Privacy Policy for Maskerade AI
Effective Date: November 6th, 2026
1. Introduction
Welcome to Maskerade AI. This Privacy Policy explains how Seven Variables SAS, trading as Maskerade.ai ("Maskerade," "we," "us," or "our"), handles personal data when you visit our website, use our SaaS platform, or engage with our services.
This policy is designed to comply with the General Data Protection Regulation (GDPR), the ePrivacy Directive, the California Consumer Privacy Act (CCPA) as amended by the CPRA, and other applicable US state privacy laws.
2. Our Role: Controller vs. Processor
Under data protection laws, Maskerade acts in two different capacities depending on the data being processed:
- Data Controller: We act as a Data Controller for the personal data you provide to create an account, handle billing, and for the data we collect via our marketing website. We determine the purposes and means of processing this data.
- Data Processor: We act as a Data Processor for the data you input into our platform to generate synthetic persona interactions (e.g., open text fields detailing your target personas). The processing of this data is strictly governed by our Terms of Service and an accompanying Data Processing Agreement (DPA). You, the client, are the Data Controller for this information.
3. Information We Collect and the "No PII" Policy
We primarily collect B2B data necessary to provide our services.
- Account and Contact Information (Controller): Name, business email address, and company details.
- Payment Information (Controller): Billing history and transaction records (processed securely via Stripe; we do not store full credit card numbers).
- Customer Input Data (Processor): Text descriptions detailing your key customer personas.
- Defensive PII Clause: Our platform deploys synthetic personas to analyze website structure, copy, and layout. Users are strictly prohibited from entering the Personally Identifiable Information (PII) of real individuals into the persona text fields. If you inadvertently or intentionally input PII in violation of our Terms of Service, Maskerade will apply our standard security measures to this data but reserves the right to immediately purge the unauthorized PII from our systems without notice to mitigate liability.
4. How We Use Information, AI Model Training, and Automated Decisions
We process your data on the following legal bases and for the following purposes:
- To Provide the Service (Contractual Necessity): To create your account and generate reports via our AI infrastructure.
- For Billing and Payments (Contractual Necessity): To process subscriptions.
- AI Processing and Model Training: To power our synthetic personas, we utilize third-party AI models (Gemini) and browsing automation tools (Browser-Use.com). We do not use your proprietary customer input data to train Maskerade’s own foundational AI models. Data processed through enterprise API connections with our sub-processors is strictly used to execute your specific tasks and is not retained to train their global foundational models.
- No Automated Decision-Making: We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on individuals.
- Legitimate interests: In certain specific cases, we process your personal data when it is necessary for our legitimate interests (Art. 6(1)(f) GDPR), provided those interests are not overridden by your rights and freedoms. We have conducted a balancing test for these activities, which include:
- Platform Analytics & Improvement: We analyze how users interact with the Maskerade dashboard and synthetic persona tools to debug issues, improve the underlying AI models, and enhance user experience.
- Direct B2B Marketing: We may contact existing business customers regarding new features, updates, or related services that are relevant to your use of the platform. You may opt out of these communications at any time.
- Security & Fraud Prevention: To ensure the security of our infrastructure and the integrity of the synthetic persona interactions, we monitor for unauthorized access or fraudulent activity on the platform.
5. Cookies, Tracking, and Advertising
We use cookies and tracking pixels (Google Analytics, Meta Pixel, Google Pixel, and TikTok Pixel) on our marketing website to understand visitor behavior and deliver targeted B2B advertising.
- Strict Consent (EU/UK): In accordance with the ePrivacy Directive, we will only deploy non-essential tracking cookies and pixels on your device after obtaining your explicit, opt-in consent via our cookie management banner. You may withdraw this consent at any time.
6. Third-Party Sub-processors
We use trusted third-party service providers to operate our platform. These sub-processors are contractually obligated to protect your data:
- Hosting & Infrastructure: Supabase on AWS (database and files, stored in London, United Kingdom), Google Cloud (processing, in Belgium) and Vercel (website and web app).
- AI & Automation Models: Gemini (Google) and Browser-Use.com.
- Email: Resend (product emails) and Mailgun (in the EU, the mailboxes personas use during a test).
- Payment Processing: Stripe.
- Analytics & Advertising: Google Analytics, Meta, Google Ads, and TikTok.
Sub-processor Notification: We will notify our active clients (via email or an in-app dashboard notification) prior to engaging any new sub-processors that handle customer data, providing you with the opportunity to object.
7. Data Security
We implement robust technical and organizational measures to protect your data against unauthorized access, loss, or alteration. This includes encrypting data in transit (using TLS/HTTPS) and at rest within our cloud infrastructure. Access to customer data is strictly limited to authorized Maskerade personnel who require it to maintain the platform or provide support.
