Privacy policy
Last updated 2026-10-01.
Please read. This page describes how MUCO LABS actually operates today and is written in plain language. It has not been reviewed by a lawyer and is not a substitute for legal advice. If anything here matters to a decision you are making, ask us and we will confirm it in your agreement, which is the document that governs the engagement.
What this website itself collects
This site uses static pages and server endpoints, including the endpoint that receives an enquiry and records it in our private CRM. Initial enquiries need no account. Project enquiries and follow-up are managed in our private admin workspace.
When you send the public enquiry or website review form, the details are checked and sent to our private Supabase CRM and through Resend to our business inbox. The form confirms receipt when at least one channel succeeds. If neither confirms receipt, it offers a prefilled WhatsApp handoff and phone contact. No customer login account is created by the form.
We retain the first landing page, referring site and campaign tags in session storage during your visit and include them with your enquiry to understand its source. Referrer query strings and fragments are discarded. Your IP address is used for anti-abuse rate limiting.
Google Analytics and Tag Manager are loaded from Google, and Microsoft Clarity from Microsoft, only once you have allowed analytics. Our own stylesheets, scripts, typefaces and images are served from this domain. Contact pages also embed Google Maps, which loads separately as described below. The preview tool can separately use Google Gemini for business-content personalisation as described below.
Nothing on this site measures you until you say yes. We load Google Analytics and Google Tag Manager, and Tag Manager may in turn load Microsoft Clarity, which records how pages are used — pointer movement, clicks, scrolling and the content of the pages you view — and replays those sessions to us so we can see where a page is confusing. All of these start in a denied state under Google Consent Mode, which means they set no cookies and store nothing on your device. When you first visit, we ask. If you decline, or simply ignore the question, they stay denied for as long as you use the site. If your browser sends a Do Not Track signal or you have enabled Global Privacy Control, we treat that as a decline and never ask. The site works exactly the same either way, and the only thing we keep in your browser is your answer to that question, which we cannot read from our end. If you allow analytics, the data collected is limited to the pages viewed, the site that referred you, any campaign tags in the link, and which links or forms were used; we never send the contents of an enquiry to Google or Microsoft. Google Analytics processes this information under Google's privacy terms and Clarity under Microsoft's. Our private dashboard also stores consented page views and contact actions in Supabase. These events contain page paths, referring hosts and simple campaign tags, without enquiry contents, IP addresses or visitor identifiers. They do not identify unique visitors.
We use the following outside services. Vercel hosts this website and keeps standard technical request logs, such as your IP address and browser type, as part of serving the pages; we do not control those logs. Resend delivers your enquiry to us as an email — when you submit the enquiry or website review form, everything you typed passes through Resend to reach our inbox, and is processed under Resend's privacy terms. Supabase stores enquiry details and source attribution in our private CRM in Singapore for follow-up, and stores consented analytics events with authenticated staff access and row-level security. Google provides Analytics and Tag Manager, which run only with your consent as described above; Tag Manager may load Microsoft Clarity on the same basis. Microsoft processes Clarity session information when analytics is allowed. Google Maps embeds on our contact pages may load as they approach the visible part of the page, independently of your analytics choice. Google then receives technical request data, including your IP address and browser information. See Google's privacy policy. For website-preview personalisation, business details pass through our server to Google Gemini when configured. Contact fields and uploaded images are excluded from that request. Do not enter confidential information. We do not sell your information, rent it, or share it with advertisers, and we do not add you to a marketing list because you asked a question.
Website preview and AI personalisation
When you generate or regenerate concepts, the business name, category, town, description, services, products, language and design preferences are sent to our preview endpoint. If Gemini is configured, it processes those details to suggest copy and design guidance. If it is unavailable, fixed-rule content is used instead.
Phone numbers, email, street address, social links and uploaded photos or logos are excluded from that personalisation request. Drafts, images and concept selections are stored locally in your browser. Do not include confidential or sensitive information in business descriptions. Clearing browser storage removes local drafts; it does not delete request information already processed by a provider.
What we collect when you contact us
When you message us on WhatsApp, email us, call us or send an enquiry, we receive whatever you chose to include: typically your name, business name, phone number, email address, location, the service you are interested in, your budget range, your timeline and a description of your project.
We ask only for what we need to understand and quote your project. You are never required to give us financial details, identity documents or anything sensitive in order to make an enquiry.
How we use it
To reply to your enquiry, ask follow-up questions, prepare a scope and a quote, and deliver the project if you go ahead with it.
For an active project, to keep the records any working relationship needs: the agreed scope, milestones, invoices and correspondence.
Where it is stored
Your enquiry is stored in our private CRM hosted by Supabase in Singapore and as an email in our business inbox through Resend, when those deliveries succeed. CRM records include your submitted details, landing page, referring site and campaign tags. Your IP address is not included in the CRM record. Google Analytics data, if you allowed analytics, is processed by Google under its own privacy terms. We do not put enquiry contents into Google Analytics or Clarity, and access to our records is limited to the people working on your project.
WhatsApp messages and emails are stored in the respective services we use to communicate with you.
Where a project requires a third-party service such as a payment gateway or email provider, that is stated in your project agreement along with who the provider is.
How long we keep it
Enquiries that do not become projects are kept while there is a realistic chance of the conversation continuing, and removed on request at any time.
Private dashboard events are used for aggregate reports and can be removed on request. Google Analytics retention follows the settings of the Google Analytics property, and applies only if you allowed analytics.
Records relating to a project we delivered are kept for as long as we may need them for accounting, tax or contractual reasons.
Your choices
You can ask us what we hold about you, ask for it to be corrected, or ask us to delete it. Email founder@mucolabs.com and we will confirm what we have done. If deleting something would conflict with a legal or accounting obligation, we will tell you which part and why.
You can stop hearing from us at any time by saying so in any channel.
You can allow or decline analytics here. Declining reloads the page to stop loaded analytics scripts. Turning on Do Not Track or Global Privacy Control in your browser tells us not to ask at all, and we treat it as a decline.Children
This website and our services are aimed at businesses. We do not knowingly collect information from children.
Changes
If our practices change, this page changes with them and the date at the top is updated. Material changes affecting an active project will be told to you directly.
Questions about this page
Email founder@mucolabs.com — no account is needed to ask about this policy. You can also message us on WhatsApp or call +91 6381809844.