MUJO AI PRIVACY POLICY

Date: 23 September 2026

Plain-language summary

MUJO AI SDN. BHD. ("MUJO", "we", "us") collects the information needed to operate our AI creative platform, manage accounts, deliver generations, support team collaboration, process payments, protect the Service, and improve its features. We send the content needed for a requested generation to third-party AI providers and infrastructure partners. MUJO does not use customer inputs or outputs to train or fine-tune its own foundation or general-purpose generative AI models. Third-party providers have different contractual terms and may temporarily retain information; we do not make an unqualified no-training or zero-retention promise on their behalf. We use Creative Memory to personalize recommendations and may learn from properly anonymized, aggregated usage patterns. We do not sell personal information for money. Advertising technologies may constitute "sharing" or "sale" under certain privacy laws and are subject to the applicable choice mechanisms. You may request access, correction, export, or deletion, subject to applicable law and limited retention exceptions.

This summary is for convenience; the full Policy controls.

1. Scope and who is responsible

1.1. This Privacy Policy explains how MUJO AI SDN. BHD. processes personal data through mujoai.com, its AI generation and editing tools, AI Avatar, Creative Memory, prompt library, collaboration and business workspaces, affiliated websites, support channels, and related services (collectively, the "Service").

1.2. For personal information collected to administer accounts, billing, security, customer support and MUJO's own business operations, MUJO generally determines the purposes and means of processing. Where an organization uses a Workspace and directs processing of personal data contained in its projects, MUJO may act as its data processor/service provider for that content, as specified in a separate agreement where applicable. The organization remains responsible for its instructions, user permissions and lawful basis for uploading its materials. Some processing may involve separate responsibilities of third-party AI providers under their applicable terms.

1.3. This Policy applies alongside our Terms & Conditions, any applicable organizational agreement and any Data Processing Addendum ("DPA"). Where a DPA applies, its provisions govern the processing covered by that DPA in the event of conflict.

2. Categories of data we collect

2.1. Account and contact information: name, email, login and authentication data, organization and role, settings, language, communication preferences and support correspondence.

2.2. User and Workspace content: prompts, reference images, uploaded photographs, video, audio, product and listing data, files, generated images and videos, workflow and node settings, project names, shared assets, comments, approval decisions, and other materials submitted through the Service ("Customer Content"). Some materials may contain personal data about individuals other than the account holder.

2.3. AI Avatar and likeness information: photographs, video, facial appearance and other visual or audio characteristics submitted to create or use an avatar. Depending on the functionality and technology used, automated systems may analyze features of a person's likeness. Do not upload another person's likeness or other personal information without the rights and permissions required by law. If any activity requires special-category or biometric-data consent under applicable law, the relevant user or organization must secure it before submission, and MUJO will implement any additional consent requirements applicable to its own processing.

2.4. Usage and Creative Memory information: generation history, prompts and parameters, model selections, camera and lighting controls, download/publish/reuse events, edits, reviews, preferences, recommendation interactions, subscription usage and credit records. We may analyze Customer Content and associated metadata to generate contextual recommendations and identify patterns of usage.

2.5. Billing and transaction information: plan, purchase history, transaction identifiers, billing address, tax information, limited card details made available by payment processors (such as card brand and last four digits), and payment status. MUJO does not need to store a full payment-card number for normal subscription processing.

2.6. Device, diagnostic and online activity information: IP address, approximate location derived from IP, browser, operating system, device identifiers, logs, referral and affiliate identifiers, pages visited, clicks, interaction or session events, error reports, and cookie or pixel identifiers.

2.7. Communications and marketing information: email-delivery and engagement data, campaign identifiers, survey responses, communication preferences and requests to exercise privacy rights.

2.8. We obtain data directly from you, your Workspace administrator, your device, third-party sign-in or payment services where used, and service providers acting on our behalf. We do not seek unnecessary sensitive personal data; please avoid including it in prompts or uploads unless essential and lawful.

3. Purposes and lawful bases

3.1. We use personal data to: (a) register and authenticate users; (b) provide generations, editing, storage, exports and team collaboration; (c) manage subscription and credit balances; (d) answer support requests; (e) protect the Service, detect abuse and investigate fraud; (f) maintain, debug and improve reliability; (g) deliver Creative Memory recommendations and measure whether they are helpful; (h) create aggregate, appropriately anonymized product insights and improve non-foundation algorithms, including recommendation and model-routing logic; (i) send essential service and legal notices; (j) undertake analytics and marketing where permitted; and (k) meet legal, tax and regulatory duties.

3.2. Where the EU/EEA or UK GDPR applies, our legal bases may include performance of a contract (core Service and billing), legitimate interests (security, support, proportionate product analytics and improvement), legal obligations (records, compliance), and consent where required (non-essential cookies, certain marketing or other optional processing). We assess the appropriate basis for each activity; contractual acceptance is not a substitute for consent where the law requires separate, freely given consent.

