AI Privacy policy

Material-UI SAS a Simplified Joint Stock Company (hereinafter "MUI"), publisher of the open-source React component library and Material UI services, places particular importance on the protection of personal data of Users of its artificial intelligence features.

This privacy policy dedicated to artificial intelligence features (hereinafter the "AI Privacy Policy" or "AI Privacy Policy") is intended to inform Users of the manner in which MUI collects, processes, and protects personal data (hereinafter "Personal Data") when they interact with the artificial intelligence features integrated into MUI services and libraries, in particular:

MUI X AI Assistant, an artificial intelligence assistance feature integrated into the MUI X library (Data Grid component in particular);
MUI Recipes (formerly MUI Chat), a conversational assistance feature for users;
Any other artificial intelligence feature deployed by MUI and expressly designated as such in the applicable terms of use.

This AI Privacy Policy supplements and does not replace MUI's General Privacy Policy (accessible at https://mui.com/legal/privacy/ ), which continues to govern all processing carried out by MUI in connection with access to the website www.mui.com the client account, the online store (including MUI X licenses, third-party templates, and MUI X design kits), telemetry, and any other activity not involving an artificial intelligence feature.

In the event of any conflict between the two documents regarding processing related to AI features, this AI Privacy Policy shall prevail.

Depending on the configurations and conditions of use of the AI features, MUI acts either as a data controller or as a data processor acting on behalf of its Client-Organizations that deploy these features within their own applications. Article 3 of this AI Privacy Policy sets out the respective roles and associated responsibilities.

By using the AI features offered by MUI, the User acknowledges having read this AI Privacy Policy and the General Privacy Policy.

In case of disagreement, the User must immediately cease using the relevant AI features.

Article 1. Scope

1.1 Artificial Intelligence Features Covered

This AI Privacy Policy applies exclusively to the processing of Personal Data carried out in the context of the following features:

MUI X AI Assistant: an assistant integrated into the MUI X Premium Data Grid that enables the User to interact, in natural language, with features of the Data Grid component (filters, sorts, groupings, formatting) or any other compatible MUI X Data Grid feature. This MUI X AI Assistant may rely on a third-party language model provided by MUI ("MUI Managed LLM") or on a third-party API key provided by the Client ("Bring Your Own Key" or "BYOK");
MUI Recipes (formerly MUI Chat): a conversational assistance feature offered by MUI to Users, enabling interaction with an assistant based on a third-party language model.

The following are excluded from this AI Privacy Policy and governed by the General Privacy Policy: browsing the website www.mui.com , the creation and management of the client account, access to the online store, telemetry of the MUI X library in development mode, customer support, and any commercial prospecting.

1.2 Data Subjects

The term "Users" within the meaning of this AI Privacy Policy:

developers and end users interacting directly with an MUI AI Feature;
MUI Client-Organizations that integrate MUI AI features within their own applications for their end users.

The applicable obligations vary depending on the capacity (controller or processor) in which MUI processes the Personal Data concerned (see Article 3).

Article 2. Definitions

For the purposes of this AI Privacy Policy, the following terms have the meanings set out below:

"AI Feature" means any artificial intelligence system within the meaning of Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonized rules on artificial intelligence ("AI Act"), integrated into MUI services;
"Applicable Regulations" means the body of law comprising the GDPR, the French Data Protection Act (law n° 78-17 of January 6th, 1978 as amended), Directive 2002/58/EC "ePrivacy" and its national transposing legislation, as well as the AI Act;
"BYOK" (Bring Your Own Key) means the operating mode in which the Client integrates its own access key (API key) for the third-party language model of its choice within the MUI AI Features;
"Client-Organization" means any legal entity, professional or organization (whether a company, public body, non-profit or other structure) that integrates or embeds the MUI AI Features within its own applications, products or services, in order to make them available to its own end users or employees. Client-Organizations act as data controllers with respect to the Personal Data they choose to have processed through the MUI AI Features, and MUI acts as their processor for such Personal Data;
"ConversationId" means a technical identifier assigned by MUI to a session of successive exchanges with an AI Feature, enabling continuity of conversation;
"Context" means the set of information transmitted to the third-party language model in support of the Prompt to enable its interpretation (in particular, within MUI X AI Assistant, column headers, the data schema, and where applicable a data sample when the allowAiAssistantDataSampling feature is enabled);
"MUI Managed LLM" means the default operating mode in which MUI makes a third-party language model available to its Client-Organizations via its own credentials, MUI bearing the associated connection and billing costs;
"Private Mode" ("private mode") means a technical option made available to the Client to prevent MUI from storing Prompts and Context;
"Prompt" (or "query") means text transmitted by the User to the third-party language model, containing the instruction or question to be processed;
"Third-Party Language Model" means a foundation model (large language model) published by a third-party provider, used by MUI AI Features to generate a response to a query.

