Melsun — all-in-one AI platform
    ← Back to Melsun

    Privacy Policy

    Last updated: August 22, 2026

    Controller

    Melsun ("we", "us", or "our") is operated by Vajta Technologies Inc., 1111B S Governors Ave Suite 24501, Dover, DE 19904 US. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you use melsun.ai, the Melsun iOS and Android apps, and related AI applications.

    Privacy requests: admin@melsun.ai. We aim to respond within 30 days (or sooner where required by law).

    Information we collect

    • Account data: email address, name, authentication details, and optional profile fields (company, phone, country). If you use Sign in with Apple, Apple may share your name and a real or Hide My Email relay address. If you use Google sign-in, Google shares the account email and basic profile you approve.
    • Content you submit: chat prompts, generated outputs, uploaded files, shared chats you make public, Trade Desk / Shipment Tracker data (contracts, shipping instructions, bills of lading, artwork, and related trade documents), and Equity Desk screening inputs you choose to run.
    • Usage and diagnostics: feature usage, rate-limit / security events, model-routing metadata, and error diagnostics (for example via Sentry when enabled). Routing logs may include limited prompt samples after automated redaction of common personal-data patterns.
    • Payment data: billing email and purchase metadata processed by payment providers; we do not store full card numbers.
    • Technical data: IP address, browser/device information, and similar logs needed to operate and secure the service. We may infer a country code from your IP (via our hosting provider) and store it on your account so we can understand where users are. This is separate from the optional country on your profile. The mobile apps do not use the Identifier for Advertisers (IDFA) or App Tracking Transparency prompts.
    • Device permissions (mobile apps): camera and photo library when you attach images in chat; microphone when you use Voice Mode. We use these only for the feature you start. You can revoke access in system settings.
    • Marketing preferences: newsletter opt-in status and cookie / analytics consent choices.
    • Connected accounts: if you connect a third-party app (for example Google Drive, Gmail, Calendar, or Sheets), we store the account email you connected, the scopes you granted, and an encrypted connection identifier so Chat can read files you ask about. Google access tokens are held by our connection provider (Composio) rather than stored on Melsun. We do not use those connections for advertising.

    Legal bases (EEA / UK)

    Where GDPR / UK GDPR applies, we process personal data on these bases:

    • Contract: to create your account, provide AI apps, process credits/subscriptions, and support you.
    • Legitimate interests: security, abuse prevention, service improvement, and product analytics that are not strictly necessary for the contract (balanced against your rights).
    • Consent: optional analytics / advertising cookies and newsletter marketing. You may withdraw consent at any time.
    • Legal obligation: tax, accounting, fraud prevention, and responding to lawful requests.

    How we use information

    • Provide, operate, secure, and improve the Melsun platform.
    • Process transactions and manage subscriptions or credits.
    • Run AI inference and document analysis you initiate.
    • Improve routing and product quality using limited operational logs (for example model-routing samples). We do not sell your content to train third-party public foundation models.
    • Respond to support and privacy requests; send service notices.
    • Monitor security, prevent abuse, and comply with law.

    We do not sell personal information for money. Under California law, some advertising / analytics disclosures may be considered "sharing" or "selling" for cross-context behavioral advertising — you can opt out via Decline on our cookie banner or a Global Privacy Control (GPC) signal.

    Trade and business documents

    If you use Trade Desk or similar features, you may upload documents that contain commercial, personal, or sensitive business information. We process this data only to provide the features you request. Do not upload documents you are not authorized to share, or content that violates export-control, sanctions, or confidentiality obligations.

    AI providers and subprocessors

    We use trusted third-party providers to operate the service. See our Subprocessors page and Data Processing Addendum. AI providers may temporarily process prompts and file excerpts to generate responses you request. Web-search providers may process search queries you initiate. Shipment Tracker may send bill-of-lading and carrier identifiers to carrier systems and browser/data partners that perform the lookup. Equity Desk may send symbol and screening parameters to market-data providers. If you connect Google Drive, Gmail, Calendar, or Sheets, Composio brokers the OAuth connection using its managed Google app, and Google processes the file, mail, event, or spreadsheet excerpts you ask Chat to read, under Google's terms for those APIs.

    Connected accounts

    Connectors are optional. You can connect or disconnect them in Account → Connectors. Disconnecting revokes the grant with the connection provider and deletes stored connection identifiers. File excerpts retrieved for a chat turn are treated like other content you submit (they may appear in that conversation and in your export). Account export includes connector metadata (provider, email, scopes, dates) but not connection secrets.

    Cookies and similar technologies

    • Essential: authentication, security, and load balancing — required for the service.
    • Analytics (optional): PostHog, Plausible, DataFast, Vercel Analytics, or Google Analytics when configured and consented.
    • Advertising (optional): Meta Pixel / Conversions API when marketing attribution is enabled and you have accepted optional advertising cookies. Purchase Conversions API events are sent only when marketing consent is known to be granted for that checkout.

    You can Accept or Decline optional cookies in the banner, and change your choice later via Cookie settings in the site footer. We honor Global Privacy Control (GPC) signals by treating them as a decline of optional analytics and advertising cookies, including after a prior Accept.

    International transfers

    We and our subprocessors may process data in the United States and other countries. Where required, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses (SCCs), adequacy decisions, or vendor certifications (for example Data Privacy Framework where applicable). Details are available on request at admin@melsun.ai.

    Retention

    • Account and app content: retained while your account is active.
    • After deletion: associated app data is removed or anonymized; identifiable object-storage files we can locate are deleted.
    • Purchases: anonymized records may be retained for tax, accounting, chargeback, and fraud prevention (typically up to 7 years where required).
    • Security / abuse logs: retained as needed for security investigations (typically up to 12 months unless a longer period is required).
    • Backups: may persist for a limited backup-rotation window after deletion.

    Your rights

    Depending on your location (including EEA, UK, and California), you may have rights to access, correct, delete, or export your personal data; to object to or restrict certain processing; to withdraw consent; and to appeal a denial. California residents may request to know, delete, correct, or opt out of sale/share.

    In-product controls: download your data and delete your account from Account on the website or in the iOS and Android apps. You may also email admin@melsun.ai. We will not discriminate against you for exercising privacy rights.

    Public sharing

    If you make a chat public or share a link, content in that chat may be viewable by anyone with the link. Do not share chats containing personal data of others without a lawful basis.

    Security

    We use reasonable technical and organizational measures, including encryption in transit, access controls, rate limiting, and monitoring. See our Security & Vulnerability Disclosure page. No method of transmission or storage is completely secure.

    Children

    The website and the iOS and Android apps are not directed to children under 17. We do not knowingly collect personal information from children under 17. Contact us to request deletion if you believe a child has provided data.

    Changes

    We may update this policy from time to time. Material changes will be reflected in the "Last updated" date above. Continued use after an update constitutes acceptance where permitted by law.

    Governing law notice

    Contracts with Vajta Technologies Inc. are generally governed by the State of Delaware, United States, without limiting non-waivable consumer protections in your place of residence.