8. Data Retention Policies
We retain personal data only for as long as is strictly necessary:
- Account & Platform Data: Retained for the duration of your active subscription. Upon account deletion, platform data is permanently deleted within 30 days.
- Billing & Financial Records: Retained for up to 7 years to comply with standard tax and accounting legal obligations.
- Marketing Analytics: Tracking data and analytics logs are retained for a maximum of 12 months before being anonymized or deleted.
9. International Data Transfers
Maskerade AI stores its core data on Supabase in London, United Kingdom, which is covered by an EU adequacy decision, and runs its processing on Google Cloud in Belgium. When transferring personal data originating from the EEA, UK, or Switzerland to the United States (e.g., to our analytics or payment sub-processors), we rely on the EU-US Data Privacy Framework (DPF), the UK Extension to the DPF, and the Swiss-US DPF where the vendor is certified. For vendors not certified under the DPF, we rely on the European Commission's approved Standard Contractual Clauses (SCCs).
10. Your European Privacy Rights (GDPR)
If you are located in the EEA or the UK, you have the right to Access, Rectification, Erasure (Right to be Forgotten), Restriction of Processing, Data Portability, and the Right to Object.
Right to Complain: If you believe your privacy rights have been violated, you have the right to lodge a complaint with your local supervisory authority (such as the French CNIL or the equivalent authority in your jurisdiction).
11. Your US Privacy Rights (Applicable State Laws & GPC)
If you are a resident of a US state with an active privacy law, you have the right to Know/Access, Delete, Correct, and Opt-Out of the "Sale" or "Sharing" of your personal information.
- Targeted Advertising ("Sharing"): We "share" data via third-party tracking pixels for cross-context behavioral advertising. You can opt out by clicking the "Do Not Sell or Share My Personal Information" link in the footer of our website.
- Global Privacy Control (GPC): We respect the Global Privacy Control (GPC) signal. If your browser or extension transmits a GPC signal, our website will automatically recognize it and opt you out of the use of third-party tracking pixels.
12. Age Restriction
Maskerade AI is exclusively a B2B SaaS platform. Our services are not intended for, and we do not knowingly collect personal information from, children under the age of 18.
13. Contact Us
If you have any questions, concerns, or wish to exercise your privacy rights, please contact our privacy team at:
Email: privacy@maskerade.ai
Maskerade Terms of Service
Version 3.1 | Effective Date: November 6, 2026
These Terms of Service ("Terms") constitute a legally binding agreement between Seven Variables SAS, trading as Maskerade ("Maskerade," "Company," "we," "us," or "our") and the entity or person ("Client," "you," or "your") accessing or using our B2B SaaS platform.
1. The Service & Persona Interactions
Maskerade provides a swarm of synthetic personas designed to interact with your website to provide user experience and conversion rate feedback.
- Authorized Actions: You grant Maskerade’s personas permission to browse your site, submit forms, create test accounts, and initiate checkout flows.
- Payment Limitation: Personas are intentionally not equipped with functional payment credentials (credit cards, digital wallets, etc.). While they can navigate to the point of payment, they are technically incapable of completing a real financial transaction.
- AI Nature & Hallucinations: You acknowledge that the feedback is generated by synthetic AI entities. While we strive for high-quality insights, Maskerade is not liable for "hallucinations," biased outputs, or nonsensical feedback generated by the underlying AI models.
2. Acceptable Use & Fair Use Policy
While Maskerade does not restrict the industries we serve, the Service must be used responsibly.
- Lawful Use: You agree not to use the Service for any unlawful purposes or to analyze platforms engaged in illegal activities.
- Fair Use & Infrastructure Limits: Subscriptions are subject to a Fair Use Policy. You agree not to configure the persona swarm in a manner that places an unreasonable or disproportionate burden on Maskerade’s server and AI inference infrastructure. Maskerade reserves the right to rate-limit, throttle, or temporarily suspend activity if your usage significantly exceeds typical operational norms for your subscription tier.
3. Credits, Plans, Fees, & Billing
- Credits: The Service is paid for in credits. One credit is one persona running one test, on a website or on an ad.
- Free Accounts: A new account includes a one-time starting bonus of credits, which expires one year after it is granted. No payment card is required.
- Paid Plans & Auto-Renewal: Paid plans are billed monthly in advance by card and renew automatically until cancelled. Each paid invoice provides that month’s credits, and credits left at the end of the month expire. You can cancel at any time from your billing settings. Your plan then runs until the end of the month already paid, and nothing more is charged.
