Draft. To be reviewed by a lawyer before launch.
Privacy policy
Operator and data controller
- Legal name
- UNILINK AI PTE. LTD.
- Registered in
- Singapore
- Company registration no. (UEN)
- 202610380N
- Address
- Contact us as below
- Contact
- support@mdexa.com or GitHub issues
- Security reports
- security@mdexa.com
Mdexa is pronounced em-DEK-sə.
What we collect
- Email address.
- Profile choices: identity, organization type, main use, country or region; organization name if given; contact consent (off by default).
- Call records: time, route or tool, filters including search words, result count, status, key prefix. Addresses are kept only as a salted hash.
- One session cookie (mdx_session), 30 days. No advertising or analytics cookies.
- Traffic: every request, pages included, is counted in aggregate on the server. No cookie, script or third party is used for this. The address is kept only as a 16-character hash whose salt changes daily, so days cannot be linked.
- Return visits: for API and MCP callers, a stable salted hash (address plus client label, or key id) with the dates and number of calls. Used only to count return visits and to limit how often the install note is shown.
- Requests to add or verify a dataset: the submitted text. Visible only to the operator, never published.
- Saved lists for change queries: account data.
Why
- Running the service and its limits.
- Aggregate demand: which data people look for and do not find. Analysed only in aggregate.
- Contact about data needs, only with consent.
What we never do
- Sell or hand over information that identifies you.
- Read individual search histories. Search words are treated as confidential.
Retention
- Call history: kept per plan (see Plans), then deleted.
- Sign-in links expire in 15 minutes.
- Account data, including saved lists, until you delete the account.
- Aggregate traffic counts: 400 days.
- Return-visit hash: 35 days.
Your rights
- See and edit your profile in the console.
- Delete the account: sessions, keys, saved datasets, alerts, call history and counters go with it.
- Turn off the install note: send the header X-Mdexa-Hints: off, or the parameter hints=off. Calls with an API key never get it.
- Questions: [privacy contact].
Cross-border
- The service is operated by a Singapore company. Local rules that apply when serving users in mainland China, Europe and elsewhere will be added after legal review.
- [Where data is stored]