3.3. We do not use Creative Memory to make solely automated decisions that produce legal or similarly significant effects on individuals. Recommendations about creative controls, model choices and workflows are assistive and can be ignored.

4. AI generation and third-party providers

4.1. To provide a requested AI generation or editing function, MUJO may transmit the Customer Content and technical information reasonably necessary for that function, including prompts, images, video, audio, instructions and relevant metadata, to third-party AI model providers, API intermediaries, hosting and security partners. These providers process the information under their applicable contractual, security and legal arrangements.

4.2. MUJO does not use Customer Content to train or fine-tune its own foundation or general-purpose generative AI models. MUJO uses Customer Content and usage signals to provide the Service and automatic Creative Memory personalization, and may use appropriately anonymized aggregate patterns to improve analytics, recommendations, routing and other non-foundation software algorithms, as described in Section 5.

4.3. Third-party AI providers may temporarily retain or otherwise process transmitted information for operational, security, abuse-prevention or legal purposes. Their training, logging, retention and geographic-processing terms may differ by provider, API route, contract and configuration. MUJO does not guarantee that all providers follow identical no-training or zero-retention policies. Additional protections for a particular organizational customer apply only when expressly agreed and supported by the relevant provider arrangements.

4.4. Information about material categories of AI service providers and, where legally or contractually required, the relevant subprocessors is available upon request at [email protected]. MUJO may change providers as the Service evolves, subject to applicable notification and contractual requirements. The current Privacy Policy does not list each available model.

4.5. Generated outputs may contain personal information or resemble existing works. Users are responsible for assessing lawful use, notices and any required permissions before publishing or sharing outputs.

5. Creative Memory and cross-user insights

5.1. Creative Memory operates automatically as part of the Service. It analyzes prompts, generated outputs, settings, model choices, edits, downloads, reuse, publication and review/approval feedback to suggest relevant creative controls, workflows and model options. In organization accounts, authorized administrators and team members may have visibility into activity and review records according to assigned permissions.

5.2. MUJO may derive aggregated and appropriately anonymized insights across accounts, including the frequency of feature use, model performance patterns, common control combinations and user-response signals. We do not place a customer's original private images, identifiable prompts or identifiable review comments into another customer's Creative Memory.

5.3. Pseudonymized records remain personal data where a person can reasonably be re-identified and remain subject to this Policy and applicable privacy law. We treat information as anonymous only after taking appropriate steps to prevent reasonable identification or reconstruction. We do not use personal Customer Content to train our own foundation or general-purpose generative AI models.

5.4. Creative Memory is enabled by default and the Service does not currently offer a separate in-product switch to disable it. You may contact [email protected] to exercise any applicable rights of access, correction, objection or deletion concerning associated personal information, subject to applicable law, necessary Service processing and Workspace rights. An acknowledgment of this Policy is not a substitute for separate consent where legally required.

6. Analytics, advertising, cookies and affiliate tracking

6.1. We use strictly necessary cookies and similar technologies for login, security, session continuity and essential settings. We may also use Google Analytics, Microsoft Clarity, Meta Pixel, TikTok Pixel where enabled, affiliate tracking, and email analytics to understand site use, measure campaigns, attribute referrals and improve communications.

6.2. Non-essential analytics, session measurement and advertising technologies are subject to consent or other legally required choice mechanisms. Where required, they will not be activated before a valid choice. Users can change their preferences using the cookie controls provided on the Service or contact [email protected] if a control is unavailable. Browser controls may also restrict certain technologies.

6.3. Advertising partners may receive online identifiers, device and browser information, page/event information and conversion signals. We do not sell personal data for monetary consideration. However, sharing data through advertising pixels may constitute a "sale" or "sharing" for cross-context behavioral advertising under California law. Where applicable, users may opt out through our privacy/cookie controls or by contacting us. We recognize legally applicable opt-out preference signals.

6.4. Our affiliate program may use an fp_ref referral cookie with a nominal 90-day, last-click attribution window, subject to consent requirements, browser restrictions and applicable program rules. Email messages may use delivery and engagement measurement, subject to applicable law and communication preferences.

6.5. Essential service, payment, security or legal notices are not marketing messages. You may unsubscribe from promotional emails using the unsubscribe link or by contacting us.

7. Who receives personal data

We disclose relevant data only as reasonably necessary to: (a) cloud hosting, storage, content delivery, infrastructure and security providers; (b) AI model and API providers; (c) billing and payment processors; (d) analytics, advertising, affiliate and email delivery providers where applicable; (e) authorized members and administrators of your Workspace; (f) advisers and affiliates under appropriate confidentiality arrangements; (g) competent authorities where required by law or valid legal process; and (h) a successor in a merger, acquisition or restructuring, subject to applicable privacy requirements. We do not publicly display Enterprise Customer Content or use it in our portfolio, advertisements or case studies without separate authorization.

