Mucho ehf · Iceland
Privacy Policy
How your account, your boards, and your connected agents use information.
1. Who is responsible
Mucho ehf, Iceland, operates Cork and is the controller for account information and the service operations described here. Contact: [PRIVACY CONTACT EMAIL — TO BE ADDED]. Registered address: [TO BE ADDED]. Where an organisation uses Cork to process personal data on its behalf, the respective controller and processor obligations must be addressed in a separate data processing agreement.
2. Information we process
Account information includes your name, email address, password hash, and account timestamps. Cork stores the content you or your connected agents add: boards, notes, comments, images, files, links, designs, metadata, and revision history. Authentication records can include IP addresses, browser information, sessions, token records, client identifiers, permissions, and authorisations. Live board features also process presence information. If you contact us, we receive the information you include.
3. Where information comes from
We receive information directly from you, from clients and agents you authorise, and from the sources you ask Cork to import. When Cork fetches a link or image, the source website receives a request. External content loaded by your browser may disclose connection information to its host. Other people may include information about you in their boards.
4. Why we use it
We use account and board information to provide the service you request, authenticate access, store and display your work, and carry out authorised agent actions. The proposed legal basis for these necessary service operations is performance of our contract with you. We use limited technical and security information to prevent abuse and investigate problems, based on our legitimate interests in keeping Cork reliable and secure. We also process information where necessary to meet legal obligations. Any optional processing requiring consent will be explained separately, and you may withdraw that consent.
5. Who can access your boards
Anyone who receives a link-access board URL can view that board, including someone the link is forwarded to. Private boards require authorised access. MCP-created boards default to link access unless private access is selected. Authorised agents can access your boards according to the permissions you grant. Changing access or deleting a board cannot recall screenshots, downloads, or other copies already made.
6. Service providers and connected clients
Cloudflare provides Cork’s application hosting, file storage, content delivery, and browser rendering infrastructure. Account and board records are stored in a PostgreSQL database through Cloudflare Hyperdrive. Database hosting provider and region: [TO BE CONFIRMED]. Clients you connect, such as Codex, Claude Code, and Cursor, may receive board content and tool responses. Their providers’ own policies govern how they retain or use information they receive, including any model-training settings. Cork cannot set those policies on your behalf. We may also disclose information when required by law or where necessary to protect legal rights and the security of the service.
7. International processing
Infrastructure and connected clients may process information outside Iceland and the European Economic Area. Before this policy is finalised, the provider locations and applicable transfer safeguards must be confirmed: [PROVIDER LOCATIONS, ADEQUACY DECISIONS OR CONTRACTUAL SAFEGUARDS, AND HOW TO OBTAIN A COPY — TO BE ADDED]. This draft does not represent that those arrangements have been verified.
8. Cookies and browser storage
Cork uses authentication cookies to maintain sessions and support sign-in. Browser session storage supports features such as copying board items and identifying a guest for live presence. The application code reviewed for this draft does not include advertising trackers or third-party analytics scripts. Deployment-level tracking and cookie lifetimes still need verification before publication. You can clear browser storage or block cookies in your browser; this may prevent sign-in or disrupt features.
9. How long information stays
Account and board information is retained to provide your account and saved work. Revision history can retain earlier versions of edited or removed items while the board exists. Deleting a board removes its active records and stored assets through Cork’s deletion process, but copies held by external recipients are unaffected. Exact retention periods for sessions, logs, revisions, deleted accounts, caches, and backups, and the process for legal exceptions: [TO BE CONFIRMED]. No fixed deletion deadline is promised by this draft.
10. Your choices and rights
You can manage board sharing, delete boards, and revoke agent connections and API tokens. You may also request access to, correction of, or deletion of personal data, restriction of processing, and a portable copy where applicable. You may object to processing based on legitimate interests. Rights can be subject to legal conditions, and we may need to verify your identity. Send requests to [PRIVACY CONTACT EMAIL — TO BE ADDED]. You can complain to Persónuvernd, Iceland’s Data Protection Authority, or the supervisory authority in the EEA country where you live or work.
11. Security and automated decisions
Cork uses authentication and access controls to protect accounts and private boards. No online service can guarantee absolute security. Protect your credentials and choose connected clients carefully. The current application does not make solely automated decisions about you with legal or similarly significant effects; agent-generated design suggestions are part of the creative workflow.
12. Updates to this policy
We will update this policy when the service or its data practices change, show the effective date, and provide additional notice where appropriate. Contact Mucho ehf at [PRIVACY CONTACT EMAIL — TO BE ADDED] with questions.