Article 3. Qualification of Processing Activities and Roles of the Parties

3.1 MUI - Controller

MUI acts as data controller, within the meaning of Article 4(7) of the GDPR, for the following processing activities:

the provision of its services in direct relation with its Client-Organizations and their named users (account management, assignment and revocation of API keys, logging of calls to AI Features for quota and billing purposes);
the default storage of Prompts and Context for the purposes of error analysis, anomaly detection, abuse prevention, and service improvement, where the Private Mode has not been activated;
security, fraud prevention, and compliance with its legal obligations.

3.2 MUI - Processor on Behalf of its Clients

Where a Client integrates MUI AI Features into its own application for its end users and determines alone the purposes and means of processing, MUI may act as data processor within the meaning of Article 4(8) of the GDPR.

In such case, MUI processes Personal Data solely on the Client's documented instructions and enters into, where applicable, a Data Processing Agreement (DPA) compliant with Article 28 of the GDPR.

3.3 Third-Party Language Models - Sub-processors

Where MUI acts as a data processor, third-party language model providers used by MUI in MUI Managed LLM mode act as sub-processors, depending on the technical routing applicable to the relevant request.

Where the Client activates BYOK mode and uses its own API key with a third-party provider, that provider acts as a direct processor of the Client.

In this case, MUI acts solely as a technical intermediary transmitting requests to the key provided by the Client.

The table in Article 8 details the recipients and the applicable transfer safeguards.

Article 4. Data Processed in the Context of AI Features

4.1 MUI X AI Assistant

When the User interacts with MUI X AI Assistant, MUI may process the following categories of Personal Data:

Prompt (query): the text of the query entered by the User in natural language; Context: the information transmitted to the third-party language model in support of the Prompt and necessary for its interpretation, in particular:
- (i) the column headers of the Data Grid (column metadata),
- (ii) the data schema,
- (iii) where applicable, sample data from the Data Grid when the feature technically designated as allowAiAssistantDataSampling is activated by the Client, it being specified that this sampling is random at cell level, that it does not involve any automatic exclusion or anonymisation of cells containing personal data, and that no column-by-column deactivation is available. Clients wishing to avoid this transmission must keep the option disabled and use the column examples provided by the developer (column.examples);
ConversationId: the technical identifier assigned to the exchange session. This identifier is an opaque random string, not derived from the User's email address or user identifier; taken in isolation, it does not directly identify a natural person, but it is pseudonymous in nature and may, when combined with other stored data (in particular the associated referenceId in request logs), allow indirect re-identification, and therefore constitutes personal data within the meaning of Article 4(1) of the GDPR;
API Key: a technical identifier used to authenticate the origin of a request. This key is not personal: it is associated with an account (an email address) that may be used interchangeably by members of the same Client, as MUI does not impose individual keys per user, meaning that request traceability operates at account or organization level, not at individual user level;
Technical Request Data: IP address, request timestamp, third-party model used, Client internal identifier, configuration parameters.

MUI expressly reminds that column headers, the data schema, and, where the allowAiAssistantDataSampling option is enabled, sample data may, depending on the nature of the data integrated by the Client into its its Data Grid, contain Personal Data. It is the Client's responsibility, in its capacity as data controller with respect to its own end users, to carry out prior anonymization, pseudonymization, or exclusion of such data.

4.2 MUI Recipes

MUI Recipes is a conversational assistance feature for MUI developers and users, accessible in particular from the subdomain www.chat.mui.com .

