Privacy Policy

Effective date: October 24, 2026

This Privacy Policy explains how Model Tool Labs, Inc. ("Model Tool Labs", "we", "us") collects, uses, shares and protects personal information when you use M2 Canvas — our website at m2ui.ai, the M2 web app, the M2 Mac app, the M2 MCP server and the @m2canvas/connect local bridge (together, the "Service").

If you have questions, contact us at hello@m2ui.ai.

Summary

We collect what we need to run the Service: your account details, the content you create, and the technical data needed to keep it working and secure.
We do not sell your personal information, and we do not use third-party analytics or advertising trackers.
When you use the built-in agent, your request and the project content it needs are sent to third-party AI model providers, listed below.
You can delete your projects at any time and ask us to delete your account.

Information we collect

Information you give us

Account information: your email address, name, profile picture, and sign-in method (email and password, Google or GitHub). We never see your Google or GitHub password. Email sign-in passwords are stored only as hashes by our authentication provider. We also store your preferences, such as language and theme.
Waitlist information: your email address, your role (optional) and your language.
Your content: workspaces, projects, pages, canvas layers, design systems, apps, and files you upload, such as images. We call this "Your Content". We keep a version history of your projects so they can be restored. We remove location (EXIF) data from JPEG images when you upload them.
Built-in agent conversations: the messages you send to the built-in agent, any attachments, and its replies.
Invitations: when you invite someone, we store their email address and send them an email that shows your name and email address.
Billing information: if you buy a paid plan, Stripe collects your payment details. We never receive or store full card numbers. We store your Stripe customer ID, your subscription status, and the payment records Stripe sends us, which can include your name, email address, billing address and the last four digits of your card.
Messages to us: anything you send us by email or through the in-app support form. The support form also sends your user ID, the app version and the current project ID, to help us look into the problem.

Information collected automatically

Technical data: your IP address, browser, operating system and app version, which your device sends when it connects to the Service. We use IP addresses briefly to limit abuse (for example, rate limits on sign-in and the waitlist). They are not stored in our database, but they can appear in our hosting provider's server logs.
Usage records: we record the actions that use resources — such as built-in agent runs (including the model used and the number of tokens), MCP tool calls and canvas captures — along with the user, workspace and project involved. We use these records to run plans and credits, prevent abuse and fix problems. We also keep a list of the projects you recently opened, so we can show them to you.
Collaboration data: while you work in a project, your cursor, selection and presence are shared in real time with the other people and agents in that project. Workspace activity, such as membership changes, is kept in an audit log that workspace admins can see.

Information from others

Sign-in providers: if you sign in with Google or GitHub, we receive your name, email address and profile picture from that provider.
Teammates: a workspace owner or admin may invite you by entering your email address.

Cookies and local storage

Cookies. We use two strictly necessary cookies to keep you signed in. We do not use advertising, analytics or cross-site tracking cookies.
Local storage. The app stores your preferences (such as theme, language and panel layout) in your browser, and keeps a local copy of projects you open (in IndexedDB) so the editor loads quickly and works through brief network drops. You can clear these at any time in your browser settings.
Cloudflare Turnstile. The waitlist form uses Cloudflare Turnstile to block bots. Turnstile processes information about your browser and may set its own cookies.
Google Fonts. Our pages and design systems load fonts from Google Fonts, so your browser connects to Google's servers, which receive your IP address.

How we use information

We use personal information to:

provide, operate and maintain the Service, including real-time collaboration and the built-in agent;
create and secure your account, and prevent fraud, spam and abuse;
process payments, and manage subscriptions and credits;
send service emails, such as invitations, sign-in codes, security notices and billing receipts;
respond to your questions and provide support;
fix bugs and improve the Service;
comply with legal obligations and enforce our Terms of Service.

We do not use Your Content to train AI models.

Where the GDPR or similar laws apply, we rely on these legal bases: performing our contract with you (running the Service), our legitimate interests (security, abuse prevention, improvement and support), your consent (where we ask for it), and our legal obligations.

AI features and third-party AI providers

M2's built-in agent uses large language models run by third parties. The built-in agent only runs when you send it a request. When you do, we send your request to the model provider you selected (or our default model), together with the project context the agent needs to complete it. That context can include the current page, the layers you selected, canvas and design-system content, and screenshots of parts of your canvas.

We reach these models through the Vercel AI Gateway. The model providers currently include Anthropic, OpenAI, Z.ai, DeepSeek and QuiverAI (for generating vector graphics). The list can change as we add or remove models; the model picker in the app shows which models are available. These providers process the data only to return a response to us. They are not permitted to use it to train their models, and they keep it only as long as needed to provide the response and meet their legal obligations.

