Privacy Policy

This Privacy Policy explains how Mateo (“we,” “us,” or “our”), operated by Mateo, based in Tel Aviv, Israel, collects, uses, discloses, and safeguards your information when you use our website and service (the “Service”). The Service captures a publicly accessible web page you submit and packages it for coding agents as a Rebuild Package, a DESIGN.md document, and an agent prompt.

By using the Service you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

Information we collect

Account information (Google OAuth)

We use Google to sign you in. When you authenticate, Google provides us with your name, email address, and profile picture (avatar). We do not receive your Google password and never have access to it.

Content you submit and the captures we produce

• URLs you submit for capture.
• Capture data for each URL: screenshots of the page, copies of its downloadable assets (such as images, icons, and fonts), and measurements of its layout, typography, motion, and interactions. This data describes the third-party page, not you, and is stored with the capture in your account.
• The outputs we produce from it: the Rebuild Package (including REBUILD.md), DESIGN.md, and the agent prompt, saved to your Captures.

Usage and diagnostic data

• Capture activity: counts, timestamps, the plan in effect, and pass/fail status of each capture (used for quotas and billing).
• Log and diagnostic data, including your IP address, browser and device type, and error/event logs used to operate, secure, and debug the Service.
• Analytics: if you accept analytics cookies, Google Analytics records the pages you visit on our website, along with approximate location, device, and browser information. We send it page views only: never the URLs you capture, your outputs, or your email.

Payment information

Payments are processed by Stripe. When you subscribe, your card details are entered directly with Stripe and handled under Stripe’s PCI-compliant systems. We do not store, see, or process your full card numbers. We retain only billing metadata such as your plan, subscription status, and a Stripe customer/subscription identifier.

How we use your information

• To provide, operate, and maintain the Service and your account.
• To run captures and produce, save, and let you retrieve their outputs.
• To enforce plan limits, process subscriptions, and prevent abuse.
• With your consent, to understand how visitors use our website through Google Analytics.
• To monitor, secure, troubleshoot, and improve the Service’s reliability and quality.
• To communicate with you about your account, billing, security, and material changes to the Service.
• To comply with legal obligations and enforce our agreements.

Legal bases for processing (GDPR)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

• Performance of a contract: to deliver the Service you have signed up for (authentication, captures, your Captures, billing).
• Legitimate interests: to secure the Service, prevent fraud and abuse, and improve our product, balanced against your rights.
• Legal obligation: to retain certain records (for example, tax and accounting records related to payments).
• Consent: for analytics cookies, which you can withdraw at any time from “Cookie settings” in the site footer.

How we share your information

We do not sell your personal data. We share it only with the following sub-processors and third parties, strictly to operate the Service:

• Google: authentication (Google OAuth sign-in), hosting and database (Google Cloud), and, if you accept analytics cookies, website analytics (Google Analytics).
• Anthropic: AI processing. Capture data from the page you submit, including its screenshots and measurements, is sent to Anthropic’s models to write parts of your outputs, such as REBUILD.md.
• Stripe: payment processing and subscription management.

We may also disclose information where required by law, to enforce our Terms of Service, to protect the rights, safety, and security of our users or the public, or in connection with a merger, acquisition, or sale of assets (subject to this policy).

Cookies

We use strictly necessary cookies for sign-in and security. With your consent, we also use Google Analytics cookies to measure website traffic. We do not use advertising cookies. You can accept or decline analytics when you first visit and change your choice at any time from “Cookie settings” in the site footer. For details, see our Cookie Policy.

Data retention

We retain your account information and your captures (their capture data and outputs) for as long as your account is active. You can delete a capture from your Captures at any time, which deletes its stored screenshots and assets. When you close your account, we delete or anonymize your personal data within a reasonable period, except where we must retain certain records to comply with legal, tax, or accounting obligations or to resolve disputes. Diagnostic logs are kept for a limited time and then rotated out. Google Analytics data is kept for at most 14 months.

Security

We use industry-standard safeguards to protect your data, including encryption in transit (HTTPS/TLS), access controls, and reliance on reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to promptly address any incident.

Your rights

Depending on where you live, you may have the following rights over your personal data under the GDPR and similar laws:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: request that we delete your personal data (“right to be forgotten”).
• Portability: receive your data in a portable, machine-readable format.
• Objection and restriction: object to or restrict certain processing, including processing based on legitimate interests.

Under the California Consumer Privacy Act (CCPA), California residents have the right to know what personal information we collect and to request deletion. We do not sell your personal data, so there is nothing to opt out of with respect to a “sale.” You will never be discriminated against for exercising any of your privacy rights.

To exercise any right, email us at support@mateoux.io. We may need to verify your identity before acting on a request.

International data transfers

We and our sub-processors may process your data in countries other than the one in which you reside, including the United States. Where personal data is transferred out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an equivalent mechanism offered by the relevant provider.

Children’s privacy

The Service is not directed to, and we do not knowingly collect personal data from, individuals under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Your continued use of the Service after an update constitutes acceptance of the revised policy.

Contact us

Questions about this policy or your data? Email support@mateoux.io, or write to Mateo, Tel Aviv, Israel.