Privacy Policy

01 — Who we are

Majr Technology Corporation ("MAJR", "we", "us") operates majr.app and the MAJR Agent Services APIs. Our registered address is 2219 95th Ave NE, Clyde Hill, WA 98004, and our privacy contact is support@majr.app. We have no establishment in the EU or the UK and do not target or monitor people there, so we have appointed no Article 27 representative. If that changes, this section names one before the change takes effect.

We are the controller for information about people who visit majr.app or request an access token. For the content your agents and applications send through our APIs — "Service Data" — we act as a processor on your behalf, under our Terms of Use.

02 — What this covers

This policy covers the majr.app website, the MAJR Agent Services APIs and their HTTP, MCP, and OpenAPI interfaces, and the support channels attached to them. It does not cover third-party services you connect to, even where we link to them.

03 — What we collect

From the website. Only what you type into the access form:

• Your email address, and the optional description of what you are building.
• Your IP address, read from the Fly proxy and held in memory only, to rate-limit the form to five submissions a minute. It is not written to storage and does not survive a restart.
• A hidden field that only automated submitters fill in, used to discard them.

The website sets no cookies. It runs no analytics, no tag manager, no advertising pixel, and no cross-site tracking of any kind. Pages are static files; nothing on them profiles you.

From the APIs. When your agents call a service, we handle:

• Service Data — the inputs your agents send (prompts, text, media, files, URLs, records) and the outputs we return.
• Service logs — endpoint, timestamp, latency, status code, request and response sizes, the capability invoked, unit counts, and the identifier of the API key used. Metadata about the call, not its contents.
• Error reports — the type and stack trace of a failure. Our error reporting is configured to exclude personal data, never to attach request bodies, never to ship the local variables in a stack frame, and never to include model prompts; exception messages and breadcrumb contents are stripped before an event leaves the service. What we receive is the shape of a failure, not the data that hit it.
• Usage analytics — counts and identifiers only: which capability ran, over which interface, how long it took, whether it succeeded. The identity attached to these events is the calling product, never a person.

We collect no payment information, because billing is not enabled during beta.

04 — How we use it

05 — Who we share it with

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as California law defines those terms. We disclose it only to the subprocessors below, to legal or safety recipients where the law requires it or where it is needed to protect our users or the public, and to a successor entity in a merger or asset sale, subject to this policy or a successor policy with notice to you. Where we are lawfully able to, we will tell you before handing over your Service Data in response to a legal demand.

One detail worth stating plainly: an email address submitted to the access form is stored in a single contact record shared across MAJR products, stamped with majr.app as its source. Requesting a MAJR token does not subscribe you to anything, and if you have already unsubscribed from MAJR email, submitting this form does not resubscribe you.

We process data in the United States. The website runs in Fly’s iad region and the APIs in sjc. For transfers out of the EEA, the UK, or Switzerland we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum, alongside encryption in transit and at rest.

06 — AI models and training

We do not use your Service Data to train, fine-tune, or otherwise improve foundation models — ours or anyone else’s.

• Anthropic is our only model provider. Service Data goes to it only as far as fulfilling your request requires, and only to a model on a fixed allowlist — a request naming anything else is rejected before it reaches them. Under Anthropic’s commercial terms your inputs and outputs are not used to train their models. They may hold them for up to 30 days to enforce their own safety policies, and delete them after that. We have not signed a zero-retention agreement with them, and we would rather tell you that than imply a stronger guarantee than we have.
• We hold the model provider’s credentials so that you never have to. Your API key authenticates you to us; it is stored hashed, scoped to the services it may call, and can be rotated or revoked without downtime.
• A person reads Service Data only to investigate an incident you report or abuse we suspect. That access is limited to authorised personnel and is logged.
• We keep aggregated, de-identified metrics — counts, latencies, error rates, which capabilities get used — that cannot reasonably be tied back to you, and we do not try to re-identify them.
• If we ever want to use Service Data to improve a model, we will ask for opt-in consent first. We will not change this section retroactively.

About the outputs. Model outputs can be inaccurate, incomplete, or wrong for your purpose. Review them before you act on them, and do not treat them as professional advice. Similar requests from other customers can produce similar or identical outputs.

About other people’s data. If you send us personal data about third parties, you confirm you have the legal basis and the notices in place to do so.

07 — How long we keep it

Beta means these windows move. A change that shortens them takes effect immediately; a change that lengthens them is announced under section 10 before it applies.

08 — Security

Traffic is encrypted with TLS in transit and data is encrypted at rest. API keys are stored hashed, are scoped to the services they may call, and can be rotated or revoked at any time. Revocation reaches the services within about a minute; if the service that checks keys is unreachable, the others keep serving the last key list they were given, and we are alerted when that list is older than our revocation window. Access to production is least-privilege and audited. We have not yet completed a SOC 2 audit.

No system is perfectly secure. Keep your API keys secret, and rotate them if you think one has been exposed. If a breach of personal data occurs, we will notify affected customers and regulators without undue delay and within the deadlines the law sets.

09 — Your rights

Depending on where you live, you can ask us to give you a copy of your personal data, correct it, delete it, export it, or restrict how we process it. You can object to processing we base on legitimate interests, and withdraw any consent you have given. California residents have the rights to know, delete, correct, and opt out of the sale or sharing of personal information — we do neither, and we honour the Global Privacy Control signal. We will not treat you differently for exercising any of these rights.

Email support@majr.app to exercise a right. We verify the request by confirming you control the account email, and answer within 30 days. You may use an authorised agent. If you are in the EEA or the UK you can also complain to your supervisory authority; in California, to the Attorney General.

Where we hold Service Data as a processor, your own end users should bring their requests to you as controller. We will help you answer them.

10 — Children, and changes to this policy

The services are not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has given us data, email us and we will delete it.

Revisions are posted here with a new date. For material changes — new categories of data, new purposes, longer retention, or any change to section 06 — we will give notice by email or in-product at least 30 days before the change takes effect.