- Extra Credits: You can buy extra credits at any time. Extra credits, and credits earned by inviting colleagues or referring others, are valid for twelve (12) months.
- Enterprise Agreements: Annual or custom agreements, usage-based fees and service fees for custom implementations are set out in your Order Form. Unless the Order Form says otherwise, they renew for successive periods of the same length unless either party provides written notice of non-renewal at least thirty (30) days prior to the end of the current term.
- Fees & Non-Refundability: Prices exclude VAT. Payments are handled by Stripe. All fees are non-refundable unless strictly required by applicable French law.
- Price Adjustments: Maskerade reserves the right to revise its prices upon sixty (60) days’ written notice. Such changes will take effect at the start of your next renewal.
4. Client Responsibilities & Warranties
- The Right to Crawl: You warrant that you own the website being tested or have the explicit legal authority to allow Maskerade’s personas to crawl and interact with it.
- Site Performance & IT Alerting: It is your responsibility to notify your hosting provider or IT department of Maskerade’s automated activity. Maskerade is not liable for any server strain, latency, or downtime on your infrastructure caused by the volume of persona interactions.
- Data "Pollution": Our interactions will generate mock data in your CRM, Analytics platforms, and databases. You are solely responsible for filtering, segmenting, or deleting this synthetic data from your internal systems.
5. Intellectual Property & Marketing
- Ownership of Output: You retain all ownership rights to the final feedback reports and specific data insights generated for your website.
- Maskerade IP: Maskerade retains all rights, title, and interest in the platform, including the synthetic persona architecture, AI models, and software.
- Marketing Rights: Unless you opt-out in writing, you grant Maskerade a non-exclusive license to use your company name and logo on our website and marketing materials solely to identify you as a client.
6. Confidentiality & Data Protection
- Mutual Confidentiality: Both parties agree to treat all non-public information received from the other party (including unreleased website designs, conversion data, and Maskerade’s proprietary methodology) as confidential and shall not disclose it to third parties without prior written consent.
- GDPR Compliance (DPA): While the Service utilizes synthetic personas, if Maskerade is required to process any personal data (as defined by the GDPR) on behalf of the Client during its site interactions, such processing shall be governed by our Data Processing Agreement ("DPA"), which is incorporated herein by reference.
7. Service Level & Support
- Commercially Reasonable Efforts: Maskerade will use commercially reasonable efforts to ensure the Service is available and functional. However, we do not currently offer a guaranteed uptime Service Level Agreement (SLA).
- Support Boundaries: Technical support is provided via email during standard Central European Time (CET) business hours (Monday through Friday, 9:00 AM to 5:00 PM), excluding French public holidays.
8. Disclaimers, Limitation of Liability & Indemnification
- No ROI Guarantee: Maskerade provides suggestions for improvement. We do not guarantee, and are not liable for, any specific financial outcome, sales growth, or conversion rate benchmarks.
- General Limitation: To the maximum extent permitted by French law, Maskerade’s total liability for any claim arising from the Service shall not exceed the total amount paid by the Client to Maskerade during the twelve (12) months preceding the claim.
- Client Indemnification: You agree to defend, indemnify, and hold harmless Maskerade, its founders, and employees from and against any third-party claims, damages, or legal actions arising from your use of the Service, specifically including claims related to unauthorized crawling of third-party websites or violations of third-party terms of service.
- Force Majeure: Maskerade shall not be held liable for failure or delay in performance caused by circumstances beyond our reasonable control, including outages in third-party infrastructure (e.g., cloud hosting, AI model, or telecommunications providers).
9. Termination
- Termination for Cause: Either party may terminate this agreement immediately upon written notice if the other party materially breaches these Terms and fails to cure such breach within fifteen (15) days of receiving written notice. Maskerade reserves the right to immediately suspend accounts violating the Acceptable Use Policy.
- Data Deletion Post-Termination: Upon termination or expiration of your subscription, Maskerade will retain your Output data for a period of thirty (30) days, after which it will be permanently deleted from our active systems.
10. Governing Law & Jurisdiction
These Terms are governed by the laws of France. Any dispute arising from these Terms that cannot be resolved amicably shall be submitted to the exclusive jurisdiction of the commercial courts of Paris.
11. Legal Notice
- Publisher: Seven Variables SAS, a French simplified joint-stock company (société par actions simplifiée) with a share capital of €10,000, registered in Versailles.
- SIREN: 106276264
- SIRET: 106276264 00012
- VAT Number: FR86106276264
- Hosting Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States. Phone: +1 559 288 7060.
Odile, 71Prints contracts. Tablet with large text. Calls if unsure.