Privacy policy.

Who we are

MetaCells is operated by SuperFolders Oy, Business ID 3336173-4, VAT FI33361734, Lapinlahdenkatu 16, 00180 Helsinki, Finland. This policy covers metacells.dev, the MetaCells app, Hub marketplace, vector search and embedding services, mobile and desktop clients, APIs, automations, and related support channels.

Controller contact

SuperFolders Oy is the controller for hosted MetaCells services. Contact details are listed on the Contacts page. We have not appointed a separate data protection officer unless this policy later says otherwise.

Account data

We may process your name, email address, avatar, sign-in provider identifiers, password hashes where password login is enabled, authentication and refresh tokens, role, workspace or marketplace profile, billing account status, and support contact details.

Product content

We process workbooks, sheets, cells, formulas, prompts, files, extracted text, generated artifacts, images, videos, channel payloads, action requests, schedules, marketplace submissions, uploads, moderation records, reviews, stars, download counts, and automation logs that you create, import, connect, or publish.

Local and desktop use

Some desktop or local deployments store workbooks, files, settings, model caches, job data, and logs on your own device or infrastructure. We process that data only when it is sent to a hosted MetaCells service, support channel, connected provider, or marketplace workflow.

Usage and device data

We may collect log data such as IP address, browser or app version, device identifiers, request paths, crash or error details, performance data, security events, webhook delivery records, and timestamps.

AI and embeddings

When you use AI formulas, assistants, media generation, voice, or vector formulas such as VECSEARCH and VECLOOKUPS, relevant inputs, attachments, context, and outputs may be sent to configured model providers or local services. The search service converts submitted text into embeddings for similarity search.

Model providers

Model calls may use MetaCells-managed providers, your own provider keys, or local services. Provider processing is governed by the selected provider's terms and privacy practices, and we may record usage metadata for billing, abuse prevention, debugging, and reliability.

Connected services

If you connect services such as Google, Google Drive, Gmail, Stripe, social media, voice, storage, cards, or other channels, we process the account data, OAuth grants, access or refresh tokens, scopes, messages, files, events, webhook payloads, and metadata needed to provide the connection.

Marketplace visibility

Published Hub listings, public marketplace media, titles, descriptions, tags, author profile fields, star counts, and download counts may be visible to other users and visitors. Package and document downloads may be served through short-lived signed links.

Billing

Payments and top-ups may be handled by Stripe or another payment provider. We process checkout status, customer identifiers, account balances, ledger entries, AI usage records, pricing metadata, taxes, invoices, and payment metadata, but do not store full card numbers.

Cookies and storage

We may use cookies, local storage, and similar technologies for sign-in, security, preferences, app state, embedded clients, analytics, and fraud prevention. You can control browser storage through your browser settings, but some features may stop working.

Why we use data

We use data to provide and secure the service, authenticate users, save work, run AI and automation features, operate the marketplace, process billing, prevent abuse, debug issues, improve reliability, and respond to requests.

Legal basis

Where GDPR applies, we rely on contract performance to provide accounts and paid services, legitimate interests for security, reliability, abuse prevention, support, and product improvement, consent where required, and legal obligations for tax, accounting, and compliance. You may withdraw consent where processing depends on consent.

Sharing

We share data with service providers only as needed for hosting, storage, authentication, analytics, security, billing, AI processing, communications, moderation, support, and connected-channel operation. Public marketplace content is visible to other users.

Processors

Depending on the feature, processors and providers may include hosting, database, object storage, authentication, payment, email, analytics, model API, speech, image, search, logging, and support providers. Connected services you choose, such as Google, Gmail, Drive, Stripe, social networks, or model providers, may also process data under their own terms.

Retention

We keep account and product data while your account or workspace is active, billing and tax records for the periods required by law, security and operational logs for a limited period based on risk and operational need, and marketplace moderation records as needed to protect the service. Deleted content may remain for a limited time in backups, logs, marketplace moderation records, or billing records.

Your choices

You can request access, correction, deletion, export, objection, or restriction of your personal data. Some requests may require identity verification and may be limited by billing, security, legal, or operational requirements.

Security

We use technical and organizational safeguards such as access controls, signed tokens, scoped OAuth grants, upload validation, rate limits, provider secrets, and controlled storage. No online service can be guaranteed completely secure.

International transfers

MetaCells is based in the EU, but providers and connected services may process data in other countries. Where required, we use transfer safeguards such as contractual protections or provider compliance programs.

Complaints

If you are in the European Economic Area, you may contact your local data protection authority. We ask that you contact us first when practical so we can review and respond to the issue.

Children

MetaCells is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided data, contact us so we can review it.

Updates

We may update this policy as the product, providers, legal requirements, or business operations change. The updated date shows when the current version became effective.