Privacy Policy

Maestrio (“Maestrio,” “we,” “our,” or “us”) operates the AI coding-agent platform available at maestrio.ai (the “Service”). This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, and what rights you have over it.

Maestrio is operated by SEM NEURA TECNOLOGIA DA INFORMACAO LTDA, a Brazilian company. The Service is offered from Brazil and is intended for Brazilian customers. Maestrio does not maintain an establishment or representative in the European Union or the United Kingdom and does not intentionally offer the standard Service to, or monitor the behavior of, people in those regions. If that business scope changes, or a customer requires processing subject to another jurisdiction, the applicable terms and safeguards must be reviewed before that processing begins.

This policy applies to two distinct groups of people, and it is important to understand the difference:

• Account holders (“you”): Developers and teams who create a Maestrio account, integrate the platform into their products, and manage projects through the dashboard. Maestrio is the controller of your personal data — we decide how and why it is processed, and this policy governs that relationship fully.
• End users of your product: The people who submit feedback through the Maestrio JavaScript widget that you embed in your own web application. You (the Maestrio customer) are the controller of your end users' data; Maestrio processes that data as your processor on your documented instructions under the applicable Data Processing Agreement. If you are an end user of a product that uses Maestrio's widget and want to exercise privacy rights over data submitted through that widget, please contact the operator of that product directly — we will assist that operator in fulfilling your request.

a. Account and Identity Data

When you create an account we collect your name, email address, and — if you choose email/password sign-in — a securely hashed version of your password (we never store your password in plain text). If you sign in with Google, we receive and store an OAuth token and your profile image URL from Google. Your organization name and organization slug are also collected when you set up a workspace.

b. Usage and Device Data

When you access the Service, we automatically collect your IP address, browser user agent string, and session information (including session tokens, which are stored hashed). We also collect aggregate usage metrics such as monthly agent-run counts to enforce plan limits and monitor service health.

c. GitHub and Repository Data

To power automated pull-request creation, you grant Maestrio access to your GitHub repositories through the GitHub App integration. We store your GitHub App installation ID and GitHub username. Repository names and code contents are accessed transiently during agent runs — only the specific files needed to complete a task are read at runtime. We do not continuously mirror or archive your repositories.

d. Support and Communications

If you contact us by email or through support channels, we collect the content of those communications and your contact details in order to respond to you.

e. Billing Data

When paid plans become available, billing will be handled by Stripe. Maestrio will store only your Stripe customer ID, subscription ID, and plan tier (e.g., free, pro). We will never receive or store raw payment card numbers — all payment card handling occurs directly within Stripe's PCI-compliant infrastructure.

f. End-User Widget Data (Processor Role)

When your end users submit feedback through the Maestrio widget you embed in your product, the following data is transmitted to Maestrio's servers and processed on your behalf:

• Feedback content: The title and description entered by the end user, and the feedback type (bug report or feature request).
• DOM element snapshots (pointedElements): CSS selector, HTML tag name, visible text content, and inner HTML of UI elements the end user interacted with at the time of submission. This data helps our AI agents understand the context of the reported issue.
• End-user properties (endUserProperties): Arbitrary JSON attributes you choose to pass from your application — for example, user email, user ID, account tier, or other attributes. You control what is included; do not pass sensitive data you do not intend to share with Maestrio.
• Vector embeddings: Maestrio generates 1,536-dimensional numerical vector representations of feedback content (using AI embedding models) and stores them in our database solely to power duplicate-detection — finding and grouping related pieces of feedback. Embeddings do not contain raw text but are derived from it and are therefore personal data under applicable law.

Important: As a Maestrio customer (controller), you are responsible for ensuring your end users have been informed about and have consented to the collection of the above data where required by applicable law (e.g., GDPR, LGPD). Maestrio's Data Processing Agreement governs this processing relationship.

g. Analytics Data

We use Google Analytics on the landing page for aggregate website measurement and PostHog on the landing page and dashboard for product analytics. Browser analytics collect clickstream events, page views, and session metadata only after you provide explicit consent via our cookie banner (see Section 10, Cookies). Dashboard server-side product events are sent to PostHog only when the dashboard consent preference is present. You may withdraw consent at any time through Cookie settings.

h. Log and Trace Data

Maestrio uses Grafana Cloud Loki for log aggregation and Grafana Cloud Tempo for distributed tracing. These systems may capture server-side log lines that include IP addresses, request paths, user IDs, and error messages in order to diagnose incidents and monitor service reliability. Log and trace data is retained for 90 days.

We use personal data only for the purposes listed below. For Brazilian processing, the applicable LGPD basis is identified where relevant.

Automated Decision-Making

Maestrio's AI triage agent uses automated processing to classify and score feedback submissions (e.g., deduplication scores, triage categorization). This does not produce legal effects or similarly significant effects on End Users. Account-holders may contact us to understand the logic involved in any automated scoring.

Required vs. Optional Data

Providing your name and email address is required to create an account — it is a contractual requirement without which we cannot provide the Service. Providing analytics data (PostHog) is voluntary; declining analytics consent does not prevent you from using the Service.

