MLTask ("we", "us") is an independent service run by a solo developer based in San Francisco, California, United States. This policy explains what personal information we collect when you use mltask.com, the MLTask API and the MLTask connector for AI apps (together, the "Service"), what we do with it, who receives it, and what choices you have.
Some features described here (connected social accounts and the MLTask API) are being released gradually and may not be available on your account yet.
1Who we are
MLTask is operated by an individual developer based in San Francisco, California, United States. It is not a registered company. The operator decides how the personal information described here is used (under European law, the operator is its "controller").
For any question, request or complaint about your privacy, write to us at mltask.com/contact or at contact@mltask.com. Where the law requires the operator's legal name, we give it on request.
2What we collect
Your account. Your name, email address and username. You sign in with a one-time code that we email to you, or with Google; in that case we receive the name, email address and profile picture of your Google account. MLTask has no passwords.
What you create and upload. The inputs of each run (your prompts, captions, settings and attached files), the results the models produce, the files in your library with technical details such as name, type, size and duration, and your workspaces, presets, workflows, scheduled runs and reactions.
Prompts and files can contain personal information about you or about other people, such as faces, voices and names. Upload only what you have the right to use, and include other people's personal information only with their permission. Please don't put sensitive information in a prompt or a file unless the task really needs it: health details, government ID numbers, payment card numbers.
Payments and credits. Stripe handles payments: your card details go straight to Stripe, and we never receive or store them. When you create an account, we create a customer record for you at Stripe with your email address and your MLTask account ID. We keep your plan, your credit balance, and a history of purchases, credit use and refunds. If you tell us why you cancelled a subscription, we keep your answer.
Accounts and apps you connect. Social accounts (section 5), AI apps and API keys (section 6), and your own API keys for AI providers if you add them, which we store encrypted and use only for your own runs.
Technical information. Our servers log each request: IP address, browser and device type, the page or API route, the time, and errors. We also use cookies and browser storage (section 9).
Messages you send us. What you write in the contact form, with your email address, and the email address you gave if you joined our waitlist.
3How we use it
| What for | Which information | Legal basis (EEA, UK, Switzerland) |
|---|---|---|
| Providing the Service: running the models you choose, storing your results and files, posting and scheduling for you, showing your post statistics | Account, content, connected accounts | Our contract with you |
| Signing you in, keeping accounts secure, stopping bots and abuse | Account, technical information | Our contract with you; our legitimate interest in a safe service |
| Taking payments and keeping your credit balance | Payments and credits | Our contract with you; legal obligations (tax and accounting) |
| Service emails: sign-in codes, a welcome message, notices about your account or this policy | Email address | Our contract with you; our legitimate interest in keeping you informed |
| Answering your messages | Messages you send us | Our legitimate interest in supporting users |
| Measuring how the site is used (Google Analytics) | Usage statistics | Your consent |
| Fixing problems and keeping the Service running | Technical information | Our legitimate interest in a working service |
| Complying with the law and enforcing our terms | What the case requires | Legal obligation; our legitimate interests |
What we don't do:
- We don't sell your personal information, and we don't share it with anyone for advertising.
- We don't use your prompts, files, results or connected-account data to train AI models.
- We don't make decisions about you by automated means that have legal or similarly significant effects.
4AI models: who receives your prompts and files
Most models on MLTask are operated by other companies. When you run a model, we send the inputs of that run to the company that operates it: your prompt, your settings and the files you attached; with a preset, the preset's text with your values filled in; and with a chat model that keeps history, the earlier runs of the same workspace. "Write with AI" and the tools that fill in a preset for you work the same way.
We don't send your name, your email address or your payment details, unless you put them in a prompt or a file yourself.
Each provider handles what it receives under its own terms and privacy policy, which also say how long it keeps the data. Some providers' terms let them use what they receive to improve their own models. If that matters for what you are sending, read the provider's policy before you choose its model. If you add your own API key for a provider, runs that use it go through your own account with that provider.
The name of each model ends with the company that operates it, for example "Kling 4 (FAL)". When a model is made by one company and operated by another, the maker can receive the inputs too.
