The short version
- We collect as little as we can get away with.
- We do not sell your personal data. We never have and we do not intend to.
- We do not use your content to train AI models.
- You can ask us to show you, correct or delete everything we hold, and we will do it within 30 days.
- Payments are handled by Paddle – we never see your card number.
The rest of this page is the detail behind those five lines.
1. Who is responsible for your data
The data controller is Individual Entrepreneur Rustam Alibekov, trading as Muffin Studio, an Individual Entrepreneur (ინდივიდუალური მეწარმე) registered in Georgia under identification number 304766386, with its registered address at Nino and Ilia Nakashidze Street N1, Building N3, Flat N3, Krtsanisi District, Tbilisi, Georgia.
For anything about your data, email support@muffinstudio.co.
2. Does this policy cover the apps as well as the website?
Yes. This policy covers muffinstudio.co and every mobile application we publish, unless a particular app displays its own privacy policy – in which case that policy governs that app, and this one covers the website. Where an app policy is silent on something, this policy fills the gap.
3. What we collect
When you visit this website
- Standard technical information your browser sends: IP address, browser type, device type, referring page, and the pages you view.
- Any analytics we use on this website is privacy-friendly and cookie-free. We do not run advertising trackers, we do not build profiles of visitors, and we do not set marketing cookies. See our Cookie Policy.
When you email us
- Your email address, your name if you give it, and whatever is in your message.
- We keep support correspondence for up to 24 months so we have context if you write again.
When you use one of our apps
- Account data, if you create an account: email address, and a securely hashed password or the identifier from the sign-in provider you used.
- Content you create in the app, where the feature requires storing it on our servers to work. Where a feature can work on your device alone, we keep it on your device.
- Diagnostics: crash reports and error logs, so we can fix what breaks.
- Usage analytics: which features are opened and how often, in aggregate. We use this to decide what to improve.
- Device information: model, operating system version, app version, language and region.
When you buy something
- Purchases on our website are processed by Paddle.com Market Ltd, our Merchant of Record. Paddle collects your payment details and billing address directly.
- We never see or store your full card number. We receive only the information we need to give you what you bought and to keep our books: your email address, what you bought, when, the amount, the last four digits of the card, and the country used for tax.
- Purchases made inside an app through Apple or Google are handled entirely by them. We receive an anonymous confirmation that a valid purchase exists.
If you write to us about working with us
- Whatever you send: your name, contact details, and any links or documents.
- We keep these for 12 months, then delete them. Ask at any time and we will delete them sooner.
4. What we do not collect
- We do not collect your precise location.
- We do not read your contacts, calendar, photos or messages unless you explicitly choose to give a specific file to a specific feature.
- We do not use advertising identifiers and we do not run third-party ad networks in our apps.
- We do not knowingly collect data from children under 16.
5. Why we are allowed to process it (legal bases)
| What | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account data | To give you an account and let you sign in | Performance of a contract |
| Content you create | To provide the feature you asked for | Performance of a contract |
| Purchase records | To deliver what you bought; to meet tax and accounting law | Contract; legal obligation |
| Crash reports | To find and fix defects | Legitimate interest in working software |
| Usage analytics | To understand which features matter | Legitimate interest; consent where required |
| Support emails | To answer you | Contract; legitimate interest |
| Marketing email | To tell you about a launch you asked to hear about | Consent – and you can withdraw it in one click |
| Job enquiries | To consider you for a role | Steps prior to a contract; legitimate interest |
6. Who we share it with
We share personal data only with the service providers we need to run the business. Each is bound by a contract, may only act on our instructions, and may not use your data for its own purposes.
| Provider | What for | What it receives |
|---|---|---|
| Paddle.com Market Ltd | Payments, tax, invoicing, billing support | Email, payment and billing details |
| Cloud hosting provider | Running the website and app backend | Whatever is stored, encrypted in transit |
| Email provider | Sending transactional and support email | Email address, message content |
| Analytics provider | Aggregate, privacy-friendly usage statistics | Anonymised or pseudonymised events |
| Crash reporting provider | Diagnosing failures | Device and error information |
| Third-party AI providers | Powering AI features you use | Only the input you submit to that feature |
| Apple, Google | App distribution and in-app purchases | Whatever their platforms handle directly |
We will also disclose data if the law requires it, to enforce our terms, or to protect someone's safety. If we are ever acquired or reorganised, your data may transfer to the new owner, who will remain bound by this policy.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
7. AI features and your content
When you use an AI feature, the input you give it may be sent to a third-party AI provider so the feature can produce a result. We send the minimum needed and no more.
