Molar Labs — legal

Effective date: October 15, 2026 · Last updated: October 26, 2026

This policy explains how Molar Labs (“Molar”, “we”, “us”) collects and uses personal information when you visit molar.it or docs.molar.it, use app.molar.it, the Molar CLI or the Molar MCP server, or contact us.

Early access. Molar is a free beta built and operated by Pratik Rana in Bengaluru, India, under the name Molar Labs, which is not yet an incorporated company. This policy describes what the product does today in plain language. It has not yet been reviewed by legal counsel; we will update it after that review. We do not sell personal information. Questions: pratik@molar.it.

Who this applies to

This policy covers website visitors, account holders and their team members, and people who contact us.

When you use Molar to test your own application, Molar also handles customer content on your instructions: the pages Molar visits and what it records there. For customer content, you are the controller and Molar is your processor. Our Data Processing Addendum covers that relationship.

Information we collect

Account data. Your email address, name, organization name and role. If you sign in with Google or GitHub, we receive your account identifier, email address and name from that provider. If you turn on multi-factor authentication, we store the settings needed to check your codes.

Projects and runs. The URLs you ask Molar to test, the goals and instructions you write, the hosts you allow, and any test inputs you supply. Saved logins for your test accounts are encrypted before they are stored.

Run artifacts. For each browser run Molar records screenshots, a video of the browser, a network capture (HAR) and a Playwright trace, plus the steps the agent took and its result. These show whatever the tested pages displayed and sent, which can include personal information if your application shows it. Exported Playwright tests are also stored.

Integrations. If you install the Molar GitHub App, we receive the repository metadata, pull request details and webhook events needed for checks and for opening pull requests with exported tests.

Test inboxes. Some runs use test email inboxes that Molar provides. We receive the messages your application sends to those inboxes, such as verification codes and links.

Product usage. How you use app.molar.it, and service events such as sign-ups, finished runs and finished exports. See “Product analytics” below.

Website and messages. Request data such as IP address and browser type, which our hosting providers process to deliver the site. Analytics only if you allow it. Questions you send to Ask Molar, waitlist details you submit, and emails you send us.

Please do not put sensitive categories of data (such as health data) in the product, and use test accounts rather than real customer accounts where you can.

How we use information

  • Run the browser tasks, checks and exports you request
  • Sign you in, secure accounts and administer organizations
  • Send sign-in links, service notices and support replies
  • Understand where people get stuck and improve the product
  • Prevent abuse, enforce our Terms of Service and meet legal obligations

We do not train AI models on your content.

Legal bases (EEA/UK). Where GDPR applies, we rely on contract (to provide the service), legitimate interests (security and product improvement), consent (website analytics) and legal obligation where it applies.

Who processes data for us

We use the providers below. The full list, with what each one receives and where, is on our subprocessors page.

  • Microsoft Azure hosts the product in the Central India region: the servers, the database, run artifacts, secrets and backups.
  • Microsoft Azure OpenAI Service provides the AI model. It receives the goals you write and the page content and screenshots of the sites Molar tests, to decide each browser step. Our deployment is in Azure’s South India region. As a global deployment, Microsoft may process these requests in other Azure regions.
  • Resend sends account email, such as sign-in links.
  • PostHog provides product analytics for app.molar.it (US cloud).
  • Inkbox provides the test inboxes some runs use.
  • GitHub and Google provide sign-in if you choose them. GitHub also runs the Molar GitHub App if you install it.
  • Cloudflare hosts molar.it and docs.molar.it and provides DNS.

We also share information with professional advisers under confidentiality, with authorities when the law requires it, and with a buyer in a merger or acquisition, with notice where required.

