Privacy Policy

This policy explains what personal data mado handles, why, and what you can do about it. It covers our website (mado.show), the Studio app (studio.mado.show), the demo player, the in-app help script, the mado capture extension for Chrome and our analytics endpoint (t.mado.show).

1. Who we are

mado is run by MPCSI, MB, a Lithuanian mažoji bendrija (small partnership), company code 306109625, registered at Liepyno g. 2-51, LT-08108 Vilnius, Lithuania (“we”, “us”). For anything about privacy, write to hello@mado.show. We are a small company and have not appointed a data protection officer; the same people who run the service answer that inbox.

2. Two roles

• We are the controller for data about our own customers and visitors: Studio accounts, billing state, emails you send us, reports about demos, and visits to our website.
• We are a processor for data our customers put into mado or collect through it: the recordings and demos they upload (which may show people), the analytics about people who view their demos or use their help hub, and the details viewers type into a demo’s lead form. The customer decides what is recorded and shared, and our Data Processing Addendum governs how we handle it. If you viewed someone’s demo and have a question about your data, the company that shared the demo is the one to ask first. We will help them answer.

3. What we collect, why, and on what legal basis

Studio accounts

• Your email address, name and profile picture if you sign in with Google, the workspaces you belong to and your role in each. Needed to run your account (contract, GDPR art. 6(1)(b)).
• Sign-in: we send a one-time link by email that expires after 15 minutes, or you use Google sign-in. We never store a password. Each signed-in session keeps the IP address and browser user agent it started from, so you and we can spot a session that should not be there (legitimate interest in security, art. 6(1)(f)). Sessions expire after 30 days.
• What you create: recordings, screenshots, scans (the screenshots and text outlines of your app’s screens), apps (the projects that group an app’s scans), the notes and rules you write for the Helper, demos, promo films, narration, uploaded fonts, settings, tracked links, help hubs, and the names of the folders and tags you sort them with. Folders and tags are for your workspace in Studio only and are never published. We hold these as your processor (section 2).
• A record of important actions in a workspace, such as who deleted a demo or changed a setting (legitimate interest in security and in resolving disputes, art. 6(1)(f)).
• Email about your account: sign-in links, workspace invitations, a welcome message, “your demo is ready” and the viewer alerts you turn on (contract). We do not send marketing email.

Paid plans

Paid plans are sold through Link, Stripe’s reseller, which acts as merchant of record. When you buy, your name, email, billing address, tax details and payment details go to Stripe and Link, which process them as the seller under their own privacy policies and work out and collect any tax. We receive the state of your subscription (plan, seats, renewal date, status) and Stripe’s customer and subscription ids, never your full card details (contract).

People who view a demo (customers’ viewers)

We process this as our customer’s processor. For each view we record:

• The interactions in the demo: steps reached, clicks and taps, where a tap missed, watch and sound controls, completion. Each is tied to a random session id that the player makes on every page load and keeps only in memory.
• The page the demo was embedded in or linked from, and a label if the viewer arrived through a tracked link (for example ?for=acme). The label names who the creator made the link for; the customer chooses it.
• Device class (phone, tablet or desktop), operating system and browser family, worked out from the user agent. The user agent itself is not stored.
• Country, when the network in front of our server supplies it. We do not record city or any finer location.
• A viewer hash, used to count unique viewers without cookies: a keyed hash of the IP address, user agent and demo, whose key changes every day at midnight UTC. We never store the IP address or user agent themselves. The hash is kept with the view record, but it cannot be matched across days or across demos, and it cannot be worked back to an IP address without our secret key.
• Whether the visit looks automated, with a reason. Automated visits are flagged, not deleted, so counts stay honest.

The player sets no cookies and writes nothing to the viewer’s device. We do not identify companies from IP addresses and do not build profiles across sites.

People who fill in a demo’s lead form

A customer on a paid plan can add a short form to a demo that asks for an email address, a name and a company (any of the three). The form says who the details are shared with and links the customer’s own privacy policy when they give one. The customer is the controller of what you type and decides what to do with it; we are their processor. When you send the form we keep, with the view it belongs to: what you typed (trimmed and limited in length), when, the demo and version, the tracked-link label if the link had one, and the same daily viewer hash as above. We use it only to show it to the customer in Studio, in a CSV they download, and in the Slack or email alerts they turn on. The interaction record keeps only which fields were filled in, never their contents. At most five forms a day are accepted from one viewer on one demo. A form sent from a visit that looks automated is kept flagged and never shown or alerted. If you skip the form, nothing you might have typed is sent.

