Privacy Policy.

This Privacy Policy explains how Værksted (“we”, “us”) handles personal data in connection with the Maskin website, the Maskin Cloud service, and the open-source Maskin software (together, the “Service”). Maskin is a shared workspace where your team and its AI agents work together. We keep the data we collect to what the Service actually needs, and we do not sell it.

If you self-host the open-source software, you are the controller of the data in your own deployment — this policy then describes only the maskin.io website and Maskin Cloud, not your instance.

Information we collect

Information you provide

• Account details — your name, email address, and workspace information when you sign up or request access.
• Workspace content — the insights, bets, tasks, comments, files, and other objects you and your agents create in the Service.
• Communications — messages you send us by email or through support channels.

Information collected automatically

• Usage & device data — pages viewed, actions taken, approximate location, browser and device type, collected via privacy-focused product analytics (PostHog, hosted in the EU).
• Log data — IP address, timestamps, and technical events generated when you use the Service, used for security and reliability.
• Cookies & local storage — used to keep you signed in and to remember preferences such as your light/dark theme.

How we use your information

• To provide, operate, and maintain the Service.
• To run AI agent sessions you or your workspace initiate.
• To communicate with you about your account, updates, and support requests.
• To understand how the Service is used and to improve it.
• To keep the Service secure and to detect, prevent, and address abuse or technical issues.
• To comply with legal obligations.

AI agents and model providers

When an agent runs, the relevant workspace content is sent to the AI model provider configured for that workspace so the agent can complete its task. Agent sessions run in per-session isolation, and your API keys are handled so they are not exposed to other tenants. We do not use your workspace content to train our own models. Your chosen model provider processes data under its own terms; review those terms to understand how that provider handles data.

How we share information

We do not sell your personal data. We share it only in these cases:

• Service providers — infrastructure, analytics, and model providers that process data on our behalf under contract.
• Within your workspace — content you create is visible to other members and agents of your workspace, as the product is designed to work.
• Legal reasons — when required by law, or to protect the rights, safety, and security of our users and the Service.
• Business transfers — in connection with a merger, acquisition, or sale of assets, with notice where required.

Data retention

We keep personal data for as long as your account is active or as needed to provide the Service, and thereafter only as required to meet legal, accounting, or security obligations. You can ask us to delete your account and associated content at any time.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these rights, contact us at the address below. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

Security

We use technical and organizational measures — including encryption in transit, access controls, and tenant isolation for agent sessions — to protect your data. No method of transmission or storage is perfectly secure, but we work to protect your information and to respond promptly to any incident.

International transfers

We may process and store data in countries other than your own. Where we transfer personal data across borders, we rely on appropriate safeguards, such as standard contractual clauses, to protect it.

Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the Service.