To respond to a query, it retrieves relevant elements from MUI's documentation and transmits them, along with the User's query, to a third-party language model which generates the response (so-called Retrieval-Augmented Generation, or RAG, architecture).

Accounts, conversations, and metadata are stored in MUI's databases (PostgreSQL and the Qdrant vector database).

The third-party language models used by MUI Recipes may be accessed either directly by MUI or through the OpenRouter aggregator, depending on the provider and the technical routing applicable to the relevant request, as further described in Article 5.

Categories of Personal Data Processed

In the context of using MUI Recipes, MUI may process the following categories of data:

Content of messages entered by the User (prompts): the full text transmitted by the User, including any code snippets, identifiers, email addresses, personal URLs, or any other Personal Data that the User chooses, on their own initiative, to include in their query;
Responses generated by the assistant: the textual content returned by the third-party language model and provided to the User, which may reproduce all or part of the aforementioned data;
Conversation history (conversationId, successive messages): all previous exchanges within the same session, essential for maintaining contextual continuity and enabling the model to understand follow-up questions;
Embeddings (semantic vectors): vector representations of the User's questions generated to query the documentary knowledge base (Qdrant). These embeddings reproduce, in mathematical form, the semantics of the original prompt and may constitute Personal Data within the meaning of Article 4(1) of the GDPR where the original prompt contained such data;
Technical session metadata: User IP address, timestamp of each exchange, technical session identifier, device identifier where applicable, browser user-agent, configuration parameters;
Account data (authenticated users): email address, MUI account identifier, and where applicable username and other profile data entered by the User;
Feedback data: when the User rates a response (thumbs up/down, report, comment), MUI retains this information associated with the relevant prompt and response;
Application logs: technical logs of request execution (duration, return code, any errors, model used, API version).

Note on Data Potentially Included in Prompts

MUI expressly reminds Users that, given the conversational nature of MUI Recipes, Users may paste into their queries code snippets, data structures, or concrete examples that may contain Personal Data (email addresses, identification numbers, names, configuration files containing secrets, etc.).

MUI invites Users not to include in their queries real data relating to identified or identifiable third parties, and to substitute fictitious data for real data when consulting the assistant on concrete use cases.

Sub-processors Involved in Processing

The processing carried out by MUI Recipes involves the following sub-processors:

the language model providers used for response generation, including Anthropic, OpenAI and Google, which may be accessed directly by MUI, and other providers accessed through the OpenRouter aggregator, as further described in Article 5;
Render, for hosting the backend, the relational database (PostgreSQL), and the vector database (Qdrant);
Netlify, for hosting and delivering the interface at www.chat.mui.com ;
Auth0 (Okta, Inc.), for User authentication;
Voyage AI (semantic vectors), Langfuse (model call tracing), PostHog (analytics), Sentry and New Relic (logging and monitoring), a Redis database (conversation history cache), S3-compatible storage of the Cloudflare R2 type, and Slack (internal notifications), for ancillary technical functions.

Retention periods, recipients, and applicable transfer safeguards are set out in Articles 7, 8, and 9.

4.3 Voice Recognition

When the User activates the voice recognition feature within MUI X AI Assistant, it relies on the SpeechRecognition interface provided by the User's browser (Web Speech API). Voice data is transcribed to text by this interface, and only the textual transcription is then transmitted to the third-party language model as a Prompt.

Voice Data is processed exclusively as a text input channel and is in no way used by MUI for identification or authentication of the User. Consequently, Voice Data processed within MUI X AI Assistant does not constitute biometric data within the meaning of Article 4(14) of the GDPR, and the enhanced protection regime applicable to special categories of data under Article 9 of the GDPR does not apply.

The User is also invited to refer to the privacy policy of their browser publisher, as certain browsers (in particular Chrome and Edge) may rely on remote cloud services for the SpeechRecognition feature.

Article 5. Third-Party Language Models Used

5.1 MUI Managed LLM Mode

In MUI Managed LLM mode, the AI Features rely on Third-Party Language Models published by a selection of providers. Some providers are called directly by MUI (in particular Anthropic, OpenAI, and Google), while others are accessed through the OpenRouter aggregator (in particular DeepSeek and other providers offering zero-data-retention endpoints), with MUI having activated zero data retention and disabled all training on data on its OpenRouter account.

