01Who handles your data
Vague MENA FZ-LLC, based at in5 Media, Dubai Production City, Dubai, United Arab Emirates, is responsible for the personal data described in this notice. Contact hello@murl.ai for privacy questions or requests. This notice covers Murl's website, accounts, app builder, generation tools, and hosted services.
02What we collect
- Account and contact information: your name, email address, profile, sign-in information, communications with support.
- Content and activity: prompts, uploaded files, generated media, app code and configuration, authoring conversations, saved items, publishing choices, and run history.
- Billing records: plan, credit balance, usage charges, payment identifiers, purchase and refund records, and subscription status. Stripe collects payment details through its checkout; Murl does not receive your full card number or security code through that checkout.
- Technical information: IP address, browser and device information, request and error logs, session identifiers, and service usage needed for operation, troubleshooting, security, and abuse prevention.
03Why we use it
We use information to create and authenticate accounts, run models and apps, store and serve content, process payments, maintain credit and creator accounting, answer support requests, improve reliability, prevent abuse, and meet legal obligations. Account emails support the access or service you requested; you can unsubscribe from optional updates.
Where the UAE Personal Data Protection Law applies, we process personal data with consent or an applicable legal exception, including where necessary to perform a contract or comply with law. Where the GDPR applies, our bases are contract performance for requested services, legal obligations for required records, legitimate interests in securing and maintaining the service where these do not override your rights, and consent where required for optional processing. You may withdraw consent without affecting earlier lawful processing.
04Service providers
We share information needed for the task with service providers. A generation or authoring request may send prompts, relevant conversation context, files, or temporary file-access links to the provider handling that request. Routing and fallback can involve more than one provider. Do not submit another person's personal information without an appropriate basis to do so.
Provider handling of submitted content depends on the service and model used, including its retention and data-use terms. This notice does not promise that every model has identical retention or training rules.
- Cloudflare: website and app hosting, networking and security, file and video storage/delivery, AI Gateway, and related AI and email services.
- PlanetScale: database hosting.
- fal.ai and Runware: model execution and media generation for requests routed to their services.
- Anthropic, OpenAI, and other underlying model providers selected through our AI infrastructure: processing authoring conversations and model requests where used.
- Stripe: payments, subscription management, fraud prevention, refunds, and related financial records. Stripe also processes certain information for its own legal and regulatory purposes.
06Storage and retention
We retain account and content information while needed to provide the service and for legitimate legal, security, accounting, or dispute purposes. Financial and credit-ledger records may need to remain after account closure. Retention depends on the record and purpose; account deletion is not a promise that every record disappears immediately.
Assets moved to Trash are scheduled for permanent deletion after 30 days. Assets still referenced by a published app or page can remain until those references are removed. Processing retries, backups, and legal preservation requirements may delay complete removal. Removing content from Murl does not delete copies others have already obtained or independently stored.
08Your choices and rights
Email hello@murl.ai to request access, correction, deletion, or a copy of your personal data, or to raise a privacy concern. We may need to verify your identity. Depending on applicable law, you may also have rights to portability, restriction, objection, withdrawal of consent, or review of qualifying automated decisions. Exceptions may apply, for example where records must be retained by law. We respond within the period required by applicable law.
Where the GDPR applies, you may complain to a data protection supervisory authority, including in the EU country where you live or work. Where UAE data protection law applies, you may raise concerns with the competent UAE authority. You can contact us first without giving up those rights.
Murl is intended for adults aged 18 and over. If you believe a child has provided personal data, contact us so we can investigate. We update this notice when our practices change and provide additional notice where required.
Questions about this policy?
Contact Murl