Agents you connect yourself. If you connect your own agent (for example Claude Code, Codex or Cursor) to M2 through MCP or the local bridge, that agent can read and change the projects you give it access to. The local bridge runs on your own computer and lets the agent you choose work with your files with your permissions. What happens to data inside your agent — including which AI provider it sends it to — is governed by that agent's terms and privacy policy, not ours.

We share personal information only in these cases:

Service providers that process data for us under contracts requiring them to protect it and use it only to provide their services to us:
- Supabase — database, authentication and file storage, hosted in Tokyo, Japan
- Cloudflare — hosting, real-time collaboration servers, file storage, rendering of canvas previews, email sending and bot protection (Turnstile)
- Stripe — payment processing
- Vercel (AI Gateway) and the AI model providers listed above — the built-in agent
- Zoho — receiving email you send to our m2ui.ai addresses
- Google — serving web fonts
People you work with. Content in a workspace is visible to its members according to their roles. If you share a project with "Anyone with the link", anyone who has the link can view it without signing in.
Uploaded files. Images you upload, and design-system assets, are served from public web addresses that contain a long random identifier. Anyone who has the exact address can open the file, so don't upload images you need to keep secret.
Legal reasons. When we believe in good faith that disclosure is required by law, or necessary to protect the rights, property or safety of our users, the public or Model Tool Labs.
Business transfers. If we are involved in a merger, acquisition or sale of assets, personal information may be transferred as part of that deal. We will tell you before your information becomes subject to a different privacy policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law.

How long we keep information

Account information is kept while your account is active.
Your Content is kept until you delete it or your account is deleted. Deleted projects go to Trash and are permanently deleted after 180 days, or right away if you delete them from Trash. A deleted page disappears from the project right away, but earlier copies stay in the project's version history until the project itself is permanently deleted.
Built-in agent conversations are kept until you delete them or your account is deleted.
Usage records are kept for 90 days. Records of built-in agent runs that are used for billing and credits are kept for as long as we need them for billing and accounting.
Workspace audit logs are kept for as long as the workspace exists.
Billing records are kept for as long as tax and accounting laws require, typically up to 7 years, including after your account is deleted.
Waitlist entries are kept until you join the Service or ask us to remove them.
Server logs kept by our hosting providers are deleted automatically after about 7 days.
Mac app logs are stored only on your computer, in ~/Library/Logs/M2/.

Your choices and rights

Access and export. You can see your account details in Settings, and export your designs from the editor as PNG, JPG or SVG, or export apps as code.
Correction. You can change your name and profile picture in Settings, or ask us to correct other information.
Deletion. You can permanently delete projects from Trash, and delete built-in agent conversations, at any time. To delete your account, email hello@m2ui.ai from the email address on your account. We will confirm the request and delete your account and associated personal information within 30 days, except information we must keep by law (such as billing records). Content you created in a workspace owned by someone else stays in that workspace.
AI processing. The built-in agent only sends your content to AI providers when you make a request to it. You can use M2 without the built-in agent.
Emails. We send service emails needed to run your account. If we send marketing emails, each one will have an unsubscribe link.

Depending on where you live — including the European Economic Area, the United Kingdom and California — you may have additional rights: to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to not be discriminated against for exercising these rights. To exercise them, email hello@m2ui.ai. We will verify your request and respond within the time the law requires (generally 30 days, or 45 days under California law). You can also complain to your local data-protection authority.

Security

We protect information with encryption in transit (TLS), encryption at rest by our infrastructure providers, database access controls that limit each user to the data they are allowed to see, and limited staff access. When you set a password, we check it against known data breaches by sending only the first five characters of its hash, never the password itself. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a breach that affects your personal information, we will notify you as the law requires.

International transfers

Model Tool Labs is based in the United States. Our main database and file storage are hosted in Tokyo, Japan, and our service providers may process information in the United States and other countries where they operate. When personal information is transferred from the EEA, the UK or Switzerland, we rely on our service providers' data processing terms, which include the European Commission's Standard Contractual Clauses.

Children

The Service is not directed to children under 13 (or under 16 in the EEA and the UK), and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the new version on this page and change the "Effective date". If the changes are material, we will tell you by email or in the Service before they take effect.

Contact us

Model Tool Labs, Inc.
131 Continental Dr, Suite 305
Newark, DE 19713, United States

Email: hello@m2ui.ai