The companies that operate models for us today, each linked to its privacy policy: Alibaba Cloud (Model Studio), Anthropic, Black Forest Labs, Bria, DeepSeek, ElevenLabs, fal, Google (Gemini API), Ideogram, Inworld, Lightricks (LTX), Luma, Magnific (formerly Freepik), Meta, MiniMax, Moonshot AI (Kimi), OpenAI, OpenRouter, Replicate, Runway, Tripo and xAI. The list changes as we add and remove models.
Faces and voices
Some tools work on a face or a voice, for example face swap or voice changer. The picture or recording you provide goes to that tool's provider, which uses it to produce the result. MLTask itself doesn't make or store a scan of anyone's face (a "faceprint") or voice (a "voiceprint"), doesn't use your pictures or recordings to identify people, and never sells them. The picture or recording you uploaded stays in your library like any other file, until you delete it.
5Connected social accounts
You can connect YouTube, Facebook Pages, Instagram, TikTok, LinkedIn, Pinterest and X, so that MLTask can post for you and show you how your posts perform. You connect on the network's own sign-in page. We never see your password for that network.
What we store
We read an account's details when you connect or reconnect it, and we keep them stored, not just for the moment of a request, for as long as the account stays connected:
- The access tokens the network gives us. We encrypt them (AES-256-GCM) and never show them in the app or send them to an AI app.
- The account's ID and its profile as the network returns it: name, username and picture, and where provided, bio and the numbers of followers and posts. We store these numbers only, never who your followers are.
- The Pages, channels or boards you can post to.
For each post we publish for you, the run that made it keeps the post's ID or link.
What we do with a connection
- Publish what you wrote or approved, to the account you chose, right away or at the time you scheduled. We never post without your instruction.
- Read your own posts and their statistics when you run a Post Analytics task. The report (your recent posts with their captions and links, and numbers such as views, reach, likes, comments, shares and saves) is saved as that run's result in your workspace until you delete it.
- Read what a post needs, for example your TikTok account's privacy options, your Pinterest boards, or your channel's videos when you change a thumbnail.
- Renew the tokens so the connection keeps working.
What we never do with it
We don't sell this data, share it for advertising, use it to build profiles of you or your audience, or use it to train AI models. We don't read private messages, contacts or friend lists. Nobody at MLTask looks at this data unless you agreed to it for a specific case (for example a support request), it is needed for security (such as investigating abuse or a bug), or the law requires it.
If you ask an AI model or an AI app to work with it
A statistics report is text in your workspace. If you then run a chat model in that workspace, the report is sent to that model's provider as context for the run. If you connect an AI app (section 6) and ask it about your accounts or runs, it receives the names of your connected accounts and the results you ask for. Both happen only when you start them.
What this means for each network:
YouTube (Google)
- What MLTask does: sees your Google account's name, email address and picture; uploads videos and sets thumbnails on your channel; reads your channels, your videos and their statistics.
- What we store: your Google account ID, name, email address, picture and language; each channel's ID, title, handle, description and picture, and whether it can upload long videos.
- Where you remove MLTask: Google security settings.
Facebook Pages and Instagram (Meta)
- What MLTask does: sees the Pages you manage and the Instagram professional accounts linked to them; publishes posts, photos, videos and Reels; reads your Pages' and Instagram posts and their insights.
- What we store: your Facebook ID, name and picture; each Page's ID, name, username, category and picture; each Instagram account's ID, username, name, bio and picture, and the numbers of followers, accounts followed and posts.
- Where you remove MLTask: on Facebook, under Settings & privacy, Settings, Business Integrations.
TikTok
- What MLTask does: reads your profile and its statistics; reads your videos and their statistics; posts videos and photos.
- What we store: your display name, username, avatar, bio, profile link and verified status; the numbers of followers, accounts followed, likes and videos; your posting options (privacy choices, comment, duet and stitch settings, and the longest video allowed).
- Where you remove MLTask: in the TikTok app, under Settings and privacy, in the security section, Manage app permissions, Remove access.
- What MLTask does: sees your name, email address and picture; posts for you.
- What we store: your LinkedIn member ID, name, email address and picture.