People who use a customer’s help hub

When a customer adds our help script to their app or uses a hosted hub page, we record, as their processor: that the hub was opened, what was searched for and how many results it found, which demo was opened, the page path (without its query string), the host site, device class, the same daily viewer hash and a random per-page-load session id. Nothing is stored on the user’s device.

The mado capture extension for Chrome

The optional browser extension captures a web app so it can become a demo. It works only on a tab where you click its icon, and only while you capture, except on a site where you switch on Learn while I work (below). We hold what it captures as your processor, like any other recording (section 2).

It asks Chrome for these permissions: to act on the tab where you click its icon (activeTab), to run its capture code in that tab (scripting), to keep its settings and unfinished work in the browser (storage), and, for record mode only, to record the tab’s video and sound (tabCapture) in a background page of its own (offscreen). It also declares an optional permission to read one HTTPS site (or localhost); Chrome asks you for it only when you switch on Learn while I work for that site, and it is given back when you turn that off. It has no access to all your sites.

• Screenshot mode records a picture of the tab at each step, where you clicked and on which element, the page address without its query string or fragment (identifiers, email addresses and tokens in the path are replaced with placeholders), and what you typed. It never reads password fields, card-number fields or one-time codes: the step stores dots instead, and card and code fields are shown as dots on the page during capture so their digits do not reach a screenshot.
• To find the clicked element again later, each step also stores a short description of it: its role and visible name, a test id or stable id if the page sets one, its position in the page’s structure, and the first text of its table row or list item. No other attribute values, no hidden fields, and nothing from password, card or code fields.
• Sync, when you start it from Studio, sends the extension that demo’s steps (these descriptions and small pictures of each step) so it can walk you through them again. The new pictures it takes are handled exactly like a capture.
• Learn this app, only when you start it, keeps a picture of each new screen you reach while you use your app, with a text outline of that screen: its visible text, headings, and the names and roles of buttons, links and fields, with their positions. It never includes what is typed in fields, anything from password, card or code fields, hidden content, or attribute values other than stable test or element ids. It also notes the app’s colours, fonts, corner radius and layout, and each screen’s address without its query string or fragment: record identifiers in the path are kept, so mado can open the same screen again to take a picture a demo needs, while email addresses and tokens in the path are replaced with placeholders. The extension also remembers, in its own storage on that computer only, the last address it saw for each kind of screen; that copy is never sent anywhere. On its own it does not click anything: Explore links, if you start it, only opens the app’s own links in that tab, and the Helper is described below. Nothing leaves your browser until you press Save scan in Studio, which stores it in your workspace in the EU. No third party receives it, except that making a demo from a scan, or running the Helper, with AI assist on sends outline text to Anthropic (section 4).
• Learn while I work, only when you switch it on for a site, keeps a text outline of each new screen of that one site as you use it, the same outline and look as Learn this app, plus the screen’s address, so it can open it again later. It takes no pictures and does not click anything. Chrome asks you to let the extension read that site; nothing else is granted. The outlines stay in your browser, in the extension’s own storage, until you send them. Pictures are taken only when you press Send to mado: the extension then opens those pages again in your tab (never a page reached by sending a form, and never a page whose address looks like signing out, deleting or paying) and makes a scan of them, handled exactly like Learn this app; the addresses themselves never leave your browser. You can pause it or turn it off at any time; turning it off also gives back the access to the site, and you choose whether to keep or delete what it learned.
• The Helper, only when you start it during a scan, suggests and takes the next click in the app open in that tab, on that one site, to learn it and capture its screens. It clicks, scrolls and types. By default it does not submit forms, delete, send, invite or pay: it leaves those clicks to you, or to you telling it to click (“Click it for me”), and shows you what it will type before it types: for a whole form, one card with every field. If you switch on Auto-approve for a run, it clicks ordinary buttons and fills in those values without asking; a button with a risky word in its name or its form’s heading, and any button without a name, stays yours to approve. If you tick that the site is a test instance (“sandbox mode”), it may make the risky clicks too, for that run only. In every mode it types only made-up email addresses and phone numbers and, for payments in sandbox mode, the payment provider’s published test card numbers, and it never signs out, deletes the account or workspace it is signed in with, opens password, two-factor, single sign-on or API key settings, or leaves the site. To work out where things are, it reads the app’s own map once per run: the routes listed in its sitemap.xml and its route manifest (up to three fixed requests to the same site, made by the extension from the page), the names of the endpoints the page calls (path only, no content), and the links in its navigation. It needs AI assist to choose each next step (section 4). While it runs, the extension passes its requests to Studio through a Studio tab you keep open, signed in as you; apart from the requests to the app just described, the extension itself makes no network requests.
• You can write notes and rules for the Helper for each app in Studio. They are stored in your workspace as part of the app and sent to Anthropic with each Helper request (section 4), so do not put personal data or secrets in them.
• We keep a record of what you confirmed for the Helper (the sandbox statement you accepted and the warnings you were shown) and of each step it takes, offers you or you skip, each field it fills in, and whether a click was made by you, with Click it for me or by Auto-approve. It is written before the click or the typing happens. Each entry holds your account, the workspace, the time, the site and page (with identifiers replaced as above), the button’s or field’s role and name, and whether it worked. It holds no screenshots and nothing you or the Helper typed. The workspace can see it. We keep it as the controller, for security and to answer questions and disputes about what happened (legitimate interest, art. 6(1)(f)).
• Record mode, only when you choose it, also records the tab as video and, if you turn them on, your microphone and your webcam. The background of the webcam picture is blurred on your computer before it is saved, if you choose blur. If Voice & music is on and you ask for a transcript, your microphone recording is sent to ElevenLabs to turn it into text (see below).
• Apart from the Helper’s requests and record above, everything stays in your browser, in the extension’s own storage, until you press “Finish and make demo”. Studio then uploads it with your own signed-in session to our storage in the EU, the same way as any upload, and the extension deletes its copy. The extension itself makes no network requests and holds no account token of ours.
• The extension remembers your settings (such as mode, camera and blur) and whether you have granted microphone and camera access, so it does not ask each time. A capture you have not finished stays only in your browser until you finish or cancel it.
• Only studio.mado.show can talk to the extension. It contains no analytics or advertising code, and the background blur runs from code bundled with the extension, not downloaded.

