled by Stripe. You enter your card or other payment details, billing address, and any VAT number on Stripe's pages, so they go straight to Stripe and never reach us. If your company pays by invoice, we pass the company details you enter in Maowl on to Stripe without storing them. Stripe's privacy policy explains how it handles this information.

We store your plan and its status, whether it's billed monthly or yearly, whether you pay by invoice, when any payment became overdue, the number of seats, when the plan renews or ends, Stripe's IDs for you and your subscription, and, on a Team plan, the email addresses you give seats to. We use these details only to run your plan. When you delete your account, we cancel your plan at Stripe and delete these details. We and Stripe keep the payment and invoice records the law requires us to keep.

If you have a seat on a Team plan, the models you save online while you hold that seat belong to the team. The person who manages the team can open, share, and delete them, and if your seat is removed or you delete your account, those models move to that person. Models you saved before you had the seat stay yours.

If you email us or report illegal content

• Email to us. We store the message and your email address so we can answer you. The section on who receives your data explains where the message goes.
• Reporting illegal content. If you use the report form, we store your name, your email address, where the content is, your explanation, and when we received it. We don't give your name or email address to the person you've reported, unless the law requires it.

Why we store your data, and on what legal basis

• Providing the service you signed in for or bought (Article 6(1)(b) GDPR): your email address, your sign-ins, your online models and their earlier versions, your folders, your sharing settings, the AI assistants you connect, and the details of any plan you buy.
• Answering you: email about your account or plan comes under Article 6(1)(b). Any other email comes under Article 6(1)(f), our legitimate interest in answering the people who write to us.
• Meeting a legal obligation (Article 6(1)(c)): payment records and invoices, under the Swedish Bookkeeping Act (bokföringslagen, 1999:1078), and the receipts we send for reports.
• Handling reports of illegal content (Article 6(1)(c) and (f)): the Digital Services Act requires us to receive and decide on reports. Our legitimate interest in keeping them is being able to respond to complaints and to inquiries from authorities.
• Keeping the service safe and working (Article 6(1)(f)): abuse-prevention counters and error reports. Our legitimate interest is protecting the service, finding bugs, and keeping people from getting unwanted email.

We don't use your data for anything else, we never sell it, and we share it only as described on this page. You don't have to give us any personal data, though you need an email address to sign in or to receive a receipt. We don't make automated decisions about you or use profiling.

If your company uses a Team plan

If you have a seat on a Team, or your email address is at a domain a Team has verified, the person who manages that Team can see when you last signed in and how, sign you out on every device, and read the team's audit log. The log records sign-ins and what's done with the team's models, seats, and settings: who did it, when, and to which address or model, with a model's name but never its content. Entries are deleted after a year. For team models, your company is the data controller, as our Data Processing Agreement explains.

Cookies

When you sign in, we set a cookie called __Host-maowl_session. It keeps you signed in, can't be read by scripts, and is sent only to maowl.app. Signing in doesn't work without it. While you're signing in with Google, a second cookie, __Host-maowl_google, links Google's answer to your browser. Signing in with Microsoft or your company's single sign-on uses __Host-maowl_oidc the same way, and connecting GitHub or GitLab uses __Host-maowl_git. Each is deleted as soon as the provider answers, or after 10 minutes at the latest. We don't use any other cookies.

Where your data is stored

Maowl runs on Cloudflare, which stores your account and online models in EU data centers under its data processing agreement. Backups stay in the EU too. All data is encrypted in transit and at rest.

Who receives your data, and when it leaves the EU

When data goes to a company outside the EU or EEA, we state what protects the transfer.

• Cloudflare, Inc. (United States) hosts Maowl. Stored data stays within the EU, but each request is handled at the Cloudflare data center nearest you, which may be outside the EU, so your IP address and what you send can pass through it on the way. The emails we send from hello@maowl.app, and email sent to any @maowl.app address, also go through Cloudflare, which receives the sender's and recipient's addresses and the message in order to deliver it. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which is covered by the European Commission's adequacy decision (EU) 2023/1795. If that certification ends, the Commission's standard contractual clauses in Cloudflare's data processing agreement apply.
• Stripe handles payments through Stripe Technology Europe, Limited in Ireland and Stripe, LLC in the United States. For some of this, Stripe processes data on our behalf; for the rest, such as fraud prevention, Stripe is the data controller under its own privacy policy. For transfers to the United States, Stripe relies on the EU-U.S. Data Privacy Framework and the same adequacy decision, and on standard contractual clauses, as set out in its Data Transfer Addendum.
• Google. When you email an @maowl.app address, we keep a copy on our server for 30 days and forward the message to our Gmail account. Reports of illegal content reach us the same way. When you choose Continue with Google, you sign in on Google's page in a separate window. Google Ireland Limited provides Gmail and Google sign-in under its terms and privacy policy, and may transfer data to Google LLC in the United States under the EU-U.S. Data Privacy Framework and the same adequacy decision. Our pages never load anything from Google.
• Microsoft. When you choose Continue with Microsoft, you sign in on Microsoft's page in a separate window. Microsoft Ireland Operations Limited provides Microsoft sign-in under its terms and privacy statement, and may transfer data to Microsoft Corporation in the United States under the EU-U.S. Data Privacy Framework and the same adequacy decision. Our pages never load anything from Microsoft.
• Your company's sign-in. If your company's Team uses its own identity provider, you sign in on that provider's page, which your company chooses and is responsible for. We receive only your email address from it.
• Anthropic. We use Claude, Anthropic's AI assistant, to help us read email sent to an @maowl.app address. Anthropic Ireland, Limited processes those messages under its terms, and states in its privacy policy that transfers outside the EU rely on adequacy decisions and standard contractual clauses.
• The AI design review. When you're signed in and click Review design, we send the structure of the open model to Anthropic, PBC, through its API so its AI can review the design: table and column names, data types, keys, indexes, CHECK rules, defaults, descriptions, the text of your notes, and what Maowl's design checks found. Nothing else from the model or your account goes with it, and for a model on your device you confirm first. Neither we nor the review keep a copy, and under Anthropic's commercial terms it isn't used to train AI models. Anthropic processes it in the United States under the EU-U.S. Data Privacy Framework and standard contractual clauses. A Team's manager can turn the review off for the team, and each review by a team member is noted in the team's audit log, without its content. The design checks themselves run in your browser and send nothing.
• AI assistants you connect. An assistant gets nothing until you connect it and allow access. If someone you share a model with connects an assistant, it can read that model too. Anything an assistant reads goes to the company behind it, which may be outside the EU or EEA. Whether an adequacy decision or other safeguard applies depends on the company you choose, so check its privacy terms before you connect its assistant. We have no contract with those companies for these assistants.
• Slack or Microsoft. If a model's owner connects a Slack or Microsoft Teams channel, the messages we post there (the model's name, the email address of the person who acted, and a link) go to Slack or Microsoft and are handled under the terms of the owner's workspace. We have no contract with those companies for these messages, and they may process them outside the EU or EEA.
• GitHub or GitLab. If you connect GitHub or GitLab and save a model there, our server sends the model, its CREATE TABLE script, and its change script to the repository you chose, as a pull or merge request, and reads the model back when you update from it. What's in the repository is handled under the terms of your GitHub or GitLab account, possibly outside the EU or EEA. We have no contract with those companies for it. Nothing is sent until you connect an account and save.
• People you work with. Everyone you share a model with can see it and each other's email addresses. The person who manages a team can see its team models.
• Authorities and courts, when the law requires it.

The companies that process personal data on our behalf are listed on our sub-processors page.

How long we keep your data

• A sign-in code can be used for 10 minutes and is then deleted.
• A sign-in stops working 30 days after it was last extended and is then deleted.
• A model saved online is stored until you delete it. A deleted model moves to Recently deleted in My models, where you can restore it for 30 days. After that, it's deleted for good. To delete it sooner, choose Delete forever.
• A folder is stored until you delete it or delete your account.
• A live embed and its picture are stored until the owner turns the embed off, or the model is deleted.
• Comments and a model's review status are stored until they're deleted, or until the model is deleted for good. Deleting your account deletes the comments you wrote. A note of something to email you about is deleted once the email is sent, or after seven days.
• Earlier versions: every version from the last 24 hours, the last one of each day for the past 30 days, and the last one of each week before that, up to 100 per model. We delete the others. A model's versions are deleted when the model is deleted for good.
• An AI assistant's access is stored until you disconnect the assistant, or until 30 days after it last used Maowl, whichever comes first.
• Your account is stored until you delete it.
• Email you send us: the copy on our server is deleted after 30 days. The forwarded message stays in our Gmail account for as long as we need it to answer you and handle any follow-up.
• Reports of illegal content are kept for two years, even if you delete your account.
• Payment records and invoices are kept for seven years after the end of the calendar year in which the financial year ended, as the Swedish Bookkeeping Act requires.
• Error reports are deleted after 30 days.
• In case something goes wrong, we keep backups of every account and every model saved online in separate Cloudflare storage within the EU. Models are backed up shortly after they change, and accounts every night. Each backup is deleted after 35 days, so anything that's deleted for good can remain in backups for up to 35 days, and in Cloudflare's recovery data for up to 30 days. After that, it can't be restored.

Your choices and rights

• Delete. You can delete an online model in My models, then choose Delete forever under Recently deleted. You can delete your whole account under Account in the app. Deleting your account removes your email address, your sign-ins, your folders, every online model you own (team models move to the person who manages the team), your access to models others have shared with you, and every AI assistant's access. The section above lists what we keep after that.
• Take your data with you. You have the right to data portability. Save any model as a JSON file, or bring an online model into your browser with Copy to this device. Email us for the rest of your account data, and we'll send it as JSON. Our switching page has the details.
• Ask. You have the right to know what personal data we store about you, to have it corrected or deleted, to have its processing restricted, and to object to any processing based on our legitimate interests. To exercise these rights, email hello@maowl.app or write to our postal address at the top of this page.
• Complain. If you believe your data is being handled improperly, you can file a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se.

More detail

For the technical details of how we protect your data, see our security page.

Last updated November 3, 2026.