8. Cross-border processing

MUJO is established in Malaysia and may use providers or infrastructure in Malaysia, Singapore, the United States, the EEA and other locations relevant to the Service. Applicable transfer mechanisms and safeguards depend on the location, type of data and receiving entity. Where legally required, we implement appropriate contractual and other safeguards, including relevant standard contractual clauses or equivalent arrangements when applicable. No single transfer mechanism necessarily covers every provider or transaction. Contact us for details relevant to your request or organizational agreement.

9. Retention and deletion

9.1. We retain active-account and Workspace content while the relevant account or Workspace remains in use, unless a shorter period applies or the user or organization deletes it. Access to organizational content may be controlled by its administrator.

9.2. After an account or Workspace deletion request has been verified and become effective, we target deletion of associated personal Customer Content from active MUJO systems within 7 days, subject to legitimate holds, mandatory records and technical exceptions. Deleted material may remain in restricted rolling backups for up to 30 days, after which it is overwritten or purged in the normal backup cycle. Restored backups will be subject to the deletion request again.

9.3. Routine security and diagnostic logs are generally retained for up to 90 days, unless a longer period is necessary for an actual investigation, dispute, security incident or legal obligation. Financial and tax records are retained for the applicable statutory period, which may be up to 7 years or longer where required.

9.4. Creative Memory associated with an identifiable deleted account is deleted on the same active-system and backup schedule, subject to the above exceptions. Properly anonymized aggregate statistics that cannot reasonably identify an individual may be retained for ongoing analysis. Provider-side copies are subject to the applicable provider arrangements and legal retention duties; MUJO cannot promise that a provider's independently required safety logs are deleted on the same schedule as MUJO's systems.

9.5. You may request deletion by writing to [email protected]. We may need to verify identity or organizational authority. Deleting an account may make projects and purchased credits inaccessible; see our Terms & Conditions. We will explain any legal or operational grounds for retaining specific information.

10. Security and incidents

We implement proportionate technical and organizational controls, including access restrictions, encryption in transit, appropriate protection of stored data, security monitoring and personnel access controls. No service can guarantee absolute security. We assess and respond to suspected personal-data incidents and notify affected individuals and competent authorities where required by applicable law. Keep your credentials secure and inform us promptly of suspected account misuse.

11. Your privacy rights and choices

Depending on your location and the processing involved, you may have rights to access, correct, delete, restrict or object to processing; receive portable data; withdraw consent without affecting prior lawful processing; and complain to a supervisory authority. These rights may be limited by lawful exemptions, other users' rights or organizational obligations.

For California residents where the CCPA applies, relevant rights may include knowing, correcting and deleting data, opting out of sale/sharing for cross-context behavioral advertising, limiting certain uses of sensitive personal information and non-discrimination for exercising rights. We do not condition use of the core Service on consent to optional marketing or advertising cookies where such consent is required.

For users of an organizational Workspace, we may direct requests about organization-controlled project data to the relevant organization or assist it in responding. Requests may be submitted to [email protected] or [email protected]. We will respond within the period required by applicable law, after any necessary verification.

12. Children and third-party references

The Service is intended for adults aged 18 or over, or a higher age of majority where applicable. We do not knowingly provide accounts to children. Users who upload another person's photograph, likeness, voice or other information must have all rights, permissions and notices required for that use and must not submit material that unlawfully exploits, impersonates or violates a person's privacy.

13. Changes to this Policy

We may revise this Policy to reflect changes in the Service, providers, privacy practices or law. We will post the new version with its date and notify affected users of material changes through the Service and, where appropriate or legally required, by other means. We may require an in-product acknowledgment of the revised Policy. Where a new processing activity legally requires separate consent, an acknowledgment of this Policy does not replace that consent. We maintain records of document versions and user acknowledgments.

14. Contact and company information

MUJO AI SDN. BHD.

Registration No.: 202301037167 (1531090-V)

Registered address: 7-2, PLAZA DANAU 2, JALAN 2/109F, TAMAN DANAU DESA, KUALA LUMPUR, WILAYAH PERSEKUTUAN, 58100, MALAYSIA

Business address: B-08-03, SENADA RESIDENCES KLGCC RESORTS, JALAN BUKIT KIARA 1, BUKIT KIARA, 60000, KUALA LUMPUR, Malaysia

Email: [email protected] | [email protected]

Phone: +60 3-7721 4000

For privacy questions or rights requests, please use the email addresses above.