Privacy Policy

1. Introduction

This Privacy Policy explains how personal data is handled when you use MobAI: the desktop application, website, account services, hosted features, and related services.

The controller of personal data described in this Privacy Policy is the operator identified in Section 15 ("we", "our", or "us").

2. Data We Process

We aim to collect only the information reasonably necessary to provide and protect MobAI. Depending on the features you use, this may include:

• •Account information: your email address and information necessary for login, account management, support, and service communications.
• •Service and subscription data: account status, subscription tier, entitlements, purchase or subscription status received from our Merchant of Record, and information needed to apply plan limits.
• •Machine and device registration data: a pseudonymous machine identifier (a one-way hash derived from your computer's identifier, not the raw identifier) and information necessary to register, identify, and manage machines or devices associated with your account and to enforce licensing limits.
• •API keys: if you create MobAI API keys (for example for CI), we store them in hashed form together with their name and usage metadata.
• •Testing Dashboard data: if you upload test runs from the desktop application or from CI, or if a member of a project you belong to does, we store the uploaded run. A run can include test names and results, step text, error messages, test source files, screenshots, UI trees, step and runner logs, and, only where you turn them on, device logs and screen recordings. A run can also include the device name, model, platform and OS version, a hashed device identifier, the device provider, and version-control and CI metadata such as repository, branch, commit, commit message, pull request, CI provider, and CI run link. Runs of AI-driven tests can include the agent's step trace. We also store project names, the list of project members with their email addresses, who added each member, and which member and which API key uploaded each run.
• •Relayed device sessions: if you use features that make a device reachable through MobAI's relay (such as CI live view, an iOS simulator on a CI runner that your AI agent drives, or relayed cloud devices), traffic between the device and the viewer or agent, including the screen stream, UI data, screenshots, typed input, and control commands, passes through MobAI's relay servers in transit and is not stored. We store the metadata needed to operate the session (device key, platform, label, source, and failure details you choose to publish), and connection logs record your account ID and IP address.
• •Cloud-agent devices: if you let a cloud agent use one of your iPhones, we store the device's identifier (UDID), name, iOS version, its address on your private network, and a pairing credential that lets the agent's session reach the phone. The credential is encrypted at rest and used only to start sessions you request. Removing the device deletes this data and revokes that access.
• •Support communications: information you provide when you contact us for support or otherwise communicate with us.
• •Security and operational data: limited technical records that may be generated by our authentication, hosting, and service infrastructure as necessary to operate, secure, troubleshoot, and prevent abuse of the service.

MobAI does not use your account, device, or automation data for advertising or cross-service tracking. MobAI does not intentionally collect application screenshots, UI trees, or task content through analytics or telemetry merely because you use local device automation.

3. Local Device Automation and AI Providers

Local device automation runs on your computer. Screenshots, UI trees, and task content are processed locally unless you choose a feature or integration that sends them elsewhere.

When you configure a cloud AI provider, the built-in agent sends the task context and UI data required for the request directly to that provider. If vision is enabled and the selected model supports it, this can include screenshots. These inference requests do not pass through MobAI's servers. Disabling vision does not prevent text, task context, or UI data from being sent to the configured provider where such data is required for inference.

An external agent connected through MCP handles data according to that agent's configuration and the policies of its providers. A local Ollama model can process inference on your own machine; a remote Ollama host receives the data you direct to that host.

When you choose a third-party AI provider, external agent, remote Ollama host, cloud device provider, webhook destination, or similar integration, you direct the relevant data to that third party. Its own terms and privacy policy apply, and you are responsible for configuring the integration appropriately.

Some device setup steps, such as preparing the on-device component for an iPhone, contact Apple and the technical services needed for that process.

4. Remote Devices, Sharing, Webhooks, and Test Uploads

Remote device access, cloud device providers, webhooks, device sharing, and test-result uploads transmit the data reasonably necessary for the feature you choose.

