Privacy Policy

1. Introduction

At Mithrilis, we are committed to protecting your privacy and ensuring the security of your data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered logistics intelligence platform.

This policy applies to information collected through our website, platform, APIs, and any related services (collectively, the "Service").

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name and email address
• Organization name and details
• Authentication credentials
• Billing information for paid plans

2.2 Operational Data

When you use the Service, we may process:

• Shipment identifiers (tracking numbers, bills of lading, container numbers)
• Operational metadata (origin, destination, dates, cargo details)
• Data quality metrics and confidence scores
• Workflow configurations and automation rules

2.3 What We Do NOT Store

We specifically do not store:

• End-customer personally identifiable information beyond what appears as routine shipment metadata passed through by your source systems
• Payment card information (handled exclusively by our payment processor)

Raw payloads from connected systems are retained temporarily so we can re-derive the unified intelligence if our extraction logic improves. The specific retention periods are listed in Section 4.

2.4 Third-Party Credentials

To connect to your logistics systems, we securely store:

• Encrypted API keys and OAuth tokens for connected systems
• Connection configurations and access settings

3. How We Use Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process shipments and execute workflow automations
• Send service communications (account notifications, security alerts, updates)
• Analyze usage patterns to improve service quality
• Comply with legal obligations
• Prevent fraud and ensure platform security

4. Data Retention

We follow a tiered retention model: the unified intelligencewe derive from your data is kept for the life of your account so you retain full historical insight, while the raw operational data that already lives in your source systems is aged out on the schedule below.

5. Data Sharing

We do NOT sell your personal information.

We may share information only in the following circumstances:

• Service Providers: With trusted third parties who assist in operating our Service (hosting, payment processing, analytics)
• Legal Requirements: When required by law, subpoena, or legal process
• With Consent: When you explicitly authorize us to share information
• Business Transfers: In connection with a merger, acquisition, or sale of assets

We access third-party systems only using your credentials and only to provide the Service you have requested.

6. Mithrilis Intelligence & Your Data

Mithrilis builds intelligence from the systems you connect, inside your organization boundary.

We do not sell, share, or benchmark your data against other customers'.

• Your data is never pooled with another customer's to produce comparisons, benchmarks, indices, or rankings, and no such output is offered to any other customer.
• Foundation models we use for natural-language features (such as Anthropic, OpenAI, and Google) receive only inference-time prompts. Under each provider's API terms, those inputs are not used to train their models.
• Aggregate, de-identified use to improve model quality is governed by Section 7.3 of our Terms of Service. We do not use identifiable customer data for training.

7. Security

We implement comprehensive security measures including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Database-level tenant isolation. Every customer record is protected by row-level security policies enforced by the database itself, not only by application code.
• Role-based access controls
• Audit logging of administrative and access-control events
• Third-party integration credentials are encrypted at rest with AES-256-GCM and are never returned to the browser

SOC 2 Type II: planned. We are not currently SOC 2 certified and are not undergoing an audit at this time. We will update this page when that changes.

For detailed security information, visit our Security page.

8. Your Rights

8.1 All Users

All users have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data
• Export: Request your data in a portable format

8.2 EU Residents (GDPR)

If you are located in the European Union, you also have the right to:

• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to restrict processing
• Right to object to processing
• Right to withdraw consent at any time

8.3 California Residents (CCPA)

If you are a California resident, you have the right to:

• Know what personal information is collected
• Request deletion of your personal information
• Opt-out of the sale of personal information (we don't sell data)
• Non-discrimination for exercising your rights

To exercise any of these rights, contact us at hello@mithrilis.com.

9. International Data Transfers

Your data may be processed in the United States where our servers are located. For transfers from the European Economic Area, we use Standard Contractual Clauses approved by the European Commission to ensure adequate protection of your data.

10. Cookies & Tracking

We use the following types of cookies and tracking technologies:

• Essential Cookies: Required for the Service to function (authentication, security)
• Analytics: We use Vercel Analytics to understand how the Service is used

We do not use third-party advertising cookies.

11. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a minor, we will take steps to delete that information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will provide at least thirty (30) days' notice of material changes via email and will update the "Last updated" date at the top of this page.

Your continued use of the Service after the effective date of changes constitutes acceptance of the modified policy.

13. Contact

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email: hello@mithrilis.com