Privacy Policy

1. Who is responsible for your data

[Company legal name], [registered address] (“we”, “us”) is the data controller for the personal data described below. Contact our data protection point of contact at [privacy email]. If you are in the EU and believe we have not resolved your concern, you can complain to your local data protection authority (in Spain, the AEPD).

2. What we collect

• Account data: name, email address, hashed password (via Supabase Auth).
• Profile data: your stated goals, life areas, context and preferences, which you type in.
• Tool data: the tools you build and every entry you log in them — this can include sensitive categories such as health (e.g. sleep, weight) or financial (e.g. savings, spending) data, depending on what you choose to track.
• AI conversations: messages you send to Mitheus's chat, and short remembered facts (“AI memory”), when that feature is on.
• Videos and notes you record: the promise video you record when you join, your weekly videos and the notes you write in “For your future self”. They show your face and voice, so treat them as personal data. They are recorded only when you press record, uploaded to a private storage folder that only your account can read, and are never analysed by AI, used to identify you, shown to other users (including buddies and challenge members) or used for advertising. You can watch, edit the note of, or delete any of them at any time.
• Usage data: basic in-app events (e.g. a tool was built or opened) used to keep the product working and to understand what's used.
• Language preference, stored in a functional cookie and on your profile — no advertising or tracking cookies are set.

3. Why we process it, and the legal basis

• To provide the Service you asked for (contract performance) — account, tools, entries, chat.
• To keep the Service secure and prevent abuse (legitimate interest).
• To improve Mitheus based on aggregate, non-identifying usage patterns (legitimate interest).
• Where required, with your consent — for example if we ever add marketing communications (you would be asked separately, and can withdraw consent at any time).

4. Who else sees it

We do not sell your personal data. It is shared only with the processors needed to run the Service:

• Supabase (database, authentication, file storage) — hosts your account and tool data.
• Anthropic (AI model provider) — receives the text needed to build, edit or discuss a tool (your goal, your account snapshot, your chat question) in order to generate a response. It is not used by Anthropic to train their models under our agreement with them, and it is not retained by them longer than needed to serve the request.
• Hosting/infrastructure providers needed to run the website (e.g. our deployment platform).

Some of these processors are located outside the EEA (e.g. in the United States). Where that applies, the transfer relies on appropriate safeguards such as Standard Contractual Clauses.

5. How long we keep it

We keep your data for as long as your account exists. If you delete your account, your profile, tools, entries, AI memory, conversations and recorded videos (the files themselves) are permanently deleted immediately — see Settings → Delete account. Some minimal records (e.g. required for fraud prevention or legal obligations) may be kept for a limited period as required by law.

6. Your rights

Under GDPR and similar laws, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data — most of it you can edit yourself in Settings.
• Erase your data — delete your account at any time in Settings; this is immediate and permanent.
• Port your data — download a copy of your account, tools and entries as a file from Settings.
• Object to or restrict certain processing, and to withdraw consent where processing relies on it.
• Complain to your national data protection authority.

To exercise any of these rights beyond what's available in Settings, contact [privacy email].

7. Security

Access to your data is protected by row-level security in the database (you can only read or write your own rows), your AI provider key is never exposed to the browser, and passwords are hashed, never stored in plain text. No system is perfectly secure; we work to keep the Service safe and will notify affected users if a breach materially risks their data, as required by law.

8. Children

Mitheus is not directed at children under 16, and we do not knowingly collect their data.

9. Changes to this policy

If we make material changes to this policy, we will let you know (for example, by email or an in-app notice) before they take effect.

10. Contact

[privacy email] · [Company legal name], [registered address]