Test runs are stored locally on your computer by default. They are uploaded to MobAI's hosted Testing Dashboard only when you upload them from the desktop application or configure CI to report to a MobAI project. Uploaded runs are stored in MobAI's hosted services. Shared or remotely accessed devices may send automation data to the connected client, peer, or provider as required to establish and operate that connection.

Testing Dashboard projects are shared. Every member of a project can see all runs uploaded to it, including their screenshots, recordings, logs, and metadata, can see the email addresses of the other members and of the uploader of each run, and can delete runs. The project owner decides who is a member. If you are added to a project, your email address becomes visible to its members.

MobAI tries to remove secrets it knows about (such as values marked as secret in your tests) from uploaded text before upload. This is a best-effort safeguard, not a guarantee. Screenshots, recordings, and UI trees show whatever was on the device screen.

You should not upload, share, or transmit personal data, confidential information, or third-party data through these features unless you have the authority and lawful basis to do so. Where you upload personal data of other people (for example data shown in the app under test), you decide what is uploaded and why, and MobAI processes that content to provide the Testing Dashboard to you.

5. Payment and Billing

Paid MobAI purchases are sold and processed by Dodo Payments, which acts as Merchant of Record and reseller for the transaction. Dodo Payments processes payment, billing, tax, fraud-prevention, and transaction information under its own terms and privacy policy.

We do not receive or store your full payment-card details. We may receive limited purchase and subscription information from Dodo Payments that is necessary to activate, manage, support, or reconcile your MobAI subscription.

6. How and Why We Use Personal Data

We process personal data for the following purposes and legal bases:

• •To create and manage accounts, provide paid and account-based features, register machines, apply your subscription entitlements, and provide requested hosted features: processing is necessary to perform our contract with you or to take steps at your request before entering into a contract (Article 6(1)(b) GDPR).
• •To respond to support requests and service communications connected with your use of MobAI: performance of our contract (Article 6(1)(b) GDPR) and, where appropriate, our legitimate interest in supporting and improving operation of the service (Article 6(1)(f) GDPR).
• •To secure the service, prevent fraud, enforce licensing limits, investigate abuse, protect our infrastructure and rights, and establish, exercise, or defend legal claims: our legitimate interests in operating and protecting MobAI and preventing misuse (Article 6(1)(f) GDPR).
• •To comply with tax, accounting, legal, regulatory, and lawful authority requirements: compliance with legal obligations (Article 6(1)(c) GDPR).
• •Where we specifically ask for consent for an optional activity, we process the relevant data on the basis of that consent (Article 6(1)(a) GDPR). You may withdraw consent at any time without affecting processing already carried out lawfully before withdrawal.

7. Service Providers and Recipients

We may disclose personal data to service providers and recipients only where reasonably necessary for the purposes described above. These include:

• •Supabase, for authentication, database, and related hosted-service infrastructure (data stored in the EU, Frankfurt, Germany).
• •Resend, for sending login codes and service emails.
• •Fly.io, which hosts the MobAI API and relay servers (primary region: Frankfurt, Germany), and Tigris Data, which provides object storage on Fly.io for Testing Dashboard files (screenshots, recordings, logs, and other run files).
• •GitHub, which hosts app downloads and update checks and receives your IP address and app version when the app checks for updates.
• •Other members of a Testing Dashboard project you belong to, as described in Section 4.
• •Dodo Payments, in connection with purchases, subscriptions, billing, tax, transaction status, and related support as Merchant of Record.
• •Hosting, infrastructure, security, email, and technical service providers used to operate and protect MobAI, to the extent they process relevant data on our behalf.
• •Professional advisers, public authorities, courts, or other recipients where disclosure is required by law or reasonably necessary to establish, exercise, or defend legal claims.
• •Third-party integrations you choose to configure, including AI providers, external agents, cloud device providers, webhook destinations, remote hosts, and similar services.

Where a provider processes personal data on our behalf, we require appropriate contractual and data-protection safeguards where required by law.

