Privacy Policy

1. Who we are

OmniLab (Québec enterprise number 2282318825, 7157, chemin des Forts, Lévis (Quebec) G6Y 0R7, Canada) is the data controller for the personal data described in this policy. For any privacy question or request, write to [email protected]. Full details are on makasi.dev/legal.

2. Person in charge of the protection of personal information

In accordance with Quebec's Act respecting the protection of personal information in the private sector (Law 25), the person in charge of the protection of personal information at OmniLab is its Chief Executive Officer (CEO). You can reach them at [email protected] for any question, request or complaint about how we handle personal information.

3. Data we collect

Account data — when you sign up we collect your name, email address and authentication identifiers, along with your plan, billing status, credit balance and usage history.

Project data — the requests and messages you send to the agents, the plans and code they produce, your code history (git), and the databases and files your projects store. This content belongs to you; we process it only to operate the service.

Demo video — on plans that include it, at the end of a build the platform replays your application's test journeys, without AI, on its preview and records them, solely to show you the result of the build. The video shows what the preview contains: your own content and the test data those journeys create; only the journeys that succeed are recorded. Once your application is published, it is only recorded if it is paused for the whole recording, so your visitors and their data never appear on screen. The video is announced by email (an attached still image and a link to the workspace, sign-in required) to the account paying for the build and to the project owner, and stored on our servers until it is deleted (see Retention). Each of these accounts chooses in its settings when to receive this video: always, only when the person is not on the project, or never. Nothing is recorded if none of them wants the video.

Hosted mailboxes — if you use the mailboxes Makasi hosts on your domains, the messages you send and receive, their attachments and your contacts are stored on our servers in the European Union to provide the service; outgoing messages are delivered through Amazon SES. We never use their content for marketing or advertising, and we access it only to operate the service (security, incidents) or where the law requires it.

Payment data — card payments are processed by Stripe and mobile money payments by pawaPay. We never see or store your card number or mobile wallet credentials; we only keep the transaction records (amount, plan, status) required for billing and accounting. Mobile money payments require your phone number, which is transmitted to pawaPay to process the transaction.

Analytics — we use PostHog (product analytics) to understand how the site and the product are used, in aggregate or pseudonymous form. Measurement happens on our servers: your browser calls no third-party analytics tool, and the IP address PostHog sees is our server's, not yours.

Technical logs — IP address, browser user agent and request identifiers, kept for security, abuse prevention and troubleshooting.

4. Cookies

We use a small number of first-party cookies: authentication and session cookies (required), a language preference cookie (NEXT_LOCALE, 1 year) and a referral attribution cookie (makasi_ref, 30 days), set only if you accept it on the page shown when you follow a makasi.dev/r/ link. No analytics cookie: measurement happens server-side. Your browser only keeps, in its local storage, a per-day marker (mk:seen:…) that avoids counting the same view twice. We use no advertising cookies and we never sell personal data.

5. How we use your data

We use your data to provide and secure the service (run builds, host previews, manage quotas), to bill you, to prevent abuse (rate limiting), to send transactional emails, and to improve the product.

Legal bases under the GDPR: performance of the contract, our legitimate interests (security, abuse prevention, product improvement) and your consent where required.

6. Hosting and subprocessors

Platform data is hosted in Europe on Hetzner infrastructure (Falkenstein data center, Germany). Our subprocessors fall into the following categories: payments (Stripe for cards, pawaPay for mobile money), network and security (Cloudflare: DNS and DDoS protection), product analytics (PostHog, hosted in the EU), email delivery (for example Amazon SES), encrypted off-site backups (Backblaze B2) and registration of the domain names you purchase through the service (Porkbun). Each of them processes only the data necessary for its role, under its own data protection commitments.

The content of your conversations with the agents (text, attached images and documents) is sent to the AI model providers the service relies on, to generate answers and code. These providers may change at any time; we may use the following: in the United States, Anthropic, OpenAI, Google, xAI, Groq, Together AI and Fireworks AI; in Canada, Cohere; in the European Union, Mistral (France); in China, Zhipu, DeepSeek, Moonshot and Qwen (Alibaba). Each provider processes this content under its own API terms, including as regards training its models; not all of them guarantee it will not be used for that purpose. When the agent searches the web, the search query is sent to a web search provider (Brave Search); when it looks for royalty-free images for your application, the search terms are sent to Openverse (WordPress Foundation, United States).

7. Apps you build: we act as your processor

When the applications you build with Makasi collect personal data from their own users — accounts, database records, files, messages in hosted mailboxes — you are responsible for that data as the controller, and OmniLab processes it only on your behalf, as your processor (the service provider to whom you entrust it, under Law 25).

That processing is governed by our Data Processing Addendum, at makasi.dev/legal/dpa, which forms part of the Terms of Service and applies automatically. Requests from your applications' users should be addressed to you; we help you answer them.

8. Retention

Account and project data are kept for as long as your account is active. When you delete a project or your account, the associated data is removed from production systems within 30 days; encrypted backups expire within a further 30 days.

Billing records — invoices, payments, refunds and the related transaction data — are kept for as long as tax law requires, generally six years after the end of the tax year to which they relate, even if you delete your account.

Technical logs are kept for limited periods, typically 90 to 180 days.

Build demo videos are deleted automatically at the end of their retention period, generally within 48 hours of recording. The still image attached to the email stays in your mailbox.

9. Your rights

Depending on where you live — notably under the GDPR, Quebec's Law 25 and Canada's federal PIPEDA — you have the rights of access, rectification, deletion and portability of your personal data, the right to object to or restrict certain processing, and the right to withdraw your consent at any time.

To exercise these rights, email our person in charge of the protection of personal information at [email protected]; we respond within 30 days. You may also lodge a complaint with your supervisory authority — in Quebec, the Commission d'accès à l'information (CAI).

10. Security

All traffic is encrypted in transit (TLS). Secrets and API keys are encrypted at rest, with strong encryption (AES-256). Each project runs in its own isolated environment with network isolation, and access to production systems is restricted and audited.

11. International transfers

Platform data is hosted in the European Union, in Germany. OmniLab is based in Quebec, Canada; Canada benefits from a European Commission adequacy decision for commercial organizations.

Some subprocessors process data outside Quebec, and some outside the European Union — notably the AI model providers, which may change at any time and are located in the United States (Anthropic, OpenAI, Google, xAI, Groq, Together AI, Fireworks AI), Canada (Cohere), the European Union (Mistral, France) and China (Zhipu, DeepSeek, Moonshot, Qwen/Alibaba) — as well as some network, email and payment services. Before communicating personal information outside Quebec, we conducted the privacy impact assessment required by section 17 of Law 25, taking into account the sensitivity of the information, the purpose of its use, the protection measures, including contractual ones, and the legal framework applicable in the destination country.

That assessment concluded that the information receives adequate protection with the following safeguards: a written agreement with each provider (its data processing terms, including, where the GDPR applies and the provider offers them, the European Commission's standard contractual clauses), encryption in transit, and minimisation — each provider receives only what its role requires. That conclusion does not extend to those of the AI model providers listed above whose terms do not guarantee that your content will not be used to train their models, or do not include the standard contractual clauses: for them, protection is limited to their API terms, encryption in transit and minimisation.

12. Changes to this policy

We may update this policy as the product evolves. The last-updated date shown on this page reflects the latest revision; material changes will be announced on the site or by email.

13. Contact

OmniLab — [email protected]. Person in charge of the protection of personal information: the Chief Executive Officer (CEO).