People who appear in recordings

A recording can show names, email addresses or other details of people on screen. The customer who uploads it decides that, and we process it only to build and serve their demo. Studio flags likely emails, phone numbers, card numbers and IBANs so they can be redacted, and redaction removes the pixels from the published images.

Our website, reports and email to us

• Our marketing pages use no analytics or advertising tools. Our server briefly uses your IP address to deliver pages and to limit abuse (for example, too many password attempts or reports from one address); it is held in memory and not written to our logs (legitimate interest, art. 6(1)(f)).
• If you report a demo in the gallery, we store the reason and the note you write, but not who you are (legitimate interest in keeping the service lawful, and our duties as a hosting service under the Digital Services Act).
• If you email us, we use what you send to answer you (legitimate interest, or steps before a contract).

4. Optional features that send data to the United States

Two features are off for every workspace until a workspace owner or admin turns them on in Settings. Studio names the provider and region before they do. Turning a feature off stops new data from being sent.

• AI assist (Anthropic, PBC). Writes a demo’s title, step text, narration, chapters and end card, and translates demos. It sends step screenshots and the text recognised on them. Emails, phone numbers, card numbers, IBANs and labelled names are replaced in that text before sending. Screenshots are sent as they are at that moment: at upload nothing is redacted yet; from the editor, your redactions are applied first, and your request goes too, with any screenshots you attach to it. When a product website is given, our own servers fetch its text and links (never a private or internal address) and send that text too. Building a help hub with AI assist on sends your answers to its questions, the demos’ titles and step text and their page paths — never a screenshot. Making a demo from a scan, or asking for demo suggestions, sends the scan’s outline text (page addresses, titles, headings and the names and roles of buttons, links and fields, with the same details replaced) and what you asked for; the demo it starts is then written from its screenshots as above. The Helper sends, for each step it takes, the current page’s address and title, an outline of its headings and sections, the names, roles and positions of the controls it may use, what it did in its last steps, the addresses and titles of screens already captured or known from earlier scans of the app, and the app map it read (routes, endpoint names and navigation links), with the same details replaced, plus what you asked it to focus on — never a screenshot. The notes and rules you wrote for that app (up to 2,000 characters) go with every request as you wrote them: they are not scanned for personal data. Planning a promo film sends the published demo’s title, closing button and each step’s name, description, caption and narration, the text of the product website when the demo has one on record, and your brief (length, format, language, what to stress, the audience), with the same details replaced — never a screenshot. Anthropic does not use this data to train its models.
• Voice & music (ElevenLabs). Generates narration, background music and sound effects. It sends narration text and a short music style prompt, never a screenshot. When a promo film is rendered with Voice & music on, its voice lines are sent the same way. For personalised text only the fallback is sent, never a viewer’s value. In the browser extension’s record mode, if you ask for a transcript, it also receives your microphone recording to turn it into text. Your webcam video is never sent.