In this context, Prompts and Context are transmitted to the selected provider using MUI's credentials.

The list of providers may evolve over time to reflect technical, performance and cost considerations. The current list of the specific models used within each provider is maintained by MUI on the Sub-processors list referred to in Article 5.3.

5.2 Bring Your Own Key (BYOK) Mode

In BYOK mode, the Client integrates its own access key with the third-party language model provider of its choice.

In this configuration:

MUI is not a party to the agreement concluded between the Client and the third-party language model provider;
the Client is responsible for entering into a direct Data Processing Agreement with its provider;
MUI acts as a technical intermediary transmitting requests to the Client's provided key, without intervention in the content of exchanges beyond mere technical routing;
The privacy policies, retention periods, opt-out mechanisms from training, and international transfer safeguards are those of the third-party provider selected by the Client.

5.3 Updated List of Sub-processors

MUI makes available to its Clients an updated list of sub-processors involved in the AI Features ("Subprocessors list"), accessible at https://mui.com/legal/subprocessors/ .

The Sub-processors list sets out, for each sub-processor, its identity, the service provided, the categories of Personal Data processed and a link to its applicable privacy policy.

Any material change to this list (in particular any addition or replacement of a sub-processor) is notified in advance to Client-Organizations, at least thirty (30) days before the change takes effect, in accordance with the conditions set out in the applicable Data Processing Addendum. During this period, Client-Organizations may raise reasoned objections in accordance with Article 28(2) of the GDPR.

Article 6. Purposes of Processing

Personal Data collected in the context of the AI Features is processed for the following purposes:

Providing, executing, and technically routing the AI Features, by transmitting Prompts and Context to the selected third-party language model;
Managing the Client account, assigning and revoking API keys, counting requests for quota and billing purposes;
Analyzing errors, detecting anomalies, identifying abuse and uses contrary to the terms of service, and improving the service;
Ensuring the security of information systems, preventing and detecting fraud attempts and attacks (denial of service, prompt injection, exfiltration), and guaranteeing service availability;
Enabling the exercise of rights by data subjects;
Complying with applicable legal and regulatory obligations, responding to requests from competent administrative or judicial authorities;
Establishing, exercising, or defending MUI's rights in the event of legal proceedings.

MUI undertakes not to use Prompts, Context, or other data collected in the context of the AI Features to train, fine-tune, or adjust any artificial intelligence model, whether models published by MUI or third-party language models.

Where providers are accessed through an aggregator, MUI has activated the zero-data-retention setting on its aggregator account, ensuring that Prompts and Context are neither used for training nor retained beyond the time strictly necessary to route the request.

By way of exception, Prompts and Context may be analyzed for the exclusive purposes of security, abuse prevention, and compliance with legal or regulatory obligations, where a legitimate report, a suspicion of malicious use, or a request from a competent authority so justifies. These analyses, conducted in strict compliance with the principle of proportionality, do not result in any model retraining.

Article 7. Legal Bases for Processing and Retention Periods

The processing activities carried out in the context of the AI Features are based on the following legal bases, pursuant to Article 6 of the GDPR:

In accordance with the methodology of the French Data Protection Authority (CNIL), the retention periods set out below distinguish three phases in the lifecycle of Personal Data:

the active database, corresponding to the period during which data remains directly accessible to operational services for service provision;
intermediate archiving, corresponding to restricted-access compartmentalised storage, for evidentiary, litigation, or legal obligation purposes;
the deletion, meaning the permanent erasure of Personal Data from MUI's systems and, where applicable, those of its sub-processors, in accordance with Article 28(3)(g) of the GDPR.

MUI reasons by purpose and lifecycle phase, rather than by raw data category, in accordance with the CNIL recommendation on "AI and GDPR" published in 2024-2025. The indicated periods may be adjusted in light of developments in the supervisory authority's recommendations.