How long we keep data

  • Run artifacts (screenshots, videos, HAR files, Playwright traces) are deleted automatically 5 days after they are created.
  • Run records (goal, status and step summary) are deleted automatically 90 days after the run.
  • Exported Playwright tests stay in your account while it is active.
  • Account and project data stay while your account is active. When you ask us to delete your account, we delete it from the live service within 30 days.
  • Backups. We back up our databases every 6 hours. Backups are encrypted, stored outside the application server in Azure storage in the same region, and kept for 365 days. Deleted data can remain in backups until they expire.
  • Product analytics are kept for the retention period of our PostHog plan.
  • Ask Molar request counters expire after two days. Details submitted to the old waitlist, before signup opened, stay until you ask us to delete them.

Your rights

You can ask to access, export, correct or delete your personal information, or object to how we use it. Email pratik@molar.it from the address on your account. We will confirm the request and reply within 30 days. You may also complain to your local data protection authority.

California residents have similar rights under the CCPA/CPRA. We do not sell or share personal information for cross-context behavioral advertising.

If you are a user of a Molar customer’s application and your data appears in their test runs, please contact that customer first. We will help them respond.

Website analytics and your choices

molar.it uses Google Analytics 4 only after you choose to allow analytics. Until then, the site does not load the Google analytics tag. Analytics helps us understand page visits and aggregate actions, such as opening a demo or following a signup link. Advertising storage and signals stay off. We do not send form text, submitted questions, email addresses or URL query strings to analytics.

Your analytics choice is saved in your browser. Use “Privacy choices” in the footer to change it. Declining keeps analytics off. We respect Global Privacy Control. Fonts are hosted on this website. docs.molar.it does not use analytics. app.molar.it uses session and authentication cookies to keep you signed in.

Product analytics in app.molar.it

Inside the product we use PostHog (PostHog Inc., US cloud) to understand how the product is used and where people get stuck. PostHog records page views, clicks and feature use, front-end errors, survey answers and session recordings of the dashboard. Recordings mask all text and every input value and block images, video and screenshots, so passwords, tokens, typed values, run goals, step descriptions and run media are not captured. Query strings are removed from every URL PostHog receives. Before you sign in, PostHog records events without creating a profile. After you sign in, we link events to your account (user ID, email, name and organization).

Our servers also send PostHog a small set of events — sign-ups, finished runs and finished exports, with their result and the hostname of the site tested — including runs started from the CLI or an MCP client. Our servers do not send page content, screenshots, credentials or test inputs from your runs to PostHog.

To opt out of product analytics, or to have your analytics data deleted, email pratik@molar.it. See PostHog’s privacy policy.

Ask Molar and the old waitlist

When you use Ask Molar, your question and relevant public source material are processed by Cloudflare Workers AI to create an answer. Do not include credentials, private URLs or personal information. We do not store question-and-answer histories, publish visitor questions or send them to analytics. See Cloudflare’s AI data-usage policy.

To limit abuse, we temporarily store request counts and a daily salted hash of the network address. These records expire after two days. Details people submitted to the old waitlist, before signup opened, are stored in our website database on Cloudflare. Contact pratik@molar.it to request deletion.

How we protect data

Traffic is encrypted with TLS. Each organization’s data is separated in the database. Saved logins are encrypted at rest. Hosted browsers cannot reach private or internal network addresses. Our security page lists these controls and what we have not done yet. No system is completely secure, and we cannot guarantee absolute security.

International transfers

Molar Labs is based in India, and the product is hosted in India. Some providers process data in other countries, mainly the United States (PostHog, Resend, Inkbox, GitHub, Google). Our Azure OpenAI deployment is in India, but as a global deployment Microsoft may process model requests in other Azure regions. Cloudflare serves the websites from its global network. Where the law requires it, we rely on safeguards such as Standard Contractual Clauses.

Children’s privacy

The service is not directed to children under 16 (or the age required in your jurisdiction). We do not knowingly collect personal information from children.

Changes to this policy

When our practices change, we will post the new version here and update the dates at the top. We will tell account holders about material changes by email or in the product.

Questions

Molar Labs
Bengaluru, India
pratik@molar.it

← Back to Molar