- Where you remove MLTask: LinkedIn permitted services.
- What MLTask does: sees your account, boards and pins; creates pins; reads your pins' statistics.
- What we store: your account ID, username, account type, picture, bio, website and business name; the numbers of boards, pins, followers and accounts followed, and monthly views; up to 25 of your boards (ID, name, description, privacy, cover image and counts).
- Where you remove MLTask: on Pinterest, under Settings, Security.
X
- What MLTask does: sees your profile and posts; posts and uploads media for you; reads your posts' statistics.
- What we store: your account ID, name, username, bio, picture and verification type; the numbers of followers, accounts followed, posts, lists, likes and media.
- Where you remove MLTask: X connected apps, under Settings, Security and account access, Apps and sessions.
Disconnecting
In MLTask, open Settings, Social Networks and disconnect the account. We delete its tokens and profile details from our systems right away. Disconnecting doesn't yet remove MLTask from the list of apps at the network: to withdraw the permission there too, use the network's page named above. Section 11 says how to delete all the data that came from a network.
YouTube and Google
- MLTask uses YouTube API Services to upload your videos, set thumbnails, and read your channels, your videos and their statistics. By connecting YouTube you also agree to the YouTube Terms of Service.
- Google's own handling of your information is described in the Google Privacy Policy.
- We keep your Google tokens and channel details only while YouTube is connected, and delete them when you disconnect. Statistics you asked for stay in the report of that run until you delete the run.
- Besides disconnecting in MLTask, you can revoke MLTask's access to your Google data at any time on the Google security settings page: https://security.google.com/settings/security/permissions. If you revoke it there, also disconnect YouTube in MLTask or tell us, so that we delete what we stored.
- MLTask's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the YouTube features you see in MLTask. We don't transfer it to anyone, except to carry out what you asked for as described in this section, for security, or to comply with the law. We don't use it for advertising, and we don't use it to train AI models.
- If you only sign in to MLTask with Google, we receive your name, email address and profile picture, and nothing else.
6AI apps and the MLTask API
You can let an AI app, such as Claude, Claude Code or ChatGPT, work with your MLTask account through the MLTask connector (an MCP server), or use the MLTask API with a key you create. You approve each app on an MLTask screen that says what it will be able to do, and you can revoke it at any time.
What a connected app can see, as you
| Information | Why the app gets it |
|---|---|
| The models and presets available to you, including the text of your own presets | To choose what to run and fill it in |
| Your credit balance and the price of a run | To show you the price and ask before spending credits |
| Your workspaces and runs: names, status, dates, the model and preset used, credits spent, text results and links to result files | To show you results and continue your work |
| Your library files: name, type, size, dimensions, duration, date, the run a file came from, and a link that expires | To use your files in a run and show them to you |
| Your connected social accounts: the network, the account's name, username and picture, your Pages, channels and boards, and your posting options. Never the access tokens | To post to the account you choose |
| Your scheduled runs: time, time zone, model and the beginning of their text | To list or cancel them |
What a connected app can do, as you
Run models and presets (this spends your credits; the app shows the price and asks first), schedule and cancel runs, post to your connected social accounts when you approve the post, create and change your presets, upload files you ask it to, and, only with your OK, make a preset or its sample runs public.
What we receive from the app
Only the requests it sends us: which action, with which inputs (for example a prompt, settings or a file), and the app's name and registered address. We don't receive your conversation with the app, and we don't build a profile from what the app sends.
What the app receives
The answers to its requests, as listed above. From then on, that information is handled by the company behind the app (for example Anthropic for Claude, OpenAI for ChatGPT), under your agreement with them and their privacy policy.
What we store about the connection
The app's name and address, what it may do, when you approved it, when it was last used and when you revoked it. For the access tokens and API keys we issue, we store only a fingerprint (a hash), never the token or key itself.
Revoking
Settings, MCP: revoke the app. Settings, MLTask API: revoke the key. Access stops at once. You can also remove MLTask in the app's own connector settings. Revoking doesn't take back what the app already received.