Data Category / Purpose	Legal Basis (Art. 6 GDPR)	Active Database	Intermediate Archiving and Deletion
Technical routing of Prompts and Context to the third-party language model	Performance of a contract (Art. 6.1.b GDPR)	Strictly the time necessary to process the request and transmit the response	No retention beyond this
Storage of Prompts, Context, and responses for error analysis and service improvement purposes (where Private Mode is not activated)	Legitimate interest (Art. 6.1.f GDPR)	Maximum thirty (30) days in operational access	Maximum twelve (12) months in intermediate archiving, for security and abuse-prevention purposes, under access restricted to MUI’s security team alone, then automatic deletion
Prompts and Context when Private Mode is activated by the Client	Performance of a contract (Art. 6.1.b GDPR)	No retention beyond the time strictly necessary for routing to the third-party language model	Not applicable
conversationId	Legitimate interest (Art. 6.1.f GDPR) - conversational continuity	Aligned with the retention period of the conversation to which the identifier relates (see the two "MUI Recipes conversations" rows below)	Deleted at the same time as the associated conversation. Where the identifier also appears in technical logs, together with the associated referenceId, it is retained for the duration of those logs and for no longer.
API Key and API access logging	Legitimate interest (Art. 6.1.f GDPR) - security and traceability	Duration of the key's validity (regular review, immediate revocation upon request)	API access logs: six (6) to twelve (12) months, extension of up to three (3) years possible if MUI documents a need for enhanced internal control
Session identifiers and application access logs	Legitimate interest (Art. 6.1.f GDPR) - information systems security	Duration of the session	Six (6) months to one (1) year maximum
Technical data for request counting (quotas, billing)	Performance of a contract (Art. 6.1.b GDPR); legal obligation (Art. 6.1.c GDPR)	Duration of the contract between MUI and the Client	Technical counting data: aggregated into non-identifying counters, or deleted, at the end of the contract. Invoices and supporting accounting documents: ten (10) years (Article L. 123-22 of the French Commercial Code)
Voice data related to the voice recognition feature	Consent (Art. 6(1)(a) GDPR) - explicit activation by the User	Local processing by the User’s browser (Web Speech API); no retention by MUI, any referral to a remote cloud service depending on the User’s browser	Not applicable (deletion as soon as the textual transcription is obtained)
MUI Recipes conversations - one-off sessions (unauthenticated user)	Legitimate interest (Art. 6.1.f GDPR)	Duration of the session	Deletion at the end of the session and, in any event, within forty-eight (48) hours, this short additional period being necessary for technical debugging
MUI Recipes conversations - follow-up sessions (authenticated user)	Performance of a contract (Art. 6.1.b GDPR); legitimate interest (Art. 6.1.f GDPR) for history	Duration of the active MUI account	Deletion upon the User's request or at the latest two (2) years after the last interaction
User feedback data (ratings, reports)	Legitimate interest (Art. 6.1.f GDPR) - service improvement	Thirty (30) days for operational processing	Deletion or anonymisation beyond this
Data processed for compliance with a legal obligation or the defence of MUI's rights	Legal obligation (Art. 6.1.c GDPR); legitimate interest (Art. 6.1.f GDPR)	Duration of the litigation or investigation	Five (5) years from the day on which MUI knew or ought to have known the facts enabling it to exercise its right (Article 2224 of the French Civil Code), or from the expiry of the legal obligation concerned, whichever is applicable

Article 8. Recipients of Personal Data

Personal Data collected in the context of the AI Features may be communicated, to the extent strictly necessary to fulfil the purposes pursued:

To third-party language model providers: Anthropic (in MUI Managed LLM mode) or any third-party provider selected by the Client (in BYOK mode);
To infrastructure and hosting providers: Amazon Web Services (AWS), Google Cloud Platform, Render, Netlify, in the regions detailed in Article 9;
To the authentication provider: Auth0 (Okta, Inc.);
To MUI's authorised internal teams: engineers, security teams, technical support, on the basis of individual authorisation and the least-privilege principle;
To competent administrative and judicial authorities: upon legal request or for the defence of MUI's and its Clients' rights.

