← Back to Mitlus

Privacy Policy

Version 1.1 — Effective date: 8 October 2026

1. Data Controller

Mitlus ("we", "us", "our") is the data controller responsible for your personal data. If you have questions about this policy or your data, contact us at [email protected].

2. Data We Collect

We collect and process the following categories of personal data:

  • Account information: name, email address, username, profile image, hashed password
  • OAuth tokens: access and refresh tokens from Google OAuth, stored encrypted. Sign-in tokens are used only to sign you in. Google Drive tokens are used only for the Drive integration (see section 3a).
  • AI conversations: chat messages, conversation history, and AI-generated responses within your startup workspaces
  • Startup business data: business plans, bets, interview notes, financial data, team information, milestones, and all other data you enter into your startup workspaces
  • File uploads: documents and files you upload to the platform (metadata and content)
  • Google Drive files: only if you connect Google Drive: the names, folder paths, modification times and content of files in the one folder you select (see section 3a)
  • Usage logs: AI model usage, token counts, timestamps, and estimated costs for billing and analytics
  • Payment data: billing information processed by Stripe (we do not store credit card numbers directly)
  • Audit logs: records of significant account and data actions for security purposes
  • Technical data: IP addresses (for rate limiting and security), session cookies

3. Legal Bases for Processing (GDPR Article 6)

We process your data under the following legal bases:

  • Contract performance (Art. 6(1)(b)): providing the core platform features — startup workspaces, AI assistant, billing, and account management
  • Legitimate interest (Art. 6(1)(f)): security monitoring, fraud prevention, audit logging, rate limiting, and platform stability
  • Consent (Art. 6(1)(a)): processing your data through AI providers for generating insights, suggestions, and conversational assistance

3a. Google User Data (Google Sign-In and Google Drive)

Mitlus uses Google APIs in two places. Both are optional.

  • Google Sign-In (scopes: openid, email, profile). We receive your name, email address and profile image to create and sign in to your account. We use them for nothing else.
  • Google Drive integration (scopes: drive.readonly, drive.file). When you connect Google Drive to a startup workspace, you select one folder. Mitlus reads the files in that folder and its subfolders: file names, folder paths, modification times, links and content. Mitlus does not read files outside the folder you selected. With drive.file, Mitlus files a document you upload to Mitlus in your Drive, but only after you confirm the folder and the file name. It can then change or remove only the files and folders it made itself. Mitlus never shares files and never changes or deletes your other files.

How we use Drive data. Only to provide the Drive feature you turned on:

  • to copy new and changed files from the selected folder into your startup workspace, once a day or when you ask for a sync;
  • to extract the text of each file so you and the AI assistant can search and read it inside your workspace;
  • to have an AI model screen and summarize each file, so Mitlus can suggest updates to your workspace records (for example an interview or a letter of intent). You approve every suggested change.

Storage. The copied files and their extracted text are stored on our servers in Germany (Hetzner), in your startup workspace. Only members of that workspace can see them. Your Google refresh token is stored encrypted.

Sharing. To screen and summarize files, the text of a file is sent to the AI model provider that runs the selected model (see section 4); for the Drive sync this is Google Gemini, routed through OpenRouter to Google infrastructure. These providers process the data only to return the result to us. We do not sell Google user data, do not use it for advertising, and do not share it with anyone else, except where the law requires it.

No AI training. We do not use Google user data to develop, improve or train generalized or non-personalized AI or machine learning models, and we do not allow our providers to do so.

Human access. No person at Mitlus reads your Drive data, unless you ask us to (for example for support), it is needed for security reasons, or the law requires it.

Disconnect and deletion. You can disconnect Google Drive at any time in Settings, Integrations. This revokes our access token at Google and stops all syncing. You can also remove Mitlus's access at myaccount.google.com/permissions. Files that were already copied stay in your workspace until you delete them, delete the workspace or delete your account; they are then deleted as described in section 5.

Mitlus's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Recipients and Sub-Processors

We share your data with third-party service providers (sub-processors) to deliver our services. See our full sub-processor list for details. Key recipients include:

  • Google: Google Sign-In and the optional Google Drive integration (EU/US)
  • Stripe: payment processing (US, with EU data handling)
  • OpenRouter: AI model routing for Mitlus One (Google Gemini 3.8 Flash, on Google infrastructure) and Mitlus Max (Kimi K3, on Fireworks or Baseten) (US/EU)
  • Anthropic: only when a user selects the Claude model with their own Anthropic API key (US)
  • Tavily: web search API (US)
  • European Patent Office: patent searches, only when you use the patent features (EU)
  • Hetzner Online GmbH: application and database hosting (Germany)

5. Data Retention

  • Account data: retained while your account is active. After account deletion request, data is retained for a 30-day grace period, then permanently deleted.
  • AI usage logs: retained for 1 year for billing and analytics, then deleted.
  • Audit logs: retained for 2 years for security and compliance, then deleted.
  • Stripe events: retained for 6 months, then deleted.
  • Chat messages: retained while your account is active, deleted with your account.
  • Google Drive files: copied files and their text are retained in your workspace until you delete them, the workspace or your account. Disconnecting Drive deletes the stored Google token at once.

6. Your Rights (GDPR Articles 15–22)

Under GDPR, you have the following rights:

  • Right of access (Art. 15): request a copy of your personal data
  • Right to rectification (Art. 16): correct inaccurate personal data via your account settings
  • Right to erasure (Art. 17): request deletion of your account and all associated data
  • Right to data portability (Art. 20): export your data in machine-readable JSON format
  • Right to object (Art. 21): object to processing based on legitimate interest
  • Right to restrict processing (Art. 18): request restriction of processing in certain circumstances
  • Right to withdraw consent (Art. 7(3)): withdraw consent at any time (does not affect prior processing)
  • Right to lodge a complaint: file a complaint with your local Data Protection Authority (DPA)

You can exercise your right to data export and account deletion directly from your account settings. For all other requests, contact [email protected].

7. International Data Transfers

Some of our sub-processors are located outside the EU/EEA, primarily in the United States. For these transfers we rely on:

  • EU–US Data Privacy Framework adequacy decisions where applicable
  • Standard Contractual Clauses (SCCs) as approved by the European Commission
  • Supplementary technical measures (encryption in transit and at rest)

Models accessed through OpenRouter are routed by OpenRouter (US) to pinned inference providers: Mitlus One runs on Google infrastructure (US/EU) and Mitlus Max runs on US inference providers (Fireworks, Baseten) with zero data retention. Routing outside these pinned providers is disabled.

8. Anonymized Data Aggregation

We never access your individual chats, business data, or personal information for purposes beyond delivering the Service to you. If you opt in (via Settings > Privacy & Data), we may use anonymized, aggregated data — such as feature usage patterns and aggregate statistics — to improve the platform. This data cannot be traced back to you. You can opt out at any time without any impact on your experience.

9. Cookies

We use only essential cookies required for authentication and session management. We do not use analytics, advertising, or tracking cookies. The session cookie is a secure, HTTP-only cookie set by NextAuth.js.

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

  • Encryption in transit (TLS/HTTPS)
  • Password hashing with bcrypt (cost factor 12)
  • Security headers (X-Content-Type-Options, X-Frame-Options, etc.)
  • Rate limiting on authentication and API endpoints
  • Audit logging of significant actions
  • Cascading deletes to prevent orphaned personal data

11. Children's Privacy

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected].

12. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will notify you through the platform (via a consent banner) and update the version number and effective date above. Your continued use of the platform after accepting the updated policy constitutes your acknowledgment of the changes.

13. Contact

For any questions about this privacy policy or to exercise your rights, contact us at: [email protected]