Privacy Policy

This policy covers two different surfaces, because they collect different things: the mado product (Studio, your account) and the embedded player that renders on your viewers' devices. See also the technical page on privacy in the embed.

The embed sets no cookies

The player never writes a cookie and never uses localStorage or IndexedDB. Session identity for a viewer is a random id generated fresh on each page load and held only in memory. Unique-viewer counts are computed server-side from a daily-rotating hash of (IP address + user agent + demo id); the raw inputs are never stored, only the hash, and only long enough to deduplicate same-day views.

What we collect from a demo viewer

• Interaction events (step views, taps, completion) tied to a per-load session id;
• A coarse device class (phone / tablet / desktop);
• The referring page and embed host;
• An approximate, city-level location derived from IP, which is not stored.

What we collect from a Studio user

Your account email, workspace membership, and the Content you upload. We use a magic-link and optional Google sign-in; we do not store passwords.

Payments

Paid plans are sold through Link, Stripe's reseller, which acts as merchant of record. When you buy one, your name, email, billing address and payment details go to Stripe and Link, which process them as the seller under their own privacy policy, and work out and collect any tax. We receive the state of your subscription, never your full card details.

Where data is hosted

EU company, EU-hosted. We do not claim formal data residency guarantees beyond that until Enterprise data residency ships as a product — see our subprocessor list.

Optional AI features

AI assist (automatic step names, tooltips and titles, and one-click translation) is off until a workspace owner or admin turns it on. When it is on, the screenshots and recognised text of new recordings are sent to Anthropic, PBC, in the United States, to generate that text. Emails, phone numbers, card numbers and similar identifiers are removed from the text before sending; the screenshots are sent as recorded. Anthropic does not use this data to train its models. Transfers are covered by Standard Contractual Clauses. Turn AI assist off at any time in Settings; recordings uploaded after that are not sent.

Voice & music (generated narration, background music and sound effects for watch mode) is likewise off until a workspace owner or admin turns it on. When it is on, narration text you write or accept and the short style prompt behind a demo's music are sent to ElevenLabs Inc., in the United States, to generate audio — never a screenshot, and never the raw text of a personalisation placeholder. ElevenLabs does not use this data to train its models. Transfers are covered by Standard Contractual Clauses. Turn Voice & music off at any time in Settings; demos edited after that generate no further audio.

Your rights

You can export or delete your account data at any time. Deletion requests are honoured within 30 days.

Contact

Questions about this policy: contact us.