Privacy Policy

Data We Collect

• Email address and account information.
• Blueprint content, including product descriptions, people, key moments, rules, permissions, user journeys, and product stage.
• AI report content generated from your blueprint.
• If you connect a code repository: the repository owner and name, its default branch, the commit identifier of the last scan, and the tech stack summary produced by that scan.
• Payment metadata from Paddle, such as payment status and checkout transaction identifiers.

Connecting a Code Repository

You can connect a GitHub repository so Mazora can describe your tech stack for you instead of you writing it by hand. Access is granted through a GitHub App that you install and can uninstall at any time.

Mazora never clones your repository. It reads the list of file paths, and then only specific files, over GitHub’s API.

Scanning your tech stack reads dependency manifest files only — for example package.json, .csproj, pyproject.toml, go.mod, pom.xml, Gemfile, composer.json, and Cargo.toml.

Scanning the Actors, Policies, or Workflows sections reads some of your application source code, because that is where those things are described. Mazora picks the files by name — controllers, routes, authentication, validation, services and similar — and reads at most 40 files per section, up to 20,000 characters from any one file and 300,000 characters in total. It skips dependencies, build output, and generated files. You can see exactly which files a scan would read, before running it.

Working out which technologies you use is deterministic: your manifests are matched against a fixed list of known packages, with no AI involved. Turning those findings into readable prose is then done by OpenAI — see AI Providers below for exactly what is sent. The result is saved to your blueprint and you can edit or delete it like any other context you wrote yourself.

Mazora authenticates using short-lived GitHub installation tokens that are re-minted as needed and are not stored. Uninstalling the GitHub App ends Mazora’s access immediately; previously scanned summaries remain on your blueprint until you edit or delete them.

How We Use Data

We use your data to provide account access, save blueprints, generate reports, unlock paid report access, improve beta reliability, and communicate account or payment updates.

AI Providers

Mazora uses OpenAI in three places, and each only runs when you ask for it: generating a report, drafting a guardrail work item, and summarising a repository scan.

When you generate a report, Mazora sends OpenAI your product basics and your four context sections — tech stack, actors, policies, and workflows — together with your guardrail work items. When you draft a work item, it sends the description you wrote and the relevant approved sections.

When you scan your tech stack, Mazora sends OpenAI the repository’s name and branch, the technologies detected from your manifests, the paths of the manifest files it read, and your repository’s top-level file and folder names. The contents of your manifest files are not sent.

When you scan the Actors, Policies, or Workflows sections, Mazora sends OpenAI excerpts of the application source files it read, each labelled with its path, so the model can describe what they show. This is real source code from your repository, within the limits described above.

Mazora does not send your account email, payment metadata, or GitHub credentials to OpenAI.

Do not submit secrets or sensitive regulated data that should not be processed by third-party AI systems.

Payments

Payment processing is handled by Paddle. Mazora stores limited payment metadata needed to confirm report access, but does not store full card details.

Retention and Deletion

We retain account, blueprint, report, and payment metadata while needed to provide the service. You can request deletion of your account and product data by contacting us.

Contact

For privacy requests, contact info@mazora.io. This contact address is a beta placeholder and may change before public launch.