Privacy Policy

This Privacy Policy explains how Mateo (“we,” “us,” or “our”), operated by Mateo, registered at Tel Aviv, Israel, collects, uses, discloses, and safeguards your information when you use our website and service (the “Service”). The Service extracts a website’s design system from its publicly accessible pages and generates a design.md specification for AI builders.

By using the Service you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

Information we collect

Account information (Google OAuth)

We use Google to sign you in. When you authenticate, Google provides us with your name, email address, and profile picture (avatar). We do not receive your Google password and never have access to it.

Content you submit and generate

• URLs you submit for analysis, and any optional screenshots you upload to refine a generation.
• The generated design.md files and associated AI context summaries we produce for you, which are saved to your library.

Usage and diagnostic data

• Generation activity - counts, timestamps, the plan in effect, and pass/fail status of each run (used for quotas and billing).
• Log and diagnostic data - including your IP address, browser and device type, and error/event logs used to operate, secure, and debug the Service.

Payment information

Payments are processed by Stripe. When you subscribe, your card details are entered directly with Stripe and handled under Stripe’s PCI-compliant systems. We do not store, see, or process your full card numbers. We retain only billing metadata such as your plan, subscription status, and a Stripe customer/subscription identifier.

How we use your information

• To provide, operate, and maintain the Service and your account.
• To run design extractions and generate, save, and let you retrieve your design.md files.
• To enforce plan limits, process subscriptions, and prevent abuse.
• To monitor, secure, troubleshoot, and improve the Service’s reliability and quality.
• To communicate with you about your account, billing, security, and material changes to the Service.
• To comply with legal obligations and enforce our agreements.

Legal bases for processing (GDPR)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

• Performance of a contract - to deliver the Service you have signed up for (authentication, generations, your library, billing).
• Legitimate interests - to secure the Service, prevent fraud and abuse, and improve our product, balanced against your rights.
• Legal obligation - to retain certain records (for example, tax and accounting records related to payments).
• Consent - where required, which you may withdraw at any time.

How we share your information

We do not sell your personal data. We share it only with the following sub-processors and third parties, strictly to operate the Service:

• Google - authentication (Google OAuth sign-in).
• Anthropic - AI processing. The design data extracted from the website you submit (and any screenshot you provide) is sent to Anthropic’s models to generate your design.md.
• Stripe - payment processing and subscription management.
• Our hosting and database provider - to host the application and store your account, content, and generated files.

We may also disclose information where required by law, to enforce our Terms of Service, to protect the rights, safety, and security of our users or the public, or in connection with a merger, acquisition, or sale of assets (subject to this policy).

Cookies

We use a small number of strictly necessary cookies for authentication and store your theme preference locally. We do not use advertising or cross-site tracking cookies. For details, see our Cookie Policy.

Data retention

We retain your account information and generated design.md files for as long as your account is active. You can delete generated files from your library at any time. When you close your account, we delete or anonymize your personal data within a reasonable period, except where we must retain certain records to comply with legal, tax, or accounting obligations or to resolve disputes. Diagnostic logs are kept for a limited time and then rotated out.

Security

We use industry-standard safeguards to protect your data, including encryption in transit (HTTPS/TLS), access controls, and reliance on reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to promptly address any incident.

Your rights

Depending on where you live, you may have the following rights over your personal data under the GDPR and similar laws:

• Access - request a copy of the personal data we hold about you.
• Rectification - ask us to correct inaccurate or incomplete data.
• Erasure - request that we delete your personal data (“right to be forgotten”).
• Portability - receive your data in a portable, machine-readable format.
• Objection and restriction - object to or restrict certain processing, including processing based on legitimate interests.

Under the California Consumer Privacy Act (CCPA), California residents have the right to know what personal information we collect and to request deletion. We do not sell your personal data, so there is nothing to opt out of with respect to a “sale.” You will never be discriminated against for exercising any of your privacy rights.

To exercise any right, email us at support@mateoux.io. We may need to verify your identity before acting on a request.

International data transfers

We and our sub-processors may process your data in countries other than the one in which you reside, including the United States. Where personal data is transferred out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an equivalent mechanism offered by the relevant provider.

Children’s privacy

The Service is not directed to, and we do not knowingly collect personal data from, individuals under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Your continued use of the Service after an update constitutes acceptance of the revised policy.

Contact us

Questions about this policy or your data? Email support@mateoux.io, or write to Mateo, Tel Aviv, Israel.