Legal Bases Under Brazil's LGPD (Art. 7)

Brazil's Lei Geral de Proteção de Dados (LGPD) provides its own set of legal bases For Brazilian data subjects, we rely on the following LGPD Art. 7 bases:

We send email communications via Resend in two categories:

• Transactional emails (account verification, password resets, billing receipts, security alerts, plan change notices, and material Terms updates) are required service communications and cannot be opted out of while your account is active.
• Commercial or marketing emails (new feature announcements, newsletters) may be opted out of by clicking “Unsubscribe” in any such email. We honor opt-outs within 10 business days.

We do not sell or rent your personal data. We do not share personal data with third parties for their own marketing or advertising purposes. We share data only with the subprocessors listed below, and only to the extent necessary to provide the Service. A current subprocessor list is maintained below; we will provide 30 days' notice before adding a new subprocessor that materially changes the processing of your data.

† Linear is an optional integration activated only by customer choice. It is not a default subprocessor and is not subject to the 30-day sub-processor change notice procedure.

Other disclosure scenarios

• Legal process: We may disclose personal data to comply with a valid court order, subpoena, law enforcement request, or other legal obligation. Where permitted by law, we will notify you before complying.
• Business transfers: If Maestrio is acquired, merges with another entity, or transfers substantially all of its assets, personal data may be transferred as part of that transaction. We will notify you via email and a prominent notice on our website at least 30 days before personal data becomes subject to a different privacy policy.
• Protection of rights: We may share information where necessary to protect the rights, property, or safety of Maestrio, our customers, or others.

Maestrio's primary infrastructure is hosted in the United States on Railway and processed on Cloudflare's global edge network, which may route requests through nodes in multiple countries. When you use the Service, your personal data may be transferred to and processed in the United States and potentially other countries that may not provide the same level of data-protection law as your home country.

Brazil residents: For transfers from Brazil under the LGPD, Maestrio relies on the necessity of the transfer for the performance of the contract to which the data subject is party (LGPD Art. 33, V), with the safeguards required by applicable Brazilian law.

The standard Service is not offered as an EU/UK-targeted service. If a Customer instructs Maestrio to process EU/UK data or otherwise brings that processing within GDPR or UK GDPR scope, the parties must agree the required transfer mechanism and additional terms before that processing begins.

• Account data: Retained for as long as your account is active. Upon account deletion (see Section 9 for how to request deletion), we will delete or anonymize your personal account data within 90 days of the deletion request, except where we are required to retain it by law (e.g., tax and financial records, which may be retained for up to 7 years).
• End-user widget data (feedback, DOM snapshots, endUserProperties): Retained for as long as the associated Maestrio project exists. Deleting a project will delete all feedback records and associated data for that project.
• Vector embeddings: Deleted when the associated project is deleted.
• Session data: Session tokens expire in accordance with our authentication configuration. Expired sessions are purged automatically.
• Log and trace data: 90 days for logs and traces.
• Billing records: We retain billing and payment records as required by applicable tax and financial laws, typically 7 years.

Depending on where you live, you have various rights over your personal data. To exercise any of these rights, please contact us at [email protected]. For Brazilian requests, we respond within the period required by the LGPD. If another mandatory law applies to a particular request, we will follow that law.

• LGPD: We will respond within 15 days from the date of the request.

We will not charge a fee unless permitted by applicable law.

Rights available to all users

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate or incomplete data.
• Deletion (erasure): Ask us to delete your personal data. We will comply subject to any legal retention obligations.
• Portability: Receive a copy of your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Restrict processing: Ask us to pause processing your data in certain circumstances.
• Withdraw consent: Where processing is based on your consent, withdraw it at any time without affecting the lawfulness of prior processing.

Brazil (LGPD — Article 18)

If you are in Brazil, you have the following rights under LGPD Art. 18:

• Art. 18(I): Confirmation that your data is being processed.
• Art. 18(II): Access to your data.
• Art. 18(III): Correction of incomplete, inaccurate, or outdated data.
• Art. 18(IV): Anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in non-compliance with the LGPD.
• Art. 18(V): Portability to another service provider (upon ANPD regulation).
• Art. 18(VI): Deletion of data processed with your consent.
• Art. 18(VII): Information on public and private entities with which your data has been shared.
• Art. 18(VIII): Information on the possibility of not providing consent and the consequences of doing so.
• Art. 18(IX): Revocation of consent.

Contact us at [email protected] or the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

Brazil (LGPD) — Data Protection Officer / Encarregado: Magdiel Kessler Oliveira Duarte. You may direct LGPD requests to [email protected].

California (CCPA / CPRA — California residents)

Categories of Personal Information Collected (12-Month Lookback)

The following table discloses the categories of personal information we have collected about California residents in the 12 months preceding the date of this policy, along with the sources, purposes, and third parties with whom each category is shared.

We do not sell or share personal information as defined under CCPA/CPRA. We have not done so in the preceding 12 months. The above disclosure covers the 12-month period preceding the date of this policy.