- We instruct our providers not to use your input to train their models, and we use their zero-retention or limited-retention configurations where they are offered.
- We do not use your content to train models of our own.
- Please avoid putting anything highly sensitive into an AI feature – medical records, financial identifiers, passwords. That is good practice with any AI tool, ours included.
8. Where your data goes
We are based in Georgia, and our providers operate in the European Union and the United States, so your data may be transferred outside your own country. We use a lawful transfer mechanism for every route:
- From the EEA – the European Commission's Standard Contractual Clauses, or an adequacy decision where one applies.
- From the United Kingdom – the UK International Data Transfer Agreement, or the UK Addendum to the Standard Contractual Clauses.
- From Switzerland – the Standard Contractual Clauses as recognised by the Swiss Federal Data Protection and Information Commissioner.
- From Australia, Canada and Japan – contractual protections that hold the receiving provider to standards comparable to those in your own country's law, as those laws require.
Georgia has its own data protection law, the Law of Georgia on Personal Data Protection, and we are subject to it in addition to anything set out above.
9. How long we keep it
| Data | Kept for |
|---|---|
| Account and content | While your account is active, then deleted within 30 days of a deletion request |
| Purchase and tax records | As long as tax and accounting law requires, generally 6 years – this cannot be deleted on request |
| Support correspondence | Up to 24 months |
| Crash reports | Up to 12 months |
| Aggregated, anonymised statistics | Indefinitely – these are not personal data |
| Job enquiries | 12 months, or less if you ask |
| Backups | Purged on normal rotation, within 90 days at the latest |
10. Your rights
Wherever you live, we will honour all of the following:
- Access – get a copy of what we hold about you.
- Correction – have inaccurate data fixed.
- Deletion – have your data erased. Use our deletion page.
- Portability – receive your data in a machine-readable format.
- Restriction and objection – tell us to stop or limit a particular use, including anything based on legitimate interest.
- Withdraw consent – at any time, without affecting what we did lawfully before you withdrew it.
- No discrimination – we will never give you a worse service or price for exercising a right.
To use any of these, email support@muffinstudio.co. We reply within 2 business days and complete the request within 30 days. There is no charge. We may ask you to confirm your identity first, so we do not hand your data to someone else.
Extra rights where you live
The list above is what we give everyone. Some countries add to it, and some name a specific regulator you can complain to. We would appreciate the chance to fix a problem first, but you never have to ask us before going to them.
| Where you are | What else you get | Who you can complain to |
|---|---|---|
| European Economic Area | The full set of GDPR rights, including the right not to be subject to a decision based solely on automated processing that produces a legal or similarly significant effect. We do not make decisions of that kind | Your national supervisory authority |
| United Kingdom | The same rights under the UK GDPR and the Data Protection Act 2018 | The Information Commissioner's Office |
| Switzerland | The equivalent rights under the revised Federal Act on Data Protection | The Federal Data Protection and Information Commissioner |
| United States | Under California, Colorado, Connecticut, Virginia and the other state privacy laws: the right to know, delete, correct and port, and to opt out of sale, sharing and targeted advertising. We do not sell or share personal data and we do not run targeted advertising, so there is nothing to opt out of. We will never charge you a different price for exercising a right | Your state Attorney General |
| Canada | Access and correction rights under PIPEDA. We send commercial email only with your express consent, as CASL requires, and every message has an unsubscribe link | The Office of the Privacy Commissioner of Canada |
| Australia | Access and correction under the Australian Privacy Principles. Where a breach is likely to cause serious harm, we notify you and the regulator under the Notifiable Data Breaches scheme | The Office of the Australian Information Commissioner |
| Japan | Disclosure, correction and suspension of use under the Act on the Protection of Personal Information, including our disclosure of transfers to third parties in foreign countries | The Personal Information Protection Commission |
11. Security
We encrypt data in transit with TLS and at rest where our providers support it, keep access on a strict need-to-know basis with two-factor authentication, and hold no card data at all. No system is perfectly secure, and we will not pretend otherwise – but if a breach affects your data and is likely to put you at risk, we will tell you and the relevant authority without undue delay, and within 72 hours where the GDPR requires it.
12. Children
Our services are not directed at children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, email support@muffinstudio.co and we will delete it.
13. Changes to this policy
We will update this page when our practices change, and update the date at the top. If a change materially affects you, we will notify you by email or in the app before it takes effect.
14. Contact
Individual Entrepreneur Rustam Alibekov
Nino and Ilia Nakashidze Street N1, Building N3, Flat N3
Krtsanisi District, Tbilisi
Georgia
Identification number 304766386
support@muffinstudio.co