1. Scope and relationship to Customer
This MEGA(X) Studio Privacy Notice explains how MEGA(X) collects, uses, discloses, retains, and protects personal information in connection with MEGA(X) Studio (the “Service”). It supplements the privacy information published in the MEGA(X) Terms and Conditions.
For account, billing, website, security, and support information, MEGA(X) generally determines how and why information is processed. For personal information contained in Customer Content, MEGA(X) generally processes that information on behalf of the Customer organization. In that context, users should direct privacy requests to their organization, and MEGA(X) will assist the organization as required by applicable law and contract.
2. Information we collect
- Account and profile information: name, work email, password hash, job title, department, organization, country or region, role, and account status.
- Workspace and Customer Content: workflows, prompts, notes, governance records, linked media, configurations, selected platforms, AI inputs and outputs, and files or information users choose to provide.
- Usage and device information: session, feature interaction, timestamps, approximate network information, browser or device information, request metadata, and diagnostic or security events.
- Administration and billing information: company profile, plan, seats, billing contact, subscription status, invoices or processor identifiers, and administrator actions. Payment-card details, when supported, are handled by the applicable payment processor rather than stored directly in the Service.
- Support and communications: messages, feedback, requests, and information supplied when contacting MEGA(X).
- Third-party connection information: provider selection, connection status, encrypted customer-supplied API credentials, and information transmitted through integrations at the user’s direction.
3. How we use information
MEGA(X) uses information to provide and operate the Service; authenticate users; isolate company workspaces; save and export workflows; provide AI-assisted features selected by users; administer accounts, subscriptions, and support; secure and troubleshoot the Service; prevent fraud and abuse; communicate service updates; comply with law; enforce agreements; and understand and improve reliability and usability.
MEGA(X) does not sell personal information. MEGA(X) does not use Customer Content to train a general-purpose AI model. Aggregated or de-identified information may be used to understand and improve the Service where it cannot reasonably identify a person or Customer.
4. AI providers and integrations
When a user invokes an AI-assisted feature, the Service may send the prompt, relevant workflow context, and technical instructions to the provider the user or Customer selected, such as OpenAI or Anthropic. When a Customer uses its own provider key, that provider processes the request under the Customer’s provider account and settings. Provider retention and data-use practices are governed by the Customer’s arrangement with that provider.
When users add external links or configure integrations, the relevant third party may receive information needed to perform the requested action. MEGA(X) does not control independent third-party services and encourages Customers to review their terms, permissions, and privacy practices.
5. How information is disclosed
MEGA(X) may disclose information:
- to infrastructure, database, caching, transactional email, security, support, billing, and other service providers that process information for MEGA(X);
- to AI providers and integrations at the Customer’s direction;
- to authorized Customer administrators who manage the workspace and its users;
- to professional advisers, auditors, insurers, or transaction counterparties subject to appropriate confidentiality protections;
- when required by law or reasonably necessary to protect rights, safety, security, or the integrity of the Service; and
- in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable law.
6. Cookies and local storage
The Service uses an essential, secure session cookie to keep users authenticated. It also uses browser storage for functional preferences such as canvas theme, navigation size, and interface state. These technologies are used to provide requested functionality and security, not to sell personal information or run cross-site behavioral advertising.
7. Retention and deletion
Account information and Customer Content are retained while needed to provide the Service and for legitimate security, support, legal, and business purposes. Workflows moved to Trash are scheduled for permanent deletion after 14 days. Pending signup and anti-abuse records expire or are maintained according to their operational purpose.
After account termination or a valid deletion request, information is deleted or de-identified in accordance with operational and backup cycles unless retention is required by law, needed to resolve disputes or enforce agreements, or requested by the Customer that controls the data.
8. Security
MEGA(X) uses administrative, technical, and organizational safeguards designed to protect information, including tenant scoping, access controls, password hashing, encrypted transport, protected session cookies, audit records, and encryption for stored customer-supplied provider credentials. No system can guarantee absolute security. Customers are responsible for user access, credential protection, integration permissions, and the information they choose to submit.
9. International processing
MEGA(X) and its service providers may process information in the United States and other countries where they operate. Where required, MEGA(X) uses contractual or other recognized safeguards for cross-border transfers. Customers with specific data-location or processing requirements should contact MEGA(X) before submitting regulated data.
10. Privacy choices and rights
Depending on location, individuals may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal information, and to appeal or complain to a privacy regulator. MEGA(X) will verify requests and may retain information where permitted or required by law.
Users whose account is managed by a Customer organization should first submit requests to that organization. Other requests may be submitted through the MEGA(X) contact page. Authorized agents may submit requests where allowed by law, subject to verification.
11. Children
The Service is designed for business users and is not directed to children. Users must be at least 18 years old or the age of legal majority required to enter into a business agreement in their location. MEGA(X) does not knowingly collect personal information from children through the Service.
12. Changes to this notice
MEGA(X) may update this notice to reflect changes in the Service, law, or data practices. The effective date will be updated, and material changes will be communicated in the Service or by another appropriate method before they take effect where required.