Summary table of the main recipients:

Recipient / Sub-processor	Purpose	Privacy Policy
Anthropic (United States)	Provision of the Claude language model (MUI Managed LLM mode)	https://www.anthropic.com/legal/privacy
Amazon Web Services EMEA SARL / AWS Inc.	Infrastructure hosting (regions us-east-1, eu-central-1, eu-north-1)	https://aws.amazon.com/privacy/
Google Cloud	Supplementary infrastructure hosting	https://cloud.google.com/terms/cloud-privacy-notice
Auth0 / Okta, Inc.	User authentication	https://www.okta.com/privacy-policy/
Netlify, Inc.	Hosting and delivery of frontend interfaces	https://www.netlify.com/privacy/
Render Services, Inc.	Hosting of backend services, the PostgreSQL database (muibackend, muichat, muix), the Qdrant vector database, and the Redis cache (region us-east-1, Virginia, United States)	https://www.render.com/privacy
OpenAI	Provision of language models for the AI Features	https://openai.com/fr-FR/policies/row-privacy-policy/
Google - Gemini	Provision of language models (Gemini), for the AI Features	https://support.google.com/gemini/answer/13594961?hl=fr
OpenRouter	Aggregator providing technical routing of requests to language models	https://openrouter.ai/privacy
Voyage AI	Generation of semantic vectors (embeddings) for MUI Recipes	https://www.voyageai.com/privacy
Langfuse, PostHog, Sentry, New Relic, Cloudflare R2, Slack	Model call tracing, product analytics, logging and monitoring, technical artefact storage, and internal notifications	Langfuse: https://langfuse.com/privacy/privacy PostHog: https://posthog.com/privacy Sentry: https://sentry.io/privacy/ New relic: https://newrelic.com/termsandconditions/privacy Cloudflare: https://www.cloudflare.com/fr-fr/privacypolicy/ Slack: https://slack.com/intl/fr-fr/trust/privacy/privacy-policy

MUI implements all reasonable measures to ensure that these recipients process Personal Data securely, in particular through data processing agreements compliant with Article 28 of the GDPR and standard contractual clauses adopted by the European Commission, where transfers are carried out outside of the European Economic Area.

Article 9. Transfers Outside of the European Union

In the context of the operation of the AI Features, certain Personal Data is transferred to providers established outside of the European Economic Area. MUI frames these transfers by distinguishing recipients covered by an adequacy decision from those for whom appropriate safeguards are in place under Article 46 of the GDPR, and processing operations that remain within the European Economic Area.

The current identity of each sub-processor concerned by these transfers, together with the applicable transfer mechanism, is set out in the Sub-processors list referred to in Article 5.3.

9.1 Transfers covered by an adequacy decision

Where the sub-processor is certified under the EU-US Data Privacy Framework adopted by the European Commission on 10 July 2023, transfers to the United States are based on this adequacy decision, subject to maintenance of the sub-processor's certification.

It is specified that certain sub-processors established in the United States rely on backups or redundancy hosted within the European Union; the presence of such backups does not exempt the main processing activity from qualifying as a transfer to the United States, which remains covered by the framework set out in this Article 9.1.

9.2 Transfers governed by standard contractual clauses

Where the sub-processor is not certified under the Data Privacy Framework, or is established in a third country not covered by an adequacy decision, transfers are governed by standard contractual clauses adopted by the European Commission pursuant to Article 46 of the GDPR, supplemented where necessary by additional measures and by a Transfer Impact Assessment where required.

A copy of the standard contractual clauses entered into with the sub-processors concerned may be obtained, subject to redaction of confidential commercial terms, by written request to MUI at the contact details set out in Article 15.

9.3 Processing remaining within the European Economic Area

Certain sub-processors are established in the European Union or offer intra-European hosting, meaning that no transfer outside of the EEA takes place when this configuration is selected. MUI favours, where possible, European processing and hosting options, in particular the routing of requests within the European Union offered by aggregators where technically available.

Article 10. Security and Technical and Organizational Measures

MUI implements appropriate technical and organizational measures within the meaning of Article 32 of the GDPR to ensure a level of security appropriate to the risk, including:

Encryption in transit (TLS 1.2 or higher) of all exchanges between Users, MUI AI Features, and third-party language models;
Encryption at rest delegated to infrastructure providers (AWS, Google Cloud), under standard disk encryption conditions (KMS), it being noted that the coverage of encryption at rest depends on each provider and is not uniformly guaranteed across the entire chain;
Access authentication via Auth0 and authorization controls based on the least-privilege principle (RBAC);
Multi-factor authentication (MFA) required for access to most internal infrastructure by MUI teams, depending on the platform;
Logging of access to and operations on Personal Data;
Access reviews on a need-to-know basis and upon employee departures;
Application security controls integrated into the CI/CD pipeline (SAST at each commit, dependency audits, secret scans);
Procedure for notifying Personal Data breaches to the competent supervisory authorities within 72 hours, in accordance with Article 33 of the GDPR, and notifying affected Clients without undue delay.

