Privacy Policy
Last updated: October 26, 2026
Mastan is a personal AI assistant you message on WhatsApp and Telegram. It is operated by labAI LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States ("we", "us"). labAI LLC is responsible for your personal data.
In short: we use what you send to answer you. AI providers process your messages so Mastan can reply. We study how Mastan is used, but we only publish totals, never your messages. We do not sell your data. You can ask us to delete it at any time.
1. What we collect
- Identity: the name on your messaging profile, your phone number (WhatsApp) or Telegram user ID, and your profile photo if the platform provides it.
- Messages and files: what you write, voice notes and their transcripts, images, documents and other files you send, and Mastan's replies.
- Group chats: if someone adds Mastan to a group, the messages in that group, including from members who never wrote to Mastan directly.
- Memory: things Mastan saves so it can stay useful, such as your preferences, reminders and notes about ongoing tasks.
- Usage: when and how often you use Mastan, and what kinds of requests you make.
- Google account data: only if you choose to connect your Google account. See Section 6.
- Website: mastan.ai uses self-hosted analytics without cookies to count visits, referring pages, device types and countries. There are no advertising trackers. On a first visit to one of the English pages the server looks up the country of your IP address only to pick a language (Azerbaijani, Arabic or English) and keeps nothing. If you choose a language with the language button, that choice is saved in one cookie (mastan-lang) for a year, and nothing else. IP geolocation by DB-IP.
2. Sensitive information
People sometimes send Mastan ID documents, bank statements, health information or passwords. Please do not send passwords, full card numbers or one-time codes. Mastan does not need them. If you send sensitive information, it is handled like your other messages, and you can ask us to delete it at any time.
3. How we use your data
- To reply to you and do what you ask (to provide the service you requested).
- To keep context and memory so Mastan stays useful (to provide the service).
- To keep Mastan safe and prevent abuse (our legitimate interest in running a safe service).
- To study, in aggregate, how people use practical AI (our legitimate interest in research; you can object at any time).
- To meet legal obligations.
4. Research
Conversations may be analysed, including by automated tools and AI models, to produce totals, for example how often certain requests happen, which languages people use, or how conversations end. We publish only aggregate findings and descriptions changed so that nobody can be recognised. We never publish your messages, your files or your identity. If you want your data left out of research, message Mastan or email hello@mastan.ai.
Google account data, including summaries derived from it, is never used for research, not even in aggregate (see Section 6).
5. Who processes your data
- AI model providers (currently OpenAI) generate Mastan's replies and transcribe voice notes. They process your messages under their API data terms.
- WhatsApp (Meta) and Telegram carry your messages, under their own privacy policies.
- Hosting: Mastan runs on computers and servers we operate, including servers at Hetzner in Germany. A private Mastan runs on its own dedicated server.
We do not sell, rent or trade your personal data. Apart from the providers above, we share it only when the law requires it, or when needed to protect someone's safety or rights.
6. Google account data
Connecting Google is optional. It happens only after you approve Google's permission screen. Depending on the permissions you approve:
- Account: your name, email address and profile picture identify the connected account.
- Drive, Docs, Sheets and Slides: only files you pick with Google Picker or files Mastan creates for you; read, create and edit them when asked.
- Calendar: view, create and edit events when asked.
- Gmail: read and search your email, save drafts, and send an email only after you confirm it. Before sending, Mastan shows you the exact recipients, subject and text, and one confirmation covers one email. Your Mastan's server allows at most 100 recipients per email and 500 emails per day, similar to Gmail's own limits, and keeps a small send log with no addresses or text (only time, a hashed draft ID, recipient count and result, kept 30 days). Mastan never deletes email.
We use this data only to provide or improve features you ask for in chat. Never for advertising, sale or building profiles. We transfer it only as needed for those features, with your consent, through the providers in Section 5; for security; to comply with law; or for a merger or sale of the business, with your prior explicit consent and the same protections.
Content is sent to our AI model provider, currently OpenAI, only to carry out your request, under API terms that do not allow training. Neither we nor our providers use Google user data to develop, improve or train generalised or non-personalised AI or machine learning models.
Nobody at labAI reads your Google data unless you ask for help with a specific item and explicitly agree to us viewing it, access is needed for security (such as investigating abuse) or required by law, or data is aggregated and anonymised for lawful internal operations, never research.
Each private Mastan runs on its own dedicated Hetzner server in Germany. OAuth tokens are encrypted on that server. We fetch Google data on demand for tasks, without keeping a separate mailbox or Drive copy. Content kept in chat, such as requested summaries, follows Section 7's retention rules.
Say "disconnect Google" to Mastan or remove access in your Google account. On disconnect, we revoke the token with Google and delete stored tokens. To delete retained chat content, message Mastan or email hello@mastan.ai. Deletion requests are completed within 30 days, subject to Section 7's legal exception.
Mastan's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. How long we keep it
- Conversations, files and memory: kept while you use Mastan, so it stays useful.
- Identifiable data: deleted within 24 months of your last interaction.
- Research results: contain only aggregate data and may be kept.
- Deletion requests: completed within 30 days, unless the law requires us to keep something.
8. International transfers
Your data is processed outside your own country, including in the United States (AI providers) and Germany (hosting). We take reasonable steps to keep it protected wherever it is processed.
9. Your rights
Wherever you live, you can ask us to:
- give you a copy of your data;
- correct data that is wrong;
- delete your data;
- give you your data in a machine-readable format;
- limit or stop certain processing, including research use.
You can also withdraw any consent you have given, and you can complain to the data protection authority where you live.
To make a request, message Mastan (for example "delete my data") from the same number or account, or email hello@mastan.ai. We reply within 30 days.
10. Security
We use reasonable technical and organisational measures to protect your data, including encryption in transit and restricted access. No system is perfectly secure.
11. Children
Mastan is not intended for children under 13, and we do not knowingly collect their data. If we learn that we have, we will delete it.
12. Changes to this policy
We may update this policy. We will change the date at the top when we do. For significant changes, we will also tell active users in the chat where practical.
13. Contact
labAI LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States