What we collect, and why.

01 · Who we are

Bim is built and operated by Makata Studio SAS, a digital design studio based in Medellín, Colombia. This extension is a tool for design and development review sessions.

Questions about this policy: devs@makata.tv

02 · What we collect

Account information. When you sign in with Google, we receive your name, email address, and profile photo. This is used to identify you within your team’s workspace.

Comments. The text you write, the URL of the page where you write it, and a reference to the specific element you anchored the comment to. That reference includes a short snippet of the element’s HTML, its CSS classes and identifiers, and the tags of its parent elements — this is what lets a comment find its element again after the page changes.

Screenshots. When you pin a comment, we capture two images: the element you pinned and the visible area of the page around it. These are stored on public URLs — anyone who has the link can open the image without signing in. Please do not pin comments on pages showing information you would not share, such as another person’s private data.

Slack connection. If you connect a Slack workspace, we store the OAuth access tokens and bot credentials needed to post comments to that workspace.

Local preferences. Per-site on/off settings and authentication tokens are stored locally in chrome.storage on your device. We do not see this data.

We do not track which pages you visit, and we do not read or store page content except at the moments described above: the element snippet and the screenshots taken when you pin a comment. We do not record clicks, keystrokes, or any behavioral data outside of the extension panel itself.

03 · Connecting an AI agent

You can connect an AI assistant — Claude, or any tool that speaks the Model Context Protocol — so it can read and reply to feedback on your behalf. This is optional and off until you connect one.

What the agent can reach. Exactly what you can: the workspaces you already belong to, and nothing else. It can read threads and post replies, resolve them, and add reactions. It cannot create new pinned comments, change permissions, or see another workspace.

Attribution. Anything an agent writes is marked as coming from an agent and carries your name, so your teammates can tell it apart from something you typed.

What we store. When you connect through your browser, we store a record of the connection and a refresh credential, kept as a hash rather than in readable form. If you instead create an access token by hand, we store only a hash of it — the token itself is shown to you once and never kept. Both can be revoked from Settings.

Usage records. For each action an agent takes we record which action it was, how long it took, whether it succeeded, and an abbreviated identifier for the connection. We do not record the content of the request or the response. This is used to keep the service working, not to build a profile of you.

Your conversation with the assistant stays with whoever provides it. It does not pass through us, and we never receive it.

04 · How we use it

• Showing your comments to other members of the same workspace
• Keeping you authenticated across sessions
• Routing comments to Slack if you configure a channel for the project
• Associating comments with the correct page and element so they can be re-anchored on future visits

We do not use your data for advertising or profiling, and we do not sell it. The only measurement we keep is the agent usage record described in Section 03 — which action ran and whether it worked — used to keep the service running.

05 · Who we share it with

Supabase. Our database and authentication provider. Comment data, user accounts, and workspace configurations are stored on their infrastructure. Supabase is SOC 2 Type II certified. Data is stored in the US East region by default.

Slack. If you connect a Slack workspace, comment text is sent to Slack’s API to be posted in the channel you configure. This transfer is initiated by you when you set up the Slack integration.

Google. Authentication is handled via Google’s OAuth 2.0 flow using the chrome.identity API. We receive the profile data described in Section 02 and store it in our database.

The AI assistant you connect. If you connect an agent, the feedback it reads is sent to whoever provides that assistant — Anthropic, for Claude — because that is where the assistant runs. We do not choose that provider for you and we have no relationship with them on your behalf; their handling of that data is covered by their own terms. Nothing is sent until you connect one, and disconnecting stops it.

We do not sell data. We do not transfer data to any other third party.

06 · How long we keep it

Comments stay in our database until you delete them from the panel or request account deletion. Your account and all associated data are deleted within 7 days of a verified deletion request to devs@makata.tv.

Agent connections last until you revoke them or thirty days pass without use. Revoking one takes effect immediately for new requests; a credential already issued stops working within ten minutes.

Local data stored in chrome.storage is cleared automatically when you uninstall the extension.

07 · Your rights

You can delete any comment you wrote at any time from the extension panel. Deleting a comment deletes its screenshots with it. You can disconnect the Slack integration, and revoke any connected agent, from Settings. You can request full account deletion by emailing devs@makata.tv.

If you are in the European Economic Area, you have rights under the GDPR including access, rectification, erasure, portability, and objection. Contact us at the address above to exercise any of these.

08 · Changes to this policy

If we make a material change to what we collect, who we share with, or how long we keep it, we’ll update the date at the top of this page and notify active users by email. Minor clarifications won’t trigger a notification.