Legal

Privacy Policy

Effective date: October 14, 2026 · Last updated: October 18, 2026

The short version

We collect what we need to run your account and your store workflows: your details, security data, tokens for the accounts you connect, and store data from those platforms.
We do not sell personal data, and we do not use your data to train our own AI models.
Your connected-account tokens and API keys are stored encrypted. You can disconnect accounts, export your data or ask us to delete it.
We use a small set of service providers to host the Service and run AI steps. They are listed below.
This summary is a guide, the full policy controls.

1. Who we are

This policy explains how Mukala LLC, a limited liability company formed in Pennsylvania ("Mukala", "we", "us"), handles personal information in the Mukala app at app.mukala.ai and on our marketing site at mukala.ai (together, the "Service"). Our address is 1905 N Plum Pt Drive, Exton, PA 19341. You can reach us at hello@mukala.ai.

We play two roles. For information about you, the person who signs up (account, security and usage data), we decide how it is used, so we are the controller or "business". For information about a seller's own customers that we pull from the seller's connected platforms, the seller decides and we act on the seller's behalf, so we are the processor or "service provider". See section 4.

2. What we collect

On the marketing site (mukala.ai). If you send a form on the site (the signup or audit request form), we collect your name, email, store link and anything else you choose to tell us, such as what you sell, whether you use Shopify, your revenue range or a message, plus the page and campaign link you came from. We store this in the Mukala app database and in Cloudflare Workers KV, and email it to our team. We also keep your IP address, browser details and the time with the request, and we briefly count requests per IP address to limit abuse. We use no advertising trackers and no third-party analytics. Our own first-party visit counter (served from app.mukala.ai) records anonymous page visits: the page, which of our sites it was on, the site that sent you, campaign tags in the link, scroll depth, time on page, whether you reached the pricing section, which version of the page you saw, which of our buttons or links you clicked, whether you started a form (never what you type in it), your device type (computer, phone or tablet), and random visit and visitor ids kept in your browser's storage. If you send the signup form, that visit is linked to your signup by an id number, so we can see which page brought it in. It sets no cookies, keeps no IP address (only a code scrambled with a key that changes every day), never reads what you type, and sends nothing if your browser has Do Not Track or Global Privacy Control turned on.

In the app (app.mukala.ai).

Account details: your name and email, and a hash of your password (we do not store the password itself).
Two-factor authentication (2FA) data: your authenticator (TOTP) secret and, if you choose SMS codes, your phone number.
Sessions and trusted devices: records that keep you signed in and remember devices you mark as trusted.
IP addresses: used for security and rate limiting.
Connected-account credentials: OAuth tokens and API keys for platforms you connect, stored encrypted.
Store data from connected platforms: orders, products and customer messages. This can include your customers' names and emails.
Content and approvals: drafts the Service creates for you, and append-only approval and audit logs of what was approved and by whom.
Usage and cost metering: how much of the Service and of AI usage your account uses.

When you contact us. We keep your messages and our replies.

3. How we use it

To provide the Service: run your account, show your dashboards, run workflows and post to connected accounts after you approve. Basis: to perform our contract with you.
To keep the Service secure: verify email, run 2FA, detect abuse, rate limit and keep audit logs. Basis: our legitimate interests in security, and the contract.
To meter usage and apply plan limits, and to bill you once billing starts. Basis: the contract.
To answer audit requests and support messages. Basis: your request, and our legitimate interests.
To send service emails, such as verification, security and account notices.
To improve and fix the Service. Basis: our legitimate interests.
To meet legal obligations and to handle legal claims.
Where we rely on your consent (for example, SMS codes or a connected account), you can withdraw it at any time. See section 11.

We do not sell personal data. We do not share it for cross-context behavioral advertising.

4. Your customers' data

When a seller connects a platform, the Service pulls store data, which can include the seller's customers' names, emails and messages. We process that data on the seller's behalf and on the seller's instructions, only to provide the Service. We do not use it for our own purposes.

If you are one of a seller's customers and want to see, correct or delete your data, please contact the seller first, because the seller controls it. You can also write to us at hello@mukala.ai and we will pass your request on. If your law requires a data processing agreement, contact us.

6. AI processing

To run a workflow step, we send the information that step needs, which can include store data and content drafts, to the AI provider selected for it. We do not use your data to train our own models. Each AI provider's own data terms apply to its processing, so please read them if that matters to you.

AI output can be wrong. Nothing is posted or published to your accounts until you approve it.

7. Cookies and tracking

The app uses cookies or similar storage that are needed to keep you signed in, protect your account and remember trusted devices. We do not use advertising cookies or sell data to advertisers. The marketing site has no advertising trackers and no third-party analytics; its own anonymous visit counter, described above, uses browser storage but no cookies.

Our pages load fonts (Montserrat and Poppins) from Google Fonts, so Google receives your IP address and browser details when a page loads. Cloudflare, which delivers our site, also processes request data such as IP addresses to serve and secure it.

8. How long we keep it

Account data is kept while your account is active. After you close your account or ask us to delete it, we delete or de-identify it within 30 days.
Backups roll over and are overwritten within 35 days, so deleted data can remain in backups until then.
Connected-account tokens and API keys are removed when you disconnect the account or delete your account.
Audit and approval logs are append-only, so we keep them for as long as the account exists and for the period above after deletion, unless the law requires us to keep records longer.
Anonymous site visit records (the first-party visit counter on mukala.ai) are kept for 13 months, then deleted automatically.
Audit requests from the marketing site are kept as long as needed to respond and follow up, and you can ask us to delete yours.

9. Security

We protect your information with measures that include encryption at rest for secrets such as connected-account tokens and API keys, two-factor authentication for accounts, hashed passwords, and append-only audit logs. No system is perfectly secure, so we cannot guarantee absolute security. If you think your account is at risk, email hello@mukala.ai.

10. International transfers

Our hosting is in the United States, and our providers may process data there and elsewhere. If you use the Service from outside the United States, your information will be transferred to and processed in the United States. Where the law requires safeguards for such transfers, we use them.

11. Your rights

Depending on where you live (for example under the GDPR, the UK GDPR, or California's CCPA and CPRA), you can:

Access the personal information we hold about you.
Correct information that is wrong.
Delete your information.
Export your information in a portable format.
Withdraw consent where we rely on it. Withdrawing does not affect what we did before.
Object to or restrict some uses of your information.
Opt out of sale or sharing. We do not sell personal data or share it for cross-context behavioral advertising, so there is nothing to opt out of.
Not be treated worse for using any of these rights.

To use a right, email hello@mukala.ai. We may need to verify it is you. You can use an authorized agent, and we may ask for proof they act for you. We reply within the time the law requires, which is generally one month under the GDPR and 45 days in California. If you are in the EU or UK and are not happy with our answer, you can complain to your local data protection authority.

12. Children

The Service is not for anyone under 16, and our terms require users to be at least 18. We do not knowingly collect personal information from children under 16. If you think a child has given us information, email us and we will delete it.

13. Changes to this policy

We may update this policy. If a change is material, we will tell you by email or in the app before it takes effect. The effective date at the top shows the latest version.

14. Contact

Mukala LLC
1905 N Plum Pt Drive
Exton, PA 19341
Email: hello@mukala.ai