Privacy Policy

Who controls your data

Murray is operated from the United Kingdom and may serve users in the United States, United Kingdom, and other markets. For privacy questions or data requests, contact support@askmurray.co.

What we collect

• - account details such as name, email address, login activity, and workspace membership
• - business context such as business name, goals, improvement areas, documents, websites, public handles, conversations, projects, and generated outputs
• - technical data such as device, browser, IP address, logs, errors, and usage events
• - billing data if paid subscriptions are enabled, processed through Stripe

Why we use it

We use your data to create and secure your account, operate your workspace, provide AI-assisted business advisory features, remember business context, process documents, respond to support requests, improve reliability, prevent abuse, and handle billing if applicable.

Lawful basis

We generally process account, workspace, and billing data because it is necessary to provide the service or take steps before entering into a contract. We may process reliability, security, and product-usage data based on legitimate interests. Where consent is required, for example for optional marketing or certain cookies, we will ask separately.

Processors and sharing

We share data with service providers that help us operate Murray. See the sub-processor list for more detail. These may include:

• - Supabase for authentication, database, file storage, and related infrastructure
• - Vercel for hosting, deployment, and application infrastructure
• - Anthropic and other AI model providers for generating responses and analysis
• - Stripe for payment processing if you become a paying customer
• - monitoring, email, and support tools if enabled for launch operations

Assistants you connect

The owner of a business can connect their own AI assistant, such as Claude or ChatGPT, so it can read the business's record in Murray for them. Only the owner can connect one, and nothing is shared until they do.

• - What it can read: only the kinds of record the owner chose when connecting, such as customers, invoices or decisions. Each fact it receives says where it came from and when Murray last confirmed it.
• - What it never gets: anything about the team's pay or anyone's performance, notes, recordings and replies as they were said, or anything about an individual patient. Murray does not hold patient records.
• - What Murray stores when the assistant tells it something: only the item the assistant sends (one line, who, a date, a reason and where it was seen), as a proposal in the owner's queue. Nothing else from the conversation reaches Murray. The conversation itself is handled by the assistant's provider under its own terms.
• - The receipt: for each connected assistant, one line per kind of request per day, saying which kinds of record were served. The owner sees it on the Sharing page. It is kept while the workspace exists and deleted with it.
• - Ending it: the owner can end a connection at any time from the Sharing page. The assistant's next request gets nothing, and its access is withdrawn.

International transfers

Some providers may process data outside the UK or outside your home country, including in the United States. Where this happens, we rely on the provider's published transfer safeguards, contractual protections, and applicable adequacy or transfer mechanisms.

Retention

We keep workspace data while your account is active, unless you delete your account or ask us to erase it. Account deletion removes your owned Murray workspaces, conversations, business memory, project outputs, and uploaded files from active systems. Some records may be retained longer where needed for security, billing, legal, or audit purposes. We will tighten specific retention periods before broad public launch.

Your rights

Depending on the lawful basis and circumstances, you may have rights to access, correct, delete, restrict, object to processing, withdraw consent, and receive a portable copy of your data. Send requests to support@askmurray.co or use the export and deletion options inside Murray.

Complaints

If you are unhappy with how we handle your data, contact us first. You may also complain to the UK Information Commissioner's Office.