Privacy Policy

1. Who we are

Mythein Labs ("Mythein", "we", "us") is an AI research lab. This policy explains what personal data we handle when you visit mythein.com (the "Site") or email us, why, and what you can ask of us. We are the controller of that data. For anything in this policy, write to hello@mythein.com.

2. What we collect

You can read the public Site without an account. If you are invited to Neuro-SuperPoDS and sign in, we also process the account information described below:

• Visits. Google Analytics records how the Site is used: pages viewed, time on page, referring site, approximate location (country or city, derived from your IP address), device, browser and screen size. It identifies your browser with a random ID stored in cookies; it does not tell us who you are.
• Server logs. Our hosting provider records technical request data, such as IP address, time, requested URL and browser, to deliver the Site and keep it secure.
• Email. If you write to us, we receive your address, your name if you give it, your message and any attachments, and the delivery details every email carries.
• Your account, if you create one. You sign in with Google. Google tells us your Google account ID, name, email address, whether Google has verified that address, and your profile picture; we never see your Google password. We store these, when your account was created and when you last signed in.
• Neuro-SuperPoDS sign-ins. We use an authenticated session to keep you signed in to Neuro-SuperPoDS and apply your account and workspace access permissions.
• Your theme choice. If you switch between the light and dark theme, the Site remembers it in your browser's local storage under csi-theme-v3. It never leaves your device.

We do not buy personal data, and we do not knowingly collect data from children.

3. Why we use it

• To run and secure the Site (server logs): our legitimate interest in operating a working, safe website.
• To understand how the Site is read (analytics): our legitimate interest in improving it, or your consent where the law requires consent for analytics cookies.
• To provide your account (account and Neuro-SuperPoDS data): to perform our agreement with you when you choose to create an account.
• To answer you (email): our legitimate interest in responding to people who contact us, or steps you ask us to take before entering a collaboration, role or other agreement.

We do not sell personal data, use it for advertising, or make automated decisions about you with it. We do not use your emails or analytics data to train AI models.

4. Who processes it

We use a small number of service providers, each handling data only on our instructions:

• Vercel hosts the Site and processes server logs.
• Google provides Google Analytics and Google sign-in.
• Neon hosts our account database in the European Union (Frankfurt).
• Cloudflare provides DNS for our domain. It resolves addresses and does not see page contents.
• Hetzner hosts our own mail server in Germany, where email sent to us is stored.

We may also disclose data where the law requires it, to protect our rights or the safety of others, or to a successor if the lab is reorganized or acquired, in each case under this policy's protections.

5. International transfers

Email and account data are stored in the European Union. Vercel and Google may process Site data in the United States and other countries. Where data leaves the European Economic Area or the United Kingdom, those providers rely on recognized safeguards such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

6. How long we keep it

• Analytics data: no longer than 14 months, then deleted by Google Analytics' retention setting.
• Server logs: short-term, as kept by our hosting provider for operations and security.
• Email: for as long as the conversation or the relationship it concerns lasts, then deleted unless we must keep it for legal reasons.
• Account data: until you ask us to delete your account. Platform sessions expire according to the authentication settings or when you sign out.

7. Cookies and your choices

If you sign in, the Site sets a session cookie (authjs.session-token, encrypted, for up to 30 days) that keeps you signed in, plus short-lived cookies used only while signing in. They are necessary for the account to work and are removed when you sign out. Google Analytics sets first-party cookies (named _ga and _ga_*) that distinguish returning browsers. You can block or delete cookies in your browser settings, use a content blocker, or install Google's opt-out add-on at tools.google.com/dlpage/gaoptout. The Site works fully without them. The theme setting is stored in local storage, not a cookie, and you can clear it the same way.

8. Your rights

Depending on where you live, including under the GDPR, the UK GDPR and U.S. state privacy laws, you may have the right to:

• Access the personal data we hold about you and get a copy of it.
• Correct it, or have it deleted.
• Object to, or ask us to restrict, how we use it.
• Withdraw consent where we rely on consent.
• Complain to your local data protection authority.

Most Site data is pseudonymous analytics we cannot link to you. For your account or anything tied to your email, including deleting your account, write to hello@mythein.com from the address concerned and we will reply within one month.

9. Security

The Site is served only over HTTPS, and email to and from our mail server is encrypted in transit with TLS. Access to the data we hold is limited to the people at the lab who need it. No system is perfectly secure, but we will tell affected people and the authorities of a breach where the law requires it.

10. Changes and contact

If what the Site collects changes, for example if we add forms or new account features, we will update this policy first; the date at the top shows the latest version. Questions or requests: hello@mythein.com.