7Who receives your information
We share personal information only with:
| Who | Why | What they receive |
|---|---|---|
| Amazon Web Services | Hosting, database, file storage and delivery, sending email, logs | Everything we store. Our servers are in Oregon, USA |
| Stripe | Payments and subscriptions | Your email address and what you buy. Card details go from you straight to Stripe |
| AI model providers (section 4) | Running the model you chose | The inputs of that run |
| The social networks you connect (section 5) | Publishing your posts, reading your statistics | What you post, and our requests for your data |
| AI apps you connect (section 6) | Working with your MLTask account | What the app asks for on your behalf |
| hCaptcha (Intuition Machines, Inc.) | Telling people from bots on our forms | Your IP address and signals from your browser |
| Sign-in with Google; Google Analytics (section 9) | That you signed in to MLTask; what section 9 describes | |
| Slack | Internal alerts to our team | Your email address and the event: a new account or a plan change |
| Our email provider | Receiving contact form messages | Your message and your email address |
We may also disclose information when the law requires it or to protect the rights and safety of MLTask, our users or others, and to a successor if MLTask is merged or sold, in which case we will tell you before your information comes under a different policy. Anything you make public can be seen by everyone (section 8).
Stripe. We use Stripe for payments. On the checkout page, Stripe collects information about your device and how you use the page, through cookies and similar technologies, to detect and prevent fraud. Stripe uses this information to operate and improve its services, as its Privacy Policy describes.
hCaptcha. Our sign-up, sign-in and contact forms are protected by hCaptcha, a security service of Intuition Machines, Inc. It checks that a form is being used by a person and not by a bot. For that, it evaluates information such as your IP address, your device and browser, and how you interact with the page, as our service provider. hCaptcha's Privacy Policy and Terms of Service apply.
8What is public
- Runs are private unless you set them to public. Anyone can see a public run: its inputs (including your prompt and attached files), its results, the model and preset used, your name, username and picture, and the reactions it got. Your connected accounts are never shown.
- A public preset shows its name, description, sample runs and your username. Its template text is shown only if you made the preset open source.
- Your profile page shows your name, username and picture, your public presets and runs, and how many presets you created and runs you completed. If you signed up with Google, the name and picture are the ones from your Google account.
- Public pages can be indexed by search engines and shown in link previews. If you make something private again or delete it, it leaves MLTask's pages, but copies kept by search engines or by other people can remain for a while. What other people do with content you made public is outside our control.
9Cookies and browser storage
We use cookies for three things:
- Signing in and settings (MLTask): they keep you signed in and remember your cookie choice.
- Security (hCaptcha on our forms, Stripe on the checkout page): they tell people from bots and help prevent fraud.
- Analytics (Google Analytics): they tell visitors and visits apart for usage statistics, and are set only if you accept them in the banner.
We also keep some things in your browser's own storage, which stays on your device: your settings, drafts of what you were typing, and a copy of some of your account's data so that pages load faster.
Google Analytics. We use Google Analytics 4 to count visits and see which pages people use. Until you accept analytics cookies, it sets no cookies and sends Google only basic signals for a page view, such as the time, your browser type and the page you came from. We never ask for advertising cookies. Google explains what it does with this information in How Google uses information from sites or apps that use our services.
Your choices. The banner asks before any analytics cookie is set. To change your choice later, delete this site's cookies in your browser and the banner will ask again. You can also block cookies in your browser, but if you block the sign-in cookies, you can't sign in.
Do Not Track. Our site doesn't change its behavior when your browser sends a Do Not Track signal. Google (if you accept analytics), hCaptcha and Stripe receive information about your use of our pages as described above; apart from them, we don't let other companies collect information about what you do over time and across websites through MLTask.
10How long we keep it
| Information | How long |
|---|---|
| Your account, runs, results, files, presets, workspaces and workflows | Until you delete them, or until your account is deleted |
| Connected social accounts (tokens and profile details) | Until you disconnect; then they are deleted right away |
| Connected AI apps, MLTask API keys and your own provider keys | Until you revoke or remove them. The record of a connected app or an MLTask API key stays until your account is deleted |
| Purchases and credits | Until your account is deleted. Stripe keeps its own records of your payments for as long as the law requires |
| Server logs | About 30 days |
| Database backups | 35 days |
| Google Analytics data | At most 14 months |
| Messages you sent us | As long as it takes to deal with your request |
11Deleting your data
What you can delete yourself, at any time
- A run, a workspace, a preset or a file in your library, from its menu. Deleting a run doesn't delete the files it produced: delete those in your library.