5. Who receives data

We use a short list of service providers (subprocessors) to run mado, each bound by a data processing agreement. The full list, with what each one does and where, is on our subprocessors page. Separately, Stripe and Link (payments) and Google (if you choose Google sign-in) act under their own privacy policies. If a customer turns on Slack or email alerts, viewer details from the alert (device, country, embedding site and tracked-link label, and for a lead form the name, email and company typed into it) go to the Slack workspace or inboxes the customer chose.

If a workspace member connects an AI assistant such as Claude to mado, or uses an API key, that tool reads what the member can see in the chosen workspace (demo titles and text, analytics, including the names given to tracked links) and can make tracked links and change draft text, on the customer’s instruction. The customer chooses the tool; its provider handles that data under the customer’s own agreement with it, not ours. We keep the connected app’s name and return address, who connected it and when, and when it was last used; sign-in codes, tokens and keys are stored only as one-way hashes. Owners and admins can disconnect an app or revoke a key at any time.

We do not sell personal data. We disclose it to authorities only when the law requires us to.

6. Where data is kept, and transfers outside the EU

Our servers, database, media storage and backups are with Hetzner in Helsinki, Finland. Data leaves the EU in these cases only:

• AI assist and Voice & music, when a workspace turns them on (section 4).
• Email: our provider, Resend, sends from its EU (Ireland) region but is a US company and may access the data from the US.
• Payments through Stripe and Link, and Google sign-in, as above.

Transfers to the US rely on the EU Standard Contractual Clauses in each provider’s data processing agreement, or on the EU–US Data Privacy Framework where the provider is certified. Write to us for a copy of the relevant safeguards.

7. How long we keep data

• Account data and workspace content: for as long as the account or workspace exists. When you ask us to close it, we delete it within one month.
• Sign-in sessions: they expire after 30 days. Sign-in links expire after 15 minutes.
• Demo viewer analytics: for as long as the customer’s workspace exists, then deleted with it. There is no shorter automatic limit today.
• Lead form entries: until the customer deletes them (one at a time in Studio), deletes the workspace, or deletes the demo; a deleted demo keeps showing for 30 days so a forgotten embed does not break, and its entries are erased after those 30 days.
• Help hub analytics: search text is erased after 90 days; the rest is deleted after 13 months.
• Helper action records: while the workspace exists, and for up to 24 months after it is closed, only to establish or defend legal claims (art. 17(3)(e)); then deleted.
• Backups: nightly database backups are kept for 14 days, so deleted data disappears from them within 14 days of deletion.
• Emails to us and demo reports: as long as needed to deal with them and any follow-up.

8. Your rights

Under the GDPR you can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive data you gave us in a portable format. Studio lets you export any demo, with its assets, at any time. For anything else, email hello@mado.show. We answer within one month.

If your data came to us through a customer (you viewed their demo, used their help hub or appear in their recording), we pass your request to that customer and help them answer it. Viewer data carries no name or email, so we usually cannot tell which records are yours on our own. A lead form entry does carry the email you typed: the customer can find and delete it, and if you write to us we will ask them to, or delete it for them on their instruction.

You can also complain to a data protection authority. Ours is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), vdai.lrv.lt, but you may go to the authority where you live or work.

9. Security

All traffic is encrypted in transit. Media storage is private; files are served only through our own servers. Every database query is scoped to one workspace. Stored Slack webhook addresses are encrypted. Our logs strip IP addresses, user agents and email addresses. Access to production is limited to the people who run the service. The technical and organisational measures are listed in the Data Processing Addendum.

10. Cookies

The demo player and help script set none. Studio uses a sign-in cookie and the website stores a theme preference if you choose one. Details are on our cookies page.

11. Children

mado is a tool for businesses and is not meant for anyone under 16. We do not knowingly create accounts for them.

12. Automated decisions

We make no decisions about people by automated means that have legal or similarly significant effects. AI assist only drafts text for a creator to review, and in the Helper it only chooses which control in your app to try next.

13. Changes

When we change this policy we update the date at the top. If a change matters for how we use your data, we tell account holders by email before it takes effect.