Your data, handled the way it should be

Muho is a platform for building AI assistants trained on your own content. That means you trust us with material that matters — product documentation, support histories, internal notes, and the conversations your visitors have with your bot. This page is maintained by the Muho team and explains, in plain language, exactly what we do with that material.

Our guiding rule is simple: your content is yours. We process it to run the service you asked for, and for nothing else. We do not sell it, we do not rent it to advertisers, and we do not use your private documents or chat transcripts to train general-purpose foundation models.

We group everything we hold into four buckets:

• Account data — your email address, hashed password credentials, display name, plan, and billing records. Passwords are never stored in readable form.
• Bot configuration — bot names, personas, system prompts, appearance settings, widget keys, and the AI provider you selected.
• Training material — the documents you upload, the text you paste, and the pages you ask us to crawl. This is stored so your bot can answer from it.
• Conversation data — messages exchanged between your bot and your visitors, plus technical metadata such as timestamps and message counts used for billing and abuse prevention.

We also keep minimal operational logs (error traces, request timing) needed to keep the service reliable. We do not run third-party advertising trackers on the dashboard.

• To generate answers: your training material is retrieved and sent to the AI model you selected, together with the visitor's question.
• To operate your account: authentication, plan enforcement, message metering, and billing.
• To keep the platform safe: rate limiting, abuse detection, and investigating security reports.
• To support you: when you contact us about a problem, we may look at the specific records needed to diagnose it.

What we never do: sell personal data, share your training documents with other customers, or feed your private content into model training runs of our own.

Uploaded documents and crawled pages are the most sensitive material on the platform, so they get the strictest handling:

• Tenant isolation. Every training record is bound to your account and your bot. Database row-level security policies enforce that boundary at the data layer, not just in application code.
• Encryption. Data is encrypted in transit with TLS and encrypted at rest by our hosting provider's storage layer.
• Scoped retrieval. A bot can only retrieve from its own training set. A widget key never grants access to another bot's material.
• Deletion is real deletion. When you delete a document or a bot, the underlying records are removed from the live database. Encrypted backups age out on their normal rotation schedule.
• Only send what you're comfortable sharing. Anything you train a public bot on can, by design, be surfaced in an answer. Do not upload passwords, payment card numbers, national ID numbers, or medical records as training material.

Muho supports bringing your own AI provider key, or using the Muho platform key on eligible plans. Either way:

• Provider keys are stored server-side and are never exposed to the browser or to the embedded widget.
• The public widget uses a separate, revocable widget key that carries no provider privileges.
• You can rotate or delete any key at any time from the dashboard; revocation takes effect immediately.
• Admin staff do not read customer provider keys as part of normal operations.

When someone chats with your bot, you are the controller of that conversation and Muho is the processor acting on your instructions. Practically, this means:

• We store the transcript so you can review it in your dashboard and so the bot can hold context within a session.
• Guest sessions are identified by a random session token, not by a tracking profile that follows people across the web.
• You are responsible for telling your own visitors that an AI assistant is in use and linking your own privacy notice from your site.
• You can delete any conversation, and deleting a bot removes its conversation history.

Muho relies on a small set of infrastructure partners to deliver the service. Categories we use:

• Cloud hosting and edge compute for serving the app and running server functions.
• Managed Postgres database and object storage for account data, bots, and training material.
• Email delivery for verification codes, password resets, and account notices.
• AI model providers — the specific provider is whichever one you selected for the bot.

When your bot answers a question, the relevant excerpt of your training material and the visitor's message are sent to the selected AI provider so it can generate a reply. That provider's own terms then apply to that request. If you need a specific provider's data-handling posture, choose that provider with your own key so the relationship is directly yours.

• While your account is active: we keep your bots, training material, and conversations so the service works.
• On item deletion: documents, bots, and conversations are removed from the live database when you delete them.
• On account closure: tell us and we will remove your account data, retaining only what we must for financial and legal records such as invoices.
• Backups: encrypted backups are retained on a rolling schedule and expire automatically; they are used only for disaster recovery.

Depending on where you live, you may have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate account information (most of this is editable in your profile).
• Delete your account and associated data.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.

Send any request to support@muho.me from the email address on the account. We aim to respond within 30 days. If your request concerns a visitor's data on a bot you own, we will route it to you as the controller.

Muho exists because we believe AI should be genuinely useful to people and safe by construction — not a black box that quietly hoards whatever it is fed. Privacy is the first concrete expression of that belief, so we hold ourselves to these commitments:

• Data minimisation by default. We ask for the least data that makes the product work, and we resist collecting more just because we could.
• No silent model training. Your private documents and transcripts are not used to train general models. If that ever needed to change, it would be opt-in and announced in advance.
• Grounded answers. Bots are designed to answer from your material rather than invent facts, and to say when they don't know.
• Human override. You can edit prompts, remove training material, pause a bot, or take it offline instantly at any time.
• Transparency to end users. We ask every operator to disclose that a bot is an AI, not a person.
• Refusal to enable harm. We prohibit using Muho to deceive, impersonate, surveil, or manipulate people — see the Terms for the full list.

• TLS for all traffic between browsers, our servers, and our data stores.
• Row-level security policies on customer tables so one account cannot read another's rows.
• Server-only handling of privileged credentials; the browser bundle never receives secret keys.
• Least-privilege admin roles stored in a dedicated roles table, never on a user-editable profile record.
• Password hashing handled by our managed authentication provider; we never see plaintext passwords.
• Email verification codes and password reset codes are short-lived and single-use.

We use browser storage for the things the product cannot work without: keeping you signed in, remembering your theme and dashboard preferences, and holding a random session token so a chat keeps its context. We do not use advertising cookies or cross-site tracking pixels on the Muho dashboard. Clearing site data signs you out and resets those preferences.

Muho is a business tool and is not directed at children. Do not create an account if you are under 13 (or the minimum digital-consent age where you live), and do not train a bot on children's personal data without the appropriate legal basis.

Our infrastructure providers and AI providers may operate in multiple regions, so your data may be processed outside your home country. We choose providers that offer appropriate safeguards for such transfers.

When we make a material change to this policy, we update the date at the top of this page and, for significant changes, notify account holders by email. Continuing to use Muho after a change means you accept the updated policy.

Questions, requests, or concerns: support@muho.me.