- A connected social account, a connected AI app, an API key or your own provider keys, in Settings.
Cancelling a subscription doesn't delete your account or your content.
Deleting your account
In Settings, Profile, choose Delete account and type your email address to confirm. Deletion starts at once and can't be undone.
Within 24 hours we delete your profile, runs, results, files, presets, workspaces, workflows, reactions, connected social accounts and their tokens, connected AI apps, API keys, and your credit and purchase history. Your sign-in is removed, a subscription is cancelled without a refund, and unused credits are lost.
What remains: Stripe keeps its own records of your payments for as long as the law requires, our server logs expire within about 30 days, and our database backups within 35 days. We can't delete posts already published on a social network (delete them there), runs other people made with your public presets, copies of public content that other people saved, or data held by an AI provider under its own policy.
If you can't sign in, write to us at mltask.com/contact or at contact@mltask.com from your account's email address, and we delete the account for you within 7 days.
Deleting the data from one network (Facebook, Instagram, YouTube, TikTok, LinkedIn, Pinterest or X)
- In MLTask, open Settings, Social Networks and disconnect the account. Its tokens and profile details are deleted right away.
- Delete the runs that hold results from that account (links to your posts, statistics reports), or ask us to: we do it within 7 days at the latest.
- Remove MLTask in the network's own settings (section 5 says where, for each network).
Deleting data in MLTask doesn't delete what the network itself stores: to delete a video or a post there, use the network's own app or site.
12Your rights
Everyone. You can ask us for a copy of your personal information, ask us to correct it, or ask us to delete it. You can download your own files and results from the app at any time. Write to us (section 17); we answer within 30 days.
European Economic Area, United Kingdom and Switzerland. You have the right to access, correct or delete your personal information, to restrict or object to our use of it, to receive it in a portable format, and to withdraw a consent you gave (for analytics cookies, see section 9). The legal bases we rely on are in section 3. You can also complain to your local data protection authority.
California. You can ask what personal information we collected about you, ask us to correct or delete it, and we won't treat you differently for asking. The categories we collect are in section 2 and who receives them is in section 7. We don't sell personal information and we don't share it for cross-context behavioral advertising.
13Security
Your information travels over encrypted connections (HTTPS) and is encrypted where it is stored. The tokens of your connected accounts and your own provider API keys get a second layer of encryption (AES-256-GCM), with keys kept in a separate secrets store. For the access tokens and API keys we issue, we store only a fingerprint. Private files are delivered through signed links that expire. Access to our production systems is limited to the people who operate MLTask.
No system is perfectly secure. If you think your account has been misused, or you found a security problem, write to us (section 17).
14Where your information is processed
MLTask stores your information in the United States. If you use MLTask from another country, your information is sent to and processed in the United States. The inputs of a run are also processed where that model's provider operates, and some providers are based outside the United States, in Europe or in Asia. These countries can protect personal information differently from yours. Where the law requires a safeguard for such a transfer, we rely on the standard contractual clauses in our providers' terms, or on your own request to run that model.
15Children
MLTask is not for children under 13, and we don't knowingly collect personal information from them. If you are under 18, you need your parent's or guardian's permission to use MLTask. If you believe a child under 13 gave us personal information, write to us and we will delete it.
16Changes to this policy
We may change this policy. The date at the top shows when it last changed. When we change it, we may let you know by email, with a notice on MLTask, or by updating that date. Unless we say otherwise, the new version applies from the day it is posted, and using MLTask after that day means you accept it. If you don't agree with a change, stop using MLTask.
One exception: if we want to use data from a connected account in a new way, we ask for your agreement first.
17Contact
MLTask, San Francisco, California, United States
mltask.com/contact or at contact@mltask.com