Updated on 13 September 2026. Three different things are described here: what this site collects, what your Muzau account contains, and what the application does with the data from the tools you connect to it.
The controller of this processing is Arthur Osstyn EI, a sole trader trading under the name O2S, SIREN 900 494 048, whose registered address is Station F, 5 parvis Alan Turing, 75013 Paris, France. For any question about your data, write to contact@muzau.fr.
This document also exists in French. In the event of any discrepancy between the two versions, the French version prevails.
Only what you give us: your email address and, if you answer the optional question, the job you would like to hand to an agent. Nothing else.
To reply to you, to keep you posted if you asked us to, and to understand which needs to prioritise. Your address is neither sold nor passed to a third party for commercial purposes.
The legal basis is your consent, which you may withdraw at any time by writing to us.
Three years at most after your last contact with us, then erasure. You may ask for deletion at any time.
This site uses no advertising tracker. It sets no cookie until you ask for one: if you choose a language at the bottom of the page, that choice is kept for a year in a cookie containing nothing but « fr » or « en », and serving only to give you the site back in that language. The fonts are served from this site: your browser contacts no outside server to display them. A cookie-free audience measurement counts visits in aggregate, without identifying you or following you from one site to another.
Site hosting and audience measurement: Vercel Inc. (United States), which processes the data on our behalf under standard contractual clauses. Recording of sign-ups: Google Sheets (Google Ireland Limited), in a private document accessible only to the publisher of the site.
Our site offers you a chat assistant. It is provided by Muzau (muzau.fr), acting on our behalf.
What we keep: the content of your conversation and the address of the page you write to us from. A conversation that stays anonymous is deleted after 30 days. If you leave us your email address so that we can get back to you, the exchange joins our customer correspondence and is kept for as long as that is.
What we store in your browser: a technical identifier, used only to find your conversation again if you come back. It is not an advertising cookie, it does not follow you across other sites, and clearing this site's data removes it.
Where your message goes: it is sent to an artificial intelligence provider, which writes the reply on our behalf.
To prevent automated submissions, a technical fingerprint of your IP address is kept for at most 48 hours. We never keep the address itself.
To access your data, correct it or have it deleted, write to us at contact@muzau.fr.
Your email address and those of the people you invite, your company name and what you tell us about it so that your agents can work, the agents you create and their settings, the history of what they have done, and the record of your credit consumption.
We do not keep your password: authentication is handled by our database host, and we never see its content.
Payments are handled by Stripe (Stripe Payments Europe for the European Union, Stripe, Inc. in the United States), acting as payment provider. Your card details are entered on their side and never pass through our servers: we neither receive nor store them.
From Stripe we receive what is needed to run your subscription and your invoices: your billing identity, the plan taken out, the amounts, the dates, and the status of payments.
Performance of the contract between us, for everything that makes your account and your agents work. A legal obligation, for invoicing and its retention. Our legitimate interest, for the security of the service and the prevention of abuse, to the extent it does not override your rights.
Your account data, for as long as the account is open. When it is closed, the data is erased within thirty days, unless you ask us to return it to you first.
Invoices and accounting records are kept for ten years, because the law requires it. Technical logs needed for security are kept for one year, then erased.
Two records deliberately outlive the closure, because they exist for no other purpose than proof. The record of your acceptance of our terms (your account identifier, the text accepted, its version and the date, never your address) is kept for five years after the end of our relationship. The log of your data being opened by our team (who looked, at what and when, never what was read) is kept for one year. Erasing them along with the account would mean erasing the proof on the very day it is needed.
Muzau lets you create agents that work for you. So that they can, you may open access to some of your tools for them. That authorisation comes from you, it is limited to what you grant, and you can withdraw it at any time.
Google Calendar. Muzau queries only your busy periods, through Google's « free/busy » function. The title of your meetings, their participants, their notes and their attachments are never read: we receive only slots as taken or free. When you allow an agent to book a meeting, it creates one event (the one it has just agreed, with its subject and the address of the person invited) and changes nothing else in your calendar.
Google Sheets. Muzau reads the sheets you point it to and copies their rows into your workspace, so that your agents can refer to them without reading the file again every time. It can write back into a tracking column reserved for it, so that you find in your own file what the agent did.
Google Drive. Two distinct uses. To attach one of your documents to a message, Muzau lists your files (their name and their identifier) and downloads the content only at the moment of sending, once that sending has been approved. The content of your files is neither browsed nor kept in order to build that list. To archive, Muzau places in a dedicated folder the documents it produced itself, such as quotes as PDFs; for that part, it only has access to the files it created.
To run the service you asked for: to let your agents decide and act, and to report to you on what they did. Nothing is used for advertising purposes, nothing is sold or transferred, and one company's data is never cross-referenced with another's to run the service.
Maintaining the platform is the only other use. Understanding why an agent got something wrong means opening the detail of what happened; fixing a defect that affects several customers means bringing together what several companies have asked for, or have had to say again to their agents. That comparison serves to repair the product for everyone, never to run one company's service with another's data, and opening the detail of an exchange leaves a timestamped record of who looked and at what, without ever copying what was read.
So that an agent can reason, the context useful to its decision (a row from your file, a free slot, the name of a document, the text of the message it is answering) is passed to the model that runs it.
Two providers may supply it: OpenAI (OpenAI Ireland Limited for the European Union, OpenAI, L.L.C. in the United States) and Anthropic PBC (United States). Both process this data on our behalf, under standard contractual clauses where they are established outside the European Union.
We choose the model used for each task, and we may change it: that is why both are named here rather than one. Changing model alters neither the nature of the data passed on, nor what is done with it.
This data is not used to train any model, neither ours nor those providers'.
Muzau's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
In practice, we transfer this information to a third party only as far as necessary to run the service, to comply with the law, or as part of a transfer of business of which you would be informed beforehand. No human being consults it, except with your explicit agreement, to resolve an incident you reported to us, for security reasons, or if the law requires it of us.
The application's processing and database are hosted in France, in the Paris region, with Vercel Inc. and Supabase Inc. Your agents' emails are routed by Resend Inc. Payments are handled by Stripe. These providers process the data on our behalf, under standard contractual clauses where they are established outside the European Union.
The authorisations to access your tools are encrypted before being stored (AES-256-GCM) and partitioned by company. Every action by an agent is written into a log you can consult, and sensitive actions (sending, attaching a document, committing) go through your approval.
You can disconnect at any time from Muzau: the authorisation is then revoked with Google and the corresponding tokens are erased on our side. All reading stops immediately. You can also withdraw access from your Google account, on the authorised applications page.
The rows already copied from your sheets stay in your workspace as long as you do not delete them: that is what lets your agents keep working after a disconnection. Write to us to ask for their erasure; deleting your account erases them with it.
Under the GDPR, you have rights of access, rectification, erasure, restriction, portability and objection over your data. Where processing rests on your consent, you may withdraw it at any time, without calling into question what was done before.
Two of these rights can be exercised directly from your account, without writing to us: exporting your data and deleting the account. For the others, write to contact@muzau.fr: we reply within one month.
If our answer does not satisfy you, you may refer the matter to the CNIL (cnil.fr), which is the competent supervisory authority.