In Private Mode ("private mode"), MUI makes available to its Clients a private mode that prevents MUI from storing Prompts and Context.

This mode is activated at the Client's discretion and its activation is documented in the technical documentation.

When activated, MUI undertakes not to retain, beyond the time strictly necessary for routing the request, the Prompts and Context transmitted to third-party language models. This commitment covers content recorded in databases and in model call tracing tools for models.

Without prejudice to the foregoing commitments, MUI reminds Users that no information system can guarantee absolute security. MUI cannot be held liable for the security of data transmitted via networks outside its control, in particular the public Internet.

Article 11. Compliance with the AI Act

11.1 Risk Classification

In accordance with Articles 6 et seq. of Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence ("AI Act"), MUI carries out an assessment of its AI Features according to the risk categories defined by that Regulation.

As currently designed, MUI's AI features (MUI X AI Assistant, MUI Recipes) do not appear to fall within the categories of prohibited practices (Article 5) or high-risk systems listed in Annex III of the AI Act. They fall instead, as currently designed, into the category of AI systems presenting limited risk, which are subject to the transparency obligations provided for in Article 50 of the AI Act.

11.2 Transparency Obligation (Article 50 of the AI Act)

In accordance with Article 50 of the AI Act, MUI ensures that Users of the AI Features are informed that they are interacting with an artificial intelligence system, in a clear and identifiable manner. This information is provided in particular:

within the interfaces of the AI Features (labels "AI Assistant", "AI Recipes", etc.);
in the technical documentation made available to Client-developers;
in this AI Privacy Policy.

Where content (text, image, audio, video) is generated or substantially modified by an AI system, MUI identifies such content as such, under the conditions provided for in Article 50, paragraph 2 of the AI Act and its implementing texts.

Where an AI Feature directly interacts with a natural person, MUI ensures that the person is informed that they are interacting with an AI system, unless this is obvious from the circumstances and context of use, in accordance with Article 50(1) of the AI Act.

MUI Recipes is expressly identified as an AI-powered feature within its interface. Where MUI Recipes generates synthetic text content falling within the scope of Article 50(2) of the AI Act, MUI applies the transparency measures required by that provision, taking into account the exclusions and conditions specified in the European Commission Guidelines on Article 50. In particular, source code generated by an AI system falls outside the marking obligation under Article 50(2).

MUI X AI Assistant is designed primarily to execute User instructions affecting the presentation and configuration of the Data Grid component, including filtering, sorting, grouping and conditional formatting. To the extent that these functions do not generate synthetic content within the meaning of Article 50(2), the marking obligation under that provision does not apply. Users are nevertheless informed of the AI nature of the functionality through the “AI Assistant” identification displayed in the interface.

MUI X AI Assistant does not make decisions producing legal effects concerning data subjects or affecting them significantly in a similar manner, within the meaning of Article 22 of the GDPR.

The assistant merely modifies the display of the Data Grid upon the User's instruction.

No decision relating to data subjects is taken or influenced, exclusively, by the AI Features.

This assessment applies to the native feature as made available by MUI. Where they integrate MUI X AI Assistant into their own applications, Client-organizations also qualify as « deployers » within the meaning of Article 3(4) of the AI Act.

Client-organizations who define customised behaviour using the onPrompt callback must ensure that the uses they implement do not result in automated decision-making within the meaning of Article 22 of the GDPR.

11.4 Private Mode and Opt-Out from Data Sampling

In addition to the Private Mode described in Article 10, MUI allows the Client to deactivate the allowAiAssistantDataSampling feature, which restricts the transmission of sample data from the Data Grid to the third-party language model.

When this feature is disabled, only column headers and the data schema are transmitted to the model.