8. International Data Transfers

Our main hosting and database run in the EU (Frankfurt, Germany). Supabase, Fly.io, Tigris Data, Resend, and GitHub are companies based in the United States, and Tigris may store files in regions outside the European Economic Area (EEA). Where personal data is transferred to or accessed from outside the EEA, we rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. You can request a copy of the relevant safeguards by emailing [email protected].

When you independently configure a third-party provider or destination, including an AI provider, remote host, cloud device provider, or webhook, data may be transferred to the location selected or used by that provider. You are responsible for reviewing the provider's location, settings, terms, and privacy practices before enabling the integration.

9. Data Retention

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected and as required or permitted by applicable law.

• •Account, licensing, machine-registration, and subscription data is generally retained while your account or relevant subscription is active and afterward for the period reasonably necessary to close the account, prevent abuse, resolve disputes, enforce agreements, and comply with legal obligations.
• •Billing, transaction, tax, and accounting records are retained for the periods required by applicable law. Transaction records held by Dodo Payments are also subject to Dodo Payments' retention practices.
• •Testing Dashboard runs: screenshots and screen recordings are deleted automatically after 30 days. Failure screenshots, UI trees, logs, test source files, and agent traces are deleted after 90 days. A run's summary and run file (results, step text, errors, and metadata) are kept until the run or its project is deleted. Any project member can delete a run, and the owner can delete the whole project; deletion is permanent and removes the run's files from storage. If you leave a project, runs you uploaded stay in it and still show your email address as the uploader. If your account is deleted, your runs stay in their projects but are no longer linked to you. A project owner's account can be deleted only once their projects are deleted, which we handle on request. If you lose Pro, you cannot open your projects until Pro is restored; members who still hold Pro keep access, and no runs are deleted because of it. You can ask us to delete runs by emailing [email protected].
• •Cloud-agent device data is kept until you remove the device or delete your account.
• •Uploaded test results and other hosted user content may be kept longer than stated above only where required for legal, security, or dispute-resolution purposes, or until they age out of routine backups.
• •Support communications and security or abuse-prevention records may be retained for as long as reasonably necessary to resolve the matter, protect the service, or establish, exercise, or defend legal claims.

When data is no longer required, we delete or anonymize it in accordance with our operational processes and applicable law.

10. Data Security

We use technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, destruction, or loss. These measures include secure authentication and encryption in transit and, where supported by the relevant hosted service, encryption at rest.

No system can be guaranteed to be completely secure. You are responsible for protecting your account credentials, API access, configured integrations, machines, devices, and local environment.

11. Your Rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• •access personal data concerning you;
• •correct inaccurate or incomplete personal data;
• •request deletion of personal data;
• •request restriction of processing;
• •object to processing based on legitimate interests;
• •receive certain personal data in a portable format where the right to data portability applies;
• •withdraw consent at any time where processing is based on consent; and
• •lodge a complaint with a competent data-protection authority.

To exercise any of these rights, email [email protected].

In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO).

These rights are not absolute. For example, we may need to retain certain information to comply with law, protect legal claims, prevent abuse, or complete obligations connected with your account.

MobAI does not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you. Licensing checks that apply your plan's limits are not such decisions.

12. Whether Data Is Required

Certain data is required to provide account-based or paid features. For example, an email address and the information needed to verify entitlements or register machines may be necessary to create an account, use paid functionality, or enforce plan limits. If required data is not provided, we may be unable to provide the relevant feature.

Other data is provided only when you choose an optional feature, integration, upload, or support interaction.

13. Children

MobAI is intended primarily for developers and professional or technical users and is not directed to children. If you are not legally able to enter into a binding agreement for the service in your jurisdiction, you may use MobAI only with appropriate authorization from a parent, guardian, or other person legally entitled to act for you.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to MobAI, our processing activities, legal requirements, or service providers. We will post the updated policy and update the "Last updated" date. Where required by law, we will provide additional notice of material changes.

15. Contact

The data controller and operator of MobAI is Dzmitryi Hilimovich, a sole trader registered in CEIDG (NIP 6751833057, REGON 545768472). You can reach us at [email protected].