MeDo

GDPR overview

There is no mention of the GDPR anywhere on the site. A search across every page collected, privacy policy and terms included, returns no occurrence of GDPR or General Data Protection Regulation. No Article 27 representative is designated, no data protection officer is named, and no data processing agreement is offered. The jurisdictions actually addressed are India, with a Grievance Officer under the Information Technology Act 2000, and the United States, with California-style rights to know, to access and portability over the preceding twelve months, to deletion and to correction. Generic rights are announced without naming a legal basis: access, rectification, objection, complaint to a competent authority, withdrawal of consent and erasure, all exercised by email. The terms are governed by Singapore law. European users should treat the absence of any GDPR commitment as a material gap.

Who owns the data?

Under the terms, SAILAI PRIVATE LIMITED and its licensors retain all rights to the platform, its technology, AI models, code and interfaces, and explicitly to all data generated through use of the platform, including usage data and analytical insights, subject to applicable privacy laws. Users may upload code, images, videos and other assets, warrant they hold the necessary rights, and remain solely responsible for that content. The terms never state that users own the applications they generate, which is a notable silence for a builder. Source code can nonetheless be downloaded for 300 credits. Where an end user submits personal data to a published bot, MeDo processes it on the creator's behalf.

Reuse rights

The licence granted to the user is limited, personal, non-exclusive and non-transferable, but it expressly covers commercial as well as personal use, so what you build can be exploited without asking further permission, subject to your plan and to the terms. It terminates immediately if the terms are breached or the account is closed. Downloading the source code for 300 credits gives you the generated code to run elsewhere. The restrictions bite on the platform rather than on your output: you may not extract model weights or training data, scrape the service for model extraction, or use outputs, prompts or system interactions to develop competing AI models. Business users separately grant MeDo a royalty-free, worldwide licence to display their name and logo as a customer reference, revocable in writing at any time.

Data retention & training

Hosting summary

MeDo states plainly that the information it collects is stored on secure servers located in the United States, and that personal data may sit on a server outside the user's country of residence. Transfers out of that country are said to follow applicable data protection law, but no mechanism is named: no standard contractual clauses, no adequacy decision. No choice of region is offered, and neither a data centre nor a cloud provider is identified in the policy. The declared safeguards stay generic, covering technical, administrative and physical measures, industry-standard access controls, regular security audits and periodic review. No certification is published, neither SOC 2 nor ISO 27001. Application backends themselves run on Supabase for database and object storage. As a network observation rather than a company statement, the domain resolves to an Amazon Web Services address in Boardman, Oregon. Organisations carrying European data residency obligations will find nothing here that satisfies them.