Privacy Policy

§ 1 Controller

The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws, and other data protection provisions is:

§ 2 Data Collected

We process the following personal data:

• Account data: Name, email address, password (hashed), and workspace name during registration. When signing in via Google or GitHub: the basic profile data (name, email address) released by that provider.
• Usage data: API requests (anonymized volume, timestamp, deployment ID), token consumption for billing.
• Technical data: IP address, browser type, operating system, referrer URL (anonymized after 24h).
• Payment data: Processed exclusively via our payment provider (Stripe). We do not store full card details.
• Uploaded documents: Knowledge base files are stored encrypted and processed only to create embeddings.

§ 3 Purpose of Processing

We process personal data for the following purposes:

• Provision and operation of the platform (deployments, API gateway, dashboard)
• Billing and invoicing (usage-based according to token consumption)
• Authentication and access control
• Security and abuse prevention
• Product improvement based on anonymized usage statistics
• Transactional and service-related emails (registration confirmation, invoices, critical system notifications, and occasional reminders about setting up or using your account)

§ 4 Legal Basis

Processing is carried out based on the following legal bases pursuant to Art. 6 GDPR:

• Art. 6(1)(b) GDPR Contract performance: operation of the platform and billing.
• Art. 6(1)(c) GDPR Legal obligation: retention of invoice data (§ 257 HGB, § 147 AO).
• Art. 6(1)(f) GDPR Legitimate interests: security, abuse prevention, anonymized usage analysis, account-usage reminder emails.
• Art. 6(1)(a) GDPR Consent: optional sign-in via Google or GitHub, marketing emails (where explicitly consented).

§ 5 Cookies and Tracking

We use only technically necessary cookies:

• Session cookie: Used for authentication in the dashboard. Deleted on logout.
• Theme cookie: Stores the color scheme preference (light/dark). 365-day lifetime.

We do not use tracking pixels, social media plugins, or advertising cookies. No sharing with third-party analytics services. These cookies fall under the exemption in § 25 (2) No. 2 TTDSG (technically necessary) and therefore do not require consent.

§ 6 Your Rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You can request a copy of all data stored about you.
• Right to rectification (Art. 16 GDPR): Incorrect data can be corrected at any time.
• Right to erasure (Art. 17 GDPR): Deletion of account and all personal data on request — within 30 days, subject to statutory retention obligations.
• Right to restriction (Art. 18 GDPR): Restrict processing instead of complete deletion.
• Right to object (Art. 21 GDPR): Objection to processing based on legitimate interests.
• Data portability (Art. 20 GDPR): Export your data in a machine-readable format (JSON).

To exercise your rights, contact: privacy@mycelis.ai

§ 7 Third Parties & Data Transfers

We use the following service providers, which process personal data on our behalf or under their own responsibility:

No data is shared with third parties for advertising purposes. Where data is transferred to third countries (in particular the USA), this is based on EU Standard Contractual Clauses pursuant to Art. 46 GDPR or an adequacy decision of the EU Commission.

§ 8 Data Security

All connections are TLS encrypted (TLS 1.3). Passwords are hashed and salted with bcrypt. API keys are stored only in hashed form. Knowledge base documents are encrypted at rest (AES-256).

§ 9 Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany — email: poststelle@lda.bayern.de.

For questions or concerns regarding data protection: privacy@mycelis.ai