California residents have the right to: know what personal information we collect, disclose, or sell; delete personal information we hold about them (subject to exceptions); correct inaccurate personal information; opt out of the sale or sharing of personal information; and not be discriminated against for exercising these rights.

In response to a verifiable request to know, we will disclose personal information collected, disclosed, sold, or shared in the 12 months preceding your request.

Do Not Sell or Share: Maestrio does not sell personal information, and does not share personal information for cross-context behavioral advertising purposes. We disclose certain personal information to service providers (such as PostHog for analytics and Railway for hosting) under written contracts that prohibit those service providers from using your data for any purpose other than providing services to Maestrio. These disclosures are business-purpose disclosures, not “sales” or “sharing” under CCPA/CPRA. Contact [email protected] with any questions.

Sensitive Personal Information: IP addresses are used for security and aggregate analytics. IP-based geolocation typically resolves to city or regional level and does not constitute “precise geolocation” as defined under CPRA (§1798.140(ae)), which requires accuracy within a 1,850-foot radius. We do not use IP addresses to derive precise geolocation. We do not use or disclose sensitive personal information for purposes requiring a “Limit Use of My SPI” link under Cal. Civ. Code §1798.121.

Do Not Track: Your browser may send a “Do Not Track” (DNT) signal. Our Service does not currently respond to DNT signals because no universally accepted technical standard for DNT response exists. PostHog analytics are governed by your cookie consent choice, not your browser's DNT signal.

California Shine the Light (Cal. Civ. Code §1798.83): Maestrio does not disclose personal information to third parties for their own direct marketing purposes. This section of California law does not apply to our current data-sharing practices.

When Maestrio processes personal data on behalf of a business customer (e.g., end-user widget data submitted through a customer's product), Maestrio acts as a “service provider” under the CCPA with respect to that data. To exercise your California rights over such data, contact the business customer (operator of the product) directly.

To submit a verifiable consumer request, contact us at [email protected]. You may also designate an authorized agent by providing written authorization and verifying your identity directly with us.

Other U.S. State Privacy Rights

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other U.S. states with comprehensive privacy laws may have similar rights to those described in the California section above, including rights to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of targeted advertising. To exercise these rights, use the same contact information provided in the California section above.

Account deletion (all users)

Account deletion is currently a manual process. To request deletion of your account and associated personal data, email us at [email protected]. Self-service account deletion is not yet available in the dashboard. Data export is also not yet available in self-service form; contact us to request a data export.

We use essential session cookies on the Maestrio dashboard and optional analytics technologies on the landing page and dashboard:

Strictly essential cookies

We set a session cookie managed by Better Auth (our authentication library) to keep you signed in. This cookie is strictly necessary for the Service to function — it cannot be disabled without breaking authentication. It does not track you for marketing purposes.

Analytics cookies and local-storage keys (non-essential — ph_* prefix)

Google Analytics may set _ga cookies on the landing page. PostHog sets cookies prefixed with ph_ to track page views, feature interactions, and session replay data so we can understand how the product is used and improve it. A consent-preference cookie (__ph_opt_in_out_*) is also set to remember your analytics consent choice.

Analytics technologies are only loaded after you provide explicit opt-in consent via the cookie banner shown on your first visit. Declining or ignoring the banner means no optional analytics technologies are loaded.

How to manage and revoke consent

You can withdraw analytics consent at any time through Cookie settings in the landing page footer or the dashboard cookie preferences control. You can also block or delete cookies through your browser settings. Note that blocking strictly essential cookies will prevent sign-in.

For full details, including a complete list of cookies set, see our Cookie Notice.

The Maestrio Service is designed for professional use by software development teams and is not directed to anyone under the age of 18. We do not knowingly collect personal data from children under 18.

If we become aware that we have collected personal data from a person under 18 without verification of parental consent, we will take steps to delete that information as promptly as possible. If you believe we have inadvertently collected data from a minor, please contact us at [email protected].

We implement technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include:

• HTTPS encryption for all data in transit between your browser, the Maestrio dashboard, and our APIs.
• Hashed storage of passwords (using a secure modern hashing algorithm) and API keys — we never store these in plain text.
• Session tokens stored in hashed form in the database.
• MCP OAuth tokens stored in hashed form.
• Access controls limiting which team members and automated systems can access production data.

No system connected to the internet can be completely secure. While we work hard to protect your data, we cannot guarantee that unauthorized access, hacking, or data loss will never occur. If you discover a security vulnerability, please disclose it responsibly by emailing [email protected].

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.

For material changes — those that meaningfully expand how we collect or use personal data, add new sharing with third parties, or reduce your rights — we will provide at least 30 days' notice before the change takes effect by sending an email to the address on your account and posting a prominent notice on our website.

For non-material changes (corrections, clarifications, additions of new optional features), we will update the “Last updated” date at the top of this page without advance notice. Continued use of the Service after the effective date of any change constitutes acceptance of the updated policy. We encourage you to review this page periodically.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: