Data Processing Agreement
Last updated: 14 October 2026
Mugatu AI, Inc. (“MugatuAI”, “we”, “us”) — publisher of Cloakworks by Mugatu AI.
A plain-language summary of the Data Processing Agreement (DPA) between Mugatu AI, Inc. and organisations that use Cloakworks. The signed agreement governs if anything here differs.
1. Roles
Your organisation is the controller. Mugatu AI, Inc. acts as a processor only for the limited account, licence and billing data needed to provide Cloakworks.
2. Prompt content stays on your devices
Cloakworks detects and masks sensitive data on the endpoint. Prompt text, files and redacted values are not sent to or stored by Mugatu AI.
3. Data we do process
Account contact details, licence keys and device activation records, and billing records handled by our payment provider. We use this data only to deliver, license and support the service.
4. Security and confidentiality
Access is limited to authorised personnel bound by confidentiality. Data is encrypted in transit and at rest. See our Information Security Policy and Compliance page for current assurance status.
5. Sub-processors and transfers
We use a small number of sub-processors for hosting, email and payments. International transfers rely on Standard Contractual Clauses where required. A current list is provided with the signed DPA.
6. Breach notice, deletion and audits
We notify you without undue delay of a personal data breach affecting your data, delete or return data at the end of the agreement, and support reasonable audit requests as set out in our Audit Rights terms.
Request a signed DPA
Email us your company name, the signer's name and title, and your seat count. We'll return a countersigned DPA.