Privacy Policy | Muftox Studio

Last updated: 13 September 2026

Muftox Studio is committed to processing only the data that is strictly necessary, to never selling it, and to letting anyone access, correct or erase their data at any time. This policy describes those processing activities in detail.

1. Data controller

The data controller is:

Muftox Studio, trading name of the sole proprietorship Omar Mufti
SIREN 992 837 583 — SIRET 992 837 583 00010 (French business register)
Business activity code APE 62.01Z, computer programming
31 boulevard Soult, 75012 Paris, France
Email: contact@muftox.studio — Phone: +33 7 50 19 61 01

Muftox Studio is a software development studio. It publishes this showcase website and develops applications, including ApplyZo. Any question regarding personal data can be sent to contact@muftox.studio.

2. Scope

This policy covers two distinct perimeters.

This muftox.studio website, which is a static presentation site. It has no user accounts, no customer area and no advertising tracker.
Processing carried out by Muftox Studio as publisher of its applications, in particular when those applications connect to third-party programming interfaces such as those of LinkedIn, Google or Microsoft.

Each application published by Muftox Studio also has its own privacy policy detailing the processing specific to it. For ApplyZo, it is published at applyzo.io/privacy.

3. Data processed through this website

The muftox.studio website sets no analytics, profiling or advertising cookie. The only data processed is the following.

Data	Source	Purpose	Retention
Name, email address, message content	Contact form or direct email	Answering the request	3 years from the last exchange
IP address, date and time, page requested, user agent	Server technical logs	Security, abuse detection, troubleshooting	12 months maximum

The site’s stylesheets and icons are loaded from the public jsDelivr content delivery network. In doing so, your browser discloses its IP address to that provider, as it does for any remote resource. No advertising identifier is transmitted.

4. Legal bases

Consent, GDPR Article 6(1)(a), for any connection to a third-party service and for any data import made at your request.
Performance of a contract, Article 6(1)(b), for the delivery of subscribed services.
Legitimate interest, Article 6(1)(f), for system security and fraud prevention.
Legal obligation, Article 6(1)(c), for the retention of accounting records.

5. Data obtained from LinkedIn

Muftox Studio uses LinkedIn’s Member Data Portability API, made available by LinkedIn under the European Digital Markets Act. This section describes that processing precisely.

What we retrieve, and nothing else

After the member’s explicit authorisation, we query the Member Snapshot API for the following domains, and no other:

CONNECTIONS: the name, position, company and connection date of the member’s own first-degree connections.
PROFILE, POSITIONS, EDUCATION: elements of the member’s own profile, so that they do not have to retype them.

We request no other domain. In particular, we do not access messages, searches, advertising data, or inferences drawn about the member.

Why

Solely to populate the member’s own private workspace, so that they can organise their professional network and run their own job search. This data serves that member’s personal use, and that use alone.

Our commitments

We obtain separate, explicit consent before storing anything, on a screen dedicated to this import. Consent to sign in is never treated as consent to import.
Imported data lives in that member’s own account only. It is never shown to other users, never shared, never sold, never licensed.
It is never aggregated into any derivative dataset, never used to enrich a contact database, and never used to train an artificial intelligence model.
The member can delete this data at any time from the application. We erase all ported data immediately upon request, or when the account is closed.
The member can withdraw authorisation at any time, from their LinkedIn account settings or from our application. Withdrawal stops any further synchronisation.
We write nothing to LinkedIn. No posting, no messaging, no invitation, no action on the member’s behalf. The application requests no write permission of any kind.
We carry out no automated extraction from LinkedIn, and we seek no data concerning any person other than the consenting member.
In line with LinkedIn’s terms, this flow is offered only to members located in the European Economic Area.

Retention

Ported data is retained for as long as consent remains valid and the account is active. Access tokens are encrypted at rest and expire at the term set by LinkedIn.

6. Signing in through third-party services

Some of our applications allow signing in with a Google, Microsoft or LinkedIn account. In that case we receive only the identification elements needed to create the account: a technical identifier, first and last name, email address and, where applicable, a profile picture. We never receive your password. Authentication takes place entirely on the relevant provider’s domain.

7. Recipients and processors

We sell no personal data and transfer none for advertising purposes. Data may be processed by the technical providers strictly necessary to the service:

Provider	Role	Location
OVH	Server and database hosting	European Union
Stripe	Payment processing	European Union and United States
Google	Authentication, sending email at the user’s request, bot protection, notifications	European Union and United States
Microsoft and LinkedIn	Authentication, member data portability	European Union and United States
OpenAI	Writing assistance features	United States
MillionVerifier	Email address validity checking	European Union

Each of these providers is bound by a processing agreement compliant with GDPR Article 28. Data ported from LinkedIn is never passed to any of these providers for purposes of their own.

8. Transfers outside the European Union

Some providers are established in the United States. Those transfers are governed by the European Commission’s standard contractual clauses or by the EU-US Data Privacy Framework, depending on the provider concerned.

9. Security

All traffic encrypted in transit using TLS.
Third-party service access tokens encrypted at rest.
Passwords stored as one-way hashes, never in clear text.
Strict data isolation between user accounts.
Access logging and rate limiting to detect abuse.
Production system access restricted to the data controller alone.

In the event of a data breach presenting a risk to your rights and freedoms, we notify the French data protection authority within 72 hours and inform you as soon as possible, in accordance with GDPR Articles 33 and 34.

10. Your rights

Under GDPR Articles 15 to 22, you have the following rights:

Right of access to your data.
Right to rectification of inaccurate data.
Right to erasure.
Right to restriction of processing.
Right to data portability, in a structured, machine-readable format.
Right to object to processing based on legitimate interest.
Right to withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise these rights, write to contact@muftox.studio. We respond within one month. If our answer does not satisfy you, you may lodge a complaint with the French data protection authority, Commission nationale de l’informatique et des libertés, 3 place de Fontenoy, 75007 Paris, cnil.fr.

11. Retention periods

Account data: for the lifetime of the account, then erased within 30 days of its deletion.
Data ported from a third-party service: until consent is withdrawn, erasure is requested, or the account is closed.
Technical logs: 12 months maximum.
Accounting records: 10 years, under Article L123-22 of the French Commercial Code.

12. Minors

Our services are not intended for people under 16. We do not knowingly collect data concerning them. Should such collection come to our attention, the data would be erased without delay.

13. Changes

This policy may change. The last updated date appears at the top of the page. In the event of a substantial change affecting your rights, we will inform you by an appropriate means before it takes effect.

14. Contact

Muftox Studio — 31 boulevard Soult, 75012 Paris, France
contact@muftox.studio — +33 7 50 19 61 01

This English version is provided for convenience. In case of discrepancy, the French version prevails.