Who we are

Multilo ("Multilo", "we", "us") provides the Multilo website, desktop application, and related academic-writing services, and is the controller responsible for the personal information described in this policy. For privacy questions or to exercise your rights, contact us at support@multilo.com.

Scope of this policy

This policy covers personal information we process when you visit the website, create an account, download or use the desktop app, subscribe to a paid plan, connect third-party services such as GitHub, or contact support. It does not cover third-party websites or services that have their own privacy policies, or content you choose to share with third parties through integrations you enable.

Information we collect

We collect the information needed to operate the website, desktop app, subscriptions, and support workflows.

Information you provide

• Account details such as name, email address, profile image, sign in provider, role, and account status.

• Messages, files, prompts, or other content you choose to submit through the app or connected features.

Information collected automatically

• Desktop app information such as account connection events, app version, operating system details, project details, agent usage, model selections, timestamps, and diagnostics or crash reports when you choose to enable them.

• An approximate country (for example “United States”) derived from your IP address when you sign in or your desktop app connects. We store only the resulting country code for product analytics, security, and regional compliance — we do not keep the raw IP address alongside your account.

Information from third parties

When you sign in with Google or connect GitHub, we receive basic profile information (such as your name, email, and avatar) from that provider. When you subscribe, Stripe shares billing status and identifiers with us. We combine this with your account so the service works.

• Subscription records such as plan, status, Stripe customer ID, Stripe subscription ID, price ID, renewal period, and cancellation status.

• Optional GitHub connection information when you connect GitHub for project creation.

How we use information

• Authenticate users and connect the desktop app.

• Provide AI agent, model access, usage, and project features.

• Manage free and paid subscription limits.

• Process billing events, cancellations, and account support.

• Understand which countries our users are in to prioritize features, languages, and regional compliance.

• Diagnose errors, prevent abuse, and improve reliability.

• Comply with legal, tax, security, and payment obligations.

AI processing and your content

Several Multilo features chat, agents, and inline suggestions work by sending the content you choose to act on (your prompt, selected text, document context, and any images you attach) to an AI model provider that generates a response. This only happens when you trigger the feature.

• Content is sent over an encrypted connection to the model provider for that request (currently Anthropic, OpenAI, and/or Google, depending on the model you pick).

• We send the minimum context the feature needs. We do not send your file names, project paths, or IP address to the model provider.

• We instruct providers not to retain content for training where that control is available to us (for example, requesting no-storage handling on supported endpoints). Providers may retain limited data briefly for abuse monitoring under their own terms.

• AI output can be wrong or incomplete. You are responsible for reviewing AI-assisted work before you rely on, submit, or publish it.

• Sending content to a model provider is required for these features to function. If you do not want your content processed by an AI provider, do not use the AI features; the rest of the app still works.

The specific providers we use can change as we add or remove models. The active list of model providers is reflected in the app's model picker and in our list of service providers below.

Payments

Payments are processed by Stripe. We do not store full credit card numbers or bank account details on our servers. Stripe provides us with billing status, subscription identifiers, customer identifiers, and related payment details so we can provision and support paid plans.

Service providers we share data with

We share limited personal information with vendors that process it on our behalf to run the service. Each is bound by contract to use the data only to provide their service to us. We do not sell personal information to any of them.

We may add or change providers as the product evolves. We update this list when our core processors change.s.

Cookies, local storage, and device identifiers

We keep our use of browser storage minimal. Analytics and advertising cookies are set only if you accept them in our cookie banner never before you consent, and never for essential features to work.

• Essential cookies used to keep you signed in and secure your session on the website. The service does not work without these.

• Local storage on your device remembers your theme, interface language, and which legal and AI-processing notices you have accepted. This stays on your device.

• Analytics and advertising cookies set by Google Analytics, Microsoft Clarity, and the Meta (Facebook) pixel to measure how the website is used, record how visitors interact with pages, and support our advertising. These load only after you accept them in our cookie banner, and you can withdraw consent any time via “Cookie settings” in the footer.

• Device identifier when you opt in to desktop telemetry, the app generates a random identifier stored locally. It is never linked to your email, account, or hardware, and you can delete it any time in Settings → Privacy.

You can review or withdraw your choice at any time using the “Cookie settings” link in the website footer. We also treat a Global Privacy Control or "Do Not Track" signal as an opt-out of non-essential analytics where applicable.

For the full list of every cookie we set, see our Cookie Policy.

Your privacy rights

Subject to your location and applicable law, you have the following rights over your personal information. We will not discriminate against you for exercising them.

• Access request a copy of the personal information we hold about you.

• Correction ask us to fix inaccurate or incomplete information.

• Deletion ask us to delete your personal information, subject to legal retention limits.

• Portability receive certain information in a portable, machine-readable format.

• Restriction and objection ask us to limit or stop certain processing, including processing based on legitimate interests.

• Withdraw consent where processing is based on consent (such as product-improvement collection or optional telemetry), withdraw it at any time without affecting prior processing.

• Complain lodge a complaint with your local data protection authority.

How to exercise your rights

Email support@multilo.com or use the controls in your account and the desktop app. We may need to verify your identity before acting on a request. We respond within the timeframe required by applicable law. You can authorize an agent to make a request on your behalf where the law allows.

Deleting your account and data

You can delete your account from your account settings or by emailing support@multilo.com. When you delete your account we cancel any active subscription, send you a confirmation, and remove your personal records from our systems in bounded batches. Some data may be retained only as long as required for legal, tax, security, or dispute-resolution purposes, after which it is deleted. Anonymous telemetry tied to a device identifier can be deleted separately from Settings → Privacy.

Security

We use reasonable administrative, technical, and organizational safeguards for customer information, including encryption in transit, access controls, and hashed credentials. No online service can guarantee absolute security, so customers should use strong account credentials and protect desktop connection credentials. If we ever experience a breach affecting your information, we will notify you and regulators as required by law.

Children and students

Multilo is intended for students, researchers, and adult academic users. It is not directed to children under 13. Do not submit personal information from children under 13 unless you have the authority and verified consent required by applicable law. Minors should use the service only with appropriate parent, guardian, school, or institutional permission.

Changes to this policy

We may update this policy as the product and the law change. We will post the updated version here with a new "last updated" date, and for material changes we will provide additional notice where appropriate. Your continued use of the service after an update means you accept the revised policy.