This deactivation is at the Client's discretion and there is no column-by-column exclusion; the use of column examples provided by the developer (column.examples) constitutes the alternative to sampling.

As deployers within the meaning of the AI Act, Client-organizations have at their disposal the following controls in particular:

Enabling or disabling the feature (aiAssistant),
The allowAiAssistantDataSampling option,
The onPrompt callback,
The additionalContext parameter,
The metadata.referenceId identifier,
Private Mode (privateMode),
BYOK mode,
Column examples,
Key and host restrictions and usage records.

Article 12. Rights of Data Subjects

In accordance with Articles 15 to 22 of the GDPR, data subjects have, subject to the conditions and limitations provided by the Applicable Regulations, the following rights:

Right of access: to obtain confirmation that Personal Data concerning them is being processed and to access it;
Right to rectification: to obtain the rectification of inaccurate or incomplete Personal Data;
Right to erasure: to obtain the erasure of Personal Data in the cases provided for in Article 17 of the GDPR;
Right to restriction of processing: in the cases provided for in Article 18 of the GDPR;
Right to object: to object, on grounds relating to their particular situation, to processing based on MUI's legitimate interests;
Right to data portability: to receive Personal Data in a structured, commonly used, and machine-readable format, where the processing is based on consent or the performance of a contract;
Right to withdraw consent: at any time, where the processing is based on consent, without such withdrawal affecting the lawfulness of processing carried out prior to withdrawal;
Right to define post-mortem instructions: instructions regarding the fate of Personal Data after the data subject's death, in accordance with Article 85 of the French Data Protection Act;
Right to lodge a complaint: with the competent supervisory authority (see Article 15).

With regard to processing activities in which MUI acts as a data processor on behalf of a Client, requests to exercise rights must be addressed, in the first instance, to the Client in its capacity as data controller. MUI will assist its Client in handling these requests, in accordance with the commitments set out in the applicable Data Processing Agreement.

Requests to exercise rights may be addressed to MUI at the contact address specified in Article 15. MUI has a period of one (1) month from receipt of the request to respond, which may be extended by two (2) months in the event of complexity or a high number of requests, in accordance with Article 12 of the GDPR. MUI may, where applicable, request proof of the requester's identity before acting on their request.

Article 13. Privacy of Minors

MUI AI Features are not intended for persons who have not reached the age of legal majority in their country of residence. MUI does not knowingly collect Personal Data concerning minors within the meaning of Article 8 of the GDPR.

Should MUI become aware that Personal Data concerning a minor has been collected without the required parental consent, MUI undertakes to take all appropriate measures to delete such data as soon as possible.

Parents or legal representatives who believe that a minor has communicated Personal Data to MUI in the context of the AI Features may contact MUI at the address specified in Article 15 to request the deletion of such data.

Article 14. Amendments to the AI Privacy Policy

This AI Privacy Policy may be modified at any time to reflect legal, regulatory, case-law, technical, or operational developments affecting the processing related to AI Features, in particular the progressive entry into force of the provisions of the AI Act.

MUI will update the "effective date" appearing in the header of this AI Privacy Policy and will publish the updated version at https://mui.com/legal/ .

Where the changes made are material and likely to have a significant impact on the rights or obligations of Users, MUI will implement reasonable means to inform Users, by displaying a message on the website, by notification in the interfaces of the AI Features or, where applicable, by sending an email to the affected Clients.

Article 15. Contact and Complaints

15.1 Contacting MUI

Any question, request, or complaint relating to the processing of Personal Data in the context of the AI Features may be addressed to MUI:

By email: support@mui.com ;
By post: 128 rue de la Boétie, 75008 PARIS, France.

15.2 Complaint to a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, any data subject has the right to lodge a complaint with the competent supervisory authority:

in their place of habitual residence;
at their place of work;
at the place of the alleged infringement.

Within the European Union, it is possible in particular to contact:

For France: the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 (www.cnil.fr);
For other Member States: the competent supervisory authority of the Member State concerned.

For Users established outside the European Economic Area, equivalent remedies may be available under locally applicable legislation.

MUI favours, where possible, prior dialogue with the data subject to enable the amicable resolution of any difficulty relating to the processing of Personal Data.

Last update: October 28th, 2026.