openmasu
Privacy policy
Last updated: October 20, 2026
This is an English translation provided for convenience. In case of any discrepancy, the Spanish version prevails.
In short
- What you store in your bases is yours. We keep it on servers in the European Union (Hetzner, Germany) only to provide the service to you.
- OpenMasu does not send your data to any artificial intelligence. If you connect your own assistant (Claude, Codex, Cursor…), that assistant reads and writes only what you allow, with the token or authorization you give it and can revoke.
- Neither this website nor the application uses tracking or advertising cookies; only a cookie that remembers your language, if you choose one. Visit statistics do not identify you.
- We don’t sell your data, and we don’t use it for advertising or to train models.
- Payments are handled by Stripe: we never see or store your card details.
1. Data controller
Company name: AI Services LLC
Trade name: OpenMasu
Address: 99 Wall Street #2351, New York, NY 10005, USA
Phone: +1 646 980 6880
Email: [email protected]
Website: openmasu.com
Data Protection Officer (DPO): not appointed. This policy applies to the OpenMasu web application (platform.openmasu.com), its public forms, its API and its MCP server, the desktop app and this website (hereinafter, “OpenMasu” or “the service”).
2. Applicable regulations
This policy has been drafted in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) and Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).
3. Two different roles
- Your account, your billing and your relationship with us: AI Services LLC is the data controller.
- What you and your team store in the bases (for example, your clients’ data or what comes in through a public form): the controller is the owner of the workspace, and AI Services LLC processes that data as a processor (art. 28 GDPR), only following their instructions and to provide the service to them. If you need a signed data processing agreement, ask us at [email protected].
4. What data we process
4.1. Your account
Your email address, your name if you give it to us and your password, which we store only as a hash (Argon2), never in plain text. We also store open sessions (only a fingerprint of each; they expire after 30 days) and the one-time links used to confirm your email or change your password.
4.2. Your workspaces and your bases
The tables, fields, records, views and forms you create, and the change log that lets you see them in real time and undo them (what changed, who changed it and when). If you invite someone, we process their email address to send them the invitation and their role in the workspace (owner, editor or viewer).
4.3. Public forms
If you share a form with a public link, what the person filling it in submits is stored as a record in your base. Whoever publishes the form is responsible for informing those people and for having a legal basis to collect their data. The IP address of the person submitting the form is only used at that moment to curb abuse and is not stored.
4.4. API tokens and connected assistants
If you create personal tokens or connect an application via OAuth (for example, an AI assistant through our MCP server), we store the name, the scope (read, or read and write), the workspace it gives access to, when it was created and when it was last used. Of the token itself we only store its fingerprint. Whatever that application reads or writes in OpenMasu, it does with your permissions; what it then does with that data is governed by its provider’s terms, not ours. You can revoke it at any time under Settings › API.
4.5. Importing from Airtable
If you import a base from Airtable, we use your personal Airtable token only during the import, to read the schema and the records. We do not store it.
4.6. Payments
If you subscribe to a paid plan, Stripe processes the payment. We store your Stripe customer and subscription identifiers, the plan, the period, the status and the renewal date. Your card details are processed only by Stripe.
4.7. If you write to us
If you write to [email protected], we process your email address and your message to reply to you. The mailbox is hosted on our servers in the European Union.
4.8. If you visit this website
We count visits with our own installation of Plausible Analytics, hosted on Hetzner servers in Germany. It uses no cookies and stores nothing in your browser. For each page you view it records the page, the website you came from, the browser, the operating system, the device type and the country. Your IP address is only used at that moment to infer the country and, together with your browser, to compute an identifier that changes every day; the IP is not stored.
4.9. Language
If you choose a language, we store it in the openmasu_lang cookie (“es” or “en”, 1 year) and, if you have an account, in your account. If you don’t, we infer the language from your country (which our network provider derives from your IP address) or from your browser settings, at that moment and without storing it. The details are in the cookie policy.
4.10. Technical data
Our web application firewall and our network provider log the IP address, date and path of each request to protect the service against abuse and attacks. To enforce usage limits we count requests per IP address for a few minutes, in memory.
5. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and maintaining your account and providing the service (bases, views, real time, invitations, forms, API and MCP). | Performance of the contract (art. 6.1.b). |
| Processing the data your team stores in the bases, as a processor. | The instructions of the workspace owner (art. 28). |
| Charging for paid plans and issuing invoices. | Performance of the contract and legal obligation (art. 6.1.b and 6.1.c). |
| Sending you service emails (confirming your email, password recovery, invitations, payment notices). | Performance of the contract (art. 6.1.b). |
| Enforcing usage limits, preventing abuse and protecting the security of the service. | Legitimate interest (art. 6.1.f). |
| Counting visits to this website with cookieless statistics. | Legitimate interest (art. 6.1.f). |
| Answering your questions. | Your request and our legitimate interest in handling it (art. 6.1.b and 6.1.f). |
| Handling your requests and complying with legal obligations. | Legal obligation (art. 6.1.c). |
We do not use your data for advertising, we do not build profiles for commercial purposes and we do not sell or transfer your data to third parties. We do not send you advertising by email.
6. Providers that process data on our behalf
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers that store your account and your bases, backups, our email and visit statistics. | Germany (EU) |
| Cloudflare, Inc. | Content delivery network and attack protection (encrypted connections pass through it). | USA and global network |
| Stripe Payments Europe, Ltd. and Stripe, Inc. | Charging for paid plans, invoices and subscription portal. | Ireland (EU) and USA |
7. International transfers
Your data is stored on servers in the European Union. Cloudflare and Stripe may process data outside the European Economic Area; those transfers are covered by the EU-U.S. Data Privacy Framework, to which both have adhered, and by the standard contractual clauses approved by the European Commission. AI Services LLC is a United States company; its staff’s access to the data is limited to what is necessary to maintain the service and is covered by the same safeguards.
8. How long we keep data
| Data | Period |
|---|---|
| Account | For as long as you have it. |
| Sessions | 30 days from sign-in, or until you sign out. |
| Bases, records and their change history | Until you delete them, or delete your account or the workspace. |
| API tokens and connected applications | Until you revoke them or they expire. |
| Airtable token | Not stored: it is used during the import and then discarded. |
| Backups | Daily, for 90 days: whatever you delete also disappears from the backups within that period. Server file system snapshots are kept for up to 6 months. |
| Billing data | The period required by tax and commercial law. |
| Support messages | The time needed to handle your query and anything arising from it. |
| Visit statistics | Without any data that identifies you; kept for as long as the website exists. |
| Security logs | The limited time needed to protect the service. |
9. Security
- Connections are encrypted (HTTPS/TLS) and go through a web application firewall.
- Passwords are stored with Argon2; for sessions, tokens and one-time links we only store their fingerprint.
- Each person sees only the workspaces they belong to, with their role (owner, editor or viewer), checked on the server for every change.
- The database only accepts connections from our own servers.
- Access to the servers is restricted to the people who maintain them.
10. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to [email protected] from your account email. We reply within one month at most. If what you want to exercise concerns data that someone else stores in their base (for example, if you filled in their form), contact them; if you write to us, we will pass your request on to them.
If you believe we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the data protection authority of your country.
11. Minimum age
OpenMasu is designed for professionals and teams. You must be at least 18 years old to create an account. We do not knowingly collect data from minors; if we discover that an account belongs to a minor, we will delete it.
12. Changes to this policy
If we change this policy, we will update the date above and, if the change is significant (for example, a new provider), we will notify you by email before it takes effect.