Privacy Policy

1. Who we are & how to contact us

Metatrix.ai (the “Service”) is operated by Metatrix Labs, a business based in Ontario, Canada. In this Privacy Policy, “we,” “us” and “our” mean Metatrix Labs, and “you” means the person using the Service.

Metatrix Labs is the organization accountable for the personal information handled through the Service (in Canada, the “organization” under PIPEDA and Quebec Law 25; in the EU/UK, the “controller” under the GDPR).

We have designated a Privacy Officer responsible for our privacy compliance. You can reach our Privacy Officer, or ask any question or make any request about your personal information, at:

• Email: support@metatrix.ai (please write “Privacy” in the subject line)

2. Scope

This Privacy Policy explains what personal information we collect through metatrix.ai, why we collect it, who we share it with, where it is processed and stored, how long we keep it, and the rights and choices you have. It applies to all visitors and users worldwide, with primary reference to Canadian law (PIPEDA and Quebec Law 25) and clearly labelled regional rights for the EU/EEA/UK (GDPR) and the United States.

metatrix.ai is a fully cloud-based, serverless AI platform. There is no local, on-device, or offline AI model. Your prompts, uploads and camera frames are sent to and processed by cloud infrastructure and third-party AI providers in order to deliver the features you use. We are honest about this throughout: we do not claim that “nothing leaves your device.”

This policy works together with our Terms of Service, Acceptable Use Policy, Cookie Policy, Data Processing Addendum, AI Disclosure & Usage Policy, Copyright & Notice-and-Notice Policy, and Accessibility Statement.

3. Information we collect

We collect only what we need to run the features you choose to use. The Service offers “Max” AI chat; AI image, video, 3D and upscale generation; “Real Room” camera scene description; WebRTC video calling; voice; GPS “travel-to”; a sandboxed in-browser terminal; and a personal creations gallery. What we collect depends on which of these you use.

• Account & sign-in information. If you create an account or sign in, we collect your email address, and where you use Google to sign in, the Google account identifier and basic profile information Google returns (such as your email and name). We do not receive your Google password.
• Session identifier. A first-party iomx_session cookie and, where you sign in, an authentication cookie. These let us maintain your session and link you to the creations you save. See the Cookie Policy.
• Your prompts & uploads. The text prompts you type, and any images, audio, files or other content you upload to Max, the generation tools, or the terminal.
• Generated creations. The images, video, 3D assets, upscales, text and other outputs the Service produces for you, together with the settings used to make them, saved to your creations gallery.
• Real-Room camera images. When you use the Real Room feature, camera frames from your device are sent to a cloud vision model solely to describe the scene and objects in view. Real Room does not identify, recognize, or build a biometric template of any person, and we do not use it for facial recognition.
• Voice & audio. If you use voice features, we process the audio you provide (for example, to transcribe speech or generate spoken output).
• WebRTC connection data. When you use video calling, we handle the technical data needed to set up and relay a real-time connection (for example, network/candidate information routed through a relay). Call media is relayed through our infrastructure to reach the other participant.
• GPS / precise location. If you use the GPS “travel-to” feature, we process the precise geolocation your device provides, only when you grant permission.
• Device, log & IP data. Like all internet services, our infrastructure automatically receives your IP address, approximate region, browser and device type, operating system, timestamps, referring pages, and diagnostic/error logs. Your browser also stores some settings and history locally (localStorage/IndexedDB) on your own device.

We do not intentionally collect special categories of data beyond the camera and precise-location data described above, and we ask you not to submit sensitive information (such as health, financial account, or government-ID details) into prompts, uploads, or the terminal.

4. Why we use your information

We use each category of information only for the purposes for which it was collected, and for compatible operational purposes:

• To provide the features you request — running Max chat, generating and storing your creations, describing Real-Room scenes, connecting WebRTC calls, processing voice, resolving “travel-to” locations, and executing your terminal commands in an isolated cloud sandbox.
• To create and secure your account — authenticating you (including Google sign-in), maintaining your session via iomx_session, and linking saved creations to you.
• To operate, maintain and improve the Service — monitoring performance and reliability, debugging, and understanding aggregate, non-identifying usage patterns of features (we do not use third-party advertising or analytics tracking).
• To keep the Service safe — preventing, detecting and responding to fraud, abuse, security incidents, and violations of our Acceptable Use Policy, and enforcing our Terms of Service.
• To handle billing — the Service is free today. If and when Metatrix Labs offers paid features, we will process the account and transaction information needed to manage subscriptions, payments and invoices, and we will update this policy before doing so.
• To communicate with you — responding to your requests and sending important service and legal notices.
• To meet legal obligations — complying with applicable law and responding to valid legal requests.

