Last updated: 2025-09-24
We care about your privacy. This Privacy Policy explains how Mycelo ("we", "us") collects, uses, discloses and protects personal data when you use our collaborative whiteboard platform, websites and related services (the "Service"). It also explains your rights and choices. If you do not agree with this Policy, do not use the Service.
AI prompts and outputs may be logged for abuse prevention, rate limiting and feature quality. We do not use private workspace Content to train general foundation models. We may use aggregated, anonymised patterns to improve model orchestration and performance (e.g. prompt length statistics, feature usage counts). Sensitive data should not be input unless necessary and authorised.
We may process data in the UK, EU or other countries where we or our subprocessors operate. Where required we use appropriate safeguards (e.g. Standard Contractual Clauses) for cross‑border transfers.
We keep personal data for as long as necessary to provide the Service and for legitimate business or legal purposes (audit, security, dispute resolution). We may anonymise data for longer‑term analytics. Deleted boards and files may persist in backups for a limited period (typically < 30 days) before secure purge.
Measures include encryption in transit (HTTPS), access controls, least privilege, audit logging, regular dependency patching and backups. No system is perfectly secure; you are responsible for strong passwords, managing access, and reporting suspected issues promptly.
Depending on jurisdiction you may have rights to access, rectify, erase, restrict, object, port data, or withdraw consent. Request via privacy@mycelo.app. We will verify identity before fulfilling requests. We may decline requests that would infringe others' privacy or our legal obligations.
The Service is not directed to children under 16. If we learn we processed data of a child without proper consent, we will delete it.
Key infrastructure and processors (may evolve): cloud hosting/IaaS, object storage, email transactional service, authentication provider, optional analytics, AI inference. A detailed list (with region and purpose) will be published at /subprocessors when available and material changes will be notified as required.
Requests submitted by email are logged, triaged, identity verified, evaluated for scope, responded to within statutory timelines (usually 30 days) or extended with justification if complex.
We may update to reflect service evolution or legal guidance. Material changes will be communicated via email or in‑app notice; the updated date will change. Continued use indicates acceptance.
Questions, concerns, complaints or DSR requests: privacy@mycelo.app. EU/UK representative and DPO details (if appointed) will be published when applicable.
We aim to build a trustworthy product with minimal, transparent data collection.