5. Consent & legal basis (Canada)

Under Canadian privacy law, we rely on your consent and, where permitted, on legitimate business purposes that a reasonable person would consider appropriate in the circumstances (such as securing the Service and preventing abuse). By creating an account and using a feature, you consent to the processing described in this policy that is necessary to deliver that feature.

For sensitive information — specifically Real-Room camera images and precise location — we ask for your express, just-in-time consent at the moment you first turn the feature on, through your browser’s camera or location permission prompt and our in-product controls. We only process these while the feature is active and you have granted permission.

You can withdraw your consent at any time, subject to legal or contractual limits and reasonable notice:

• Turn off camera, microphone or location permission in your browser or device settings, or stop using the relevant feature;
• Delete individual creations, clear your locally stored settings/history, or sign out; and
• Close your account or email support@metatrix.ai to withdraw consent or ask us to stop a specific use.

Withdrawing consent may mean we can no longer provide some or all of the Service to you. Withdrawal does not affect processing already carried out.

6. AI processing & training

We do not use your content to train AI models. Your prompts, uploads, camera frames, voice, and generated creations are used to produce your results and operate the Service — not to train or fine-tune our own models.

We select AI providers on the basis that they do not train their models on your content submitted through the Service; they process it only to return the output you asked for and for their own security and abuse-prevention as permitted by contract. Provider roles are listed below and governed by our Data Processing Addendum. For details of how the AI features behave and their limits, see our AI Disclosure & Usage Policy.

7. Sharing & sub-processors

We do not sell your personal information and we do not share it for third-party advertising. We share information only with the service providers (“sub-processors”) that power the Service, each acting on our instructions under contract, and where required by law.

• Cloudflare — hosts and runs the core AI models (including the “Max” chat model, the image model and the vision model), stores generated media, and relays real-time video. Processing occurs on Cloudflare’s global edge, including in the United States.
• fal.ai (United States) — runs video, 3D and upscale generation.
• Vercel (United States) — hosts and serves the website (the front door) and runs the isolated cloud sandbox behind the in-browser terminal.
• Supabase (data stored in Canada, ca-central-1, on Amazon Web Services) — stores accounts, saved creations and application data.
• Google — provides Google OAuth sign-in where you choose to sign in with Google.

We may also disclose information to comply with valid legal process, to enforce our terms, to protect the rights, safety and security of our users, the public or Metatrix Labs, or in connection with a corporate transaction (such as a merger or acquisition), in which case we will require the recipient to protect the information consistently with this policy. The obligations of these sub-processors are described further in our Data Processing Addendum, and cookie details are in our Cookie Policy.

8. International transfers & where your data lives

Your account information, saved creations and application data are stored by Supabase in Canada (ca-central-1). However, because the Service is serverless and globally distributed, processing of your prompts, uploads, camera frames, media and real-time traffic takes place in the United States and on global edge locations operated by our sub-processors (Cloudflare, fal.ai, Vercel and, for sign-in, Google).

This means your information may be processed or stored outside your province or country, including in the United States, and may therefore be subject to the laws of, and lawful access by, foreign courts, governments and authorities. Where information is transferred across borders, we protect it through contractual safeguards, including Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms where applicable, and we require our sub-processors to maintain appropriate security. By using the Service, you acknowledge these cross-border transfers. If you have questions about our transfer safeguards, contact support@metatrix.ai.

9. Retention

We keep personal information only as long as needed for the purposes above or as required by law, then delete or anonymize it:

• Account & profile (email, Google ID): kept while your account is active and deleted, or anonymized, within a reasonable period after you close your account.
• Saved creations & associated settings: kept until you delete them or close your account.
• Prompts & uploads: processed to generate your result; retained only as long as needed to deliver and (where you save it) store your creation, or for a short period for reliability and abuse-prevention, then removed.
• Real-Room camera images: processed transiently to produce the scene description and not retained as a stored gallery item unless you deliberately save the output.
• Voice/audio: processed to deliver the feature and not retained beyond what is needed for that purpose.
• WebRTC connection data: handled for the duration of the call; not stored as a recording by us.
• Precise location: used at the time of the “travel-to” request and not retained as a location history by us.
• Session cookie iomx_session: approximately 30 days, then expires.
• Device/log/IP data: kept for a limited period for security, diagnostics and reliability.
• Security & incident records: where we investigate a security incident, fraud or abuse, we may keep related records for at least five (5) years to meet legal, evidentiary and accountability obligations.
• Locally stored settings/history (localStorage/IndexedDB) remain on your device until you clear them.

10. Security

We use technical and organizational safeguards appropriate to the sensitivity of the information, including:

• Encryption in transit (HTTPS/TLS) and encryption at rest for stored data at our infrastructure providers;
• HttpOnly, Secure, SameSite=Lax cookies for your session, so session cookies cannot be read by page scripts;
• Access controls and least-privilege practices limiting who and what can reach personal information;
• Running untrusted terminal commands in an isolated cloud sandbox separated from user data; and
• Reputable sub-processors bound by security and confidentiality obligations.

No system is perfectly secure, so we cannot guarantee absolute security. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the appropriate authorities as required by law.

11. Your rights & choices

Canada (all users, primary). Subject to legal limits, you may:

• Access the personal information we hold about you and ask how it is used and disclosed;
• Correct information that is inaccurate or incomplete;
• Withdraw consent for uses that rely on consent (see Section 5);
• Ask us to delete your information and close your account;
• Data portability (Quebec): receive computerized personal information you provided to us in a structured, commonly used technological format;
• Complain to the Office of the Privacy Commissioner of Canada (OPC) and, for Quebec residents, to the Commission d’accès à l’information du Québec (CAI).

Your regional rights

EU / EEA / UK (GDPR). Metatrix Labs is the controller of your personal data. Where the GDPR applies, you have the rights to access, rectification, erasure, restriction of processing, objection, and data portability, the right to withdraw consent at any time, and the right not to be subject to solely automated decisions with legal or similarly significant effects. You may also lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office). Our legal bases are consent, performance of our contract with you, our legitimate interests in operating and securing the Service, and compliance with legal obligations.

United States (California and other states). Depending on your state, you may have the right to know/access, delete, and correct your personal information, to receive a copy of it, and to opt out of sale, sharing for cross-context behavioural advertising, and certain profiling. We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We will not discriminate against you for exercising these rights, and you may use an authorized agent where the law allows.

To exercise any right, email support@metatrix.ai. We will verify your request (usually by confirming control of your account email) and respond within the timeframes required by applicable law. These rights are in addition to, and do not waive, any mandatory consumer-protection rights or the rights of Quebec residents.

12. Automated decision-making

Our AI features generate content in response to your requests, but we do not use your personal information to make solely automated decisions that produce legal effects concerning you or that similarly significantly affect you (such as decisions about credit, employment, or eligibility). Automated systems we use for security and abuse-prevention are reviewed by people before any action with a significant effect on your account. If this changes, we will update this policy and provide the disclosures and choices required by law.

13. Children’s privacy

The Service is not directed to children and is intended for adults. We do not knowingly collect personal information from children below the applicable age of consent.

• Canada / Quebec (Law 25): we do not knowingly collect personal information from a child under 14 without the consent of a parent or guardian, except where clearly for the child’s benefit.
• United States (COPPA): the Service is not directed to, and we do not knowingly collect personal information from, children under 13.
• EU / UK: where a higher local digital-consent age applies, we honour it.

If we learn that we have collected personal information from a child below the applicable age without required consent, we will delete it promptly. If you believe a child has provided us information, contact support@metatrix.ai.

14. Cookies & local storage

We use a first-party iomx_session cookie (HttpOnly, Secure, SameSite=Lax, about 30 days) for your session and to link saved creations, authentication cookies where you sign in, and browser localStorage/IndexedDB for on-device settings and history. We use no advertising or third-party analytics cookies. Full details are in our Cookie Policy.

15. Changes to this policy & how we notify you

We may update this Privacy Policy as the Service evolves or the law changes. When we do, we will revise the “Last updated” date and version above and post the new version at this page. If the changes are material — for example, a new category of data, a new purpose, or a new sub-processor — we will provide a more prominent notice (such as an in-product notice or email to your account address) before the change takes effect, and, where the law requires, seek your consent. Your continued use of the Service after an update means you accept the revised policy, except where consent is separately required.

16. Contact & complaints

For any privacy question, request, or complaint, contact our Privacy Officer at support@metatrix.ai. We take concerns seriously and will work in good faith to resolve them. If you are not satisfied with our response, you may contact the OPC (Canada), the CAI (Quebec), your EU/EEA/UK supervisory authority, or your state attorney general or regulator, as applicable.

This Privacy Policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, and disputes are subject to the courts of Ontario — without waiving any mandatory consumer-protection rights, the rights of Quebec residents (including Quebec’s Consumer Protection Act s. 11.1 and Law 25), or other applicable mandatory local laws that protect you.