Privacy
Last updated 31 July 2026
Mycel runs AI-native service businesses. That means we process two very different things: data about you, the founder using Mycel, and data about your customers, which passes through Mycel because your business is doing work for them. This document keeps those separate, because the answers are different.
Your data, as a Mycel customer
We collect what an account needs and nothing we don't use:
- Account — email, and a password hash or the identifier from Google/GitHub if you sign in that way. We never see your Google or GitHub password.
- Business configuration — the wedges you run, the knowledge you write, the schedules you set.
- Operational records — tasks, their cost, approvals and the audit log.
- Billing — handled by Stripe. We store a customer id; we never see your card.
No advertising trackers, no ad networks, no session recording, and nothing sold or shared with anyone. We do use one third-party product analytics tool, PostHog — it does not run until you say yes to it, and the Cookies section below says exactly what it records and how to turn it off again.
Your customers' data
When your business does work for a client, their data flows through Mycel. Here we are a processor and you are the controller — you decide what is collected and why; we act on your instructions. The terms are in the Data Processing Agreement.
Two commitments worth stating plainly:
- We do not train models on your data, or your customers' data. Not ours, not anyone's.
- Credentials are encrypted at rest and never sent to a model. The AI agent receives an opaque handle; our harness holds the secret and makes the call. This is architectural, not policy — see the source.
Sub-processors
Everything below is provisioned in our infrastructure repository, so this table can be checked against it rather than believed. London means eu-west-2 — the UK, not the EEA, which matters for where transfer safeguards start.
| Who | For | Where |
|---|---|---|
| OpenAI | Model inference, reached through our own proxy — never by the agent directly | US |
| Supabase | The database | UK (London) |
| AWS | Application hosting | UK (London) |
| Daytona | The sandbox each run executes in | US |
| Composio | Brokered app connections (OAuth) | US |
| Resend | Transactional email | US |
| Stripe | Payments | US/EU |
| PostHog | Product analytics — only with your consent | US |
| Sentry | Crash reports | US |
| Google, GitHub | Sign-in, if you choose it — they confirm it's you and tell us nothing else | US |
PostHog is the narrowest, and the only one you have to agree to. It records which pages you open — the path, never the query string — and which setup steps you finish, identified by an internal account id, notyour email address, and never the contents of a form. Session recording is switched off, because this product shows your customers' financial data on screen. It does not start until you accept the cookie banner, and it is absent entirely from a self-hosted install.
Sentrytells us when something breaks. It receives the error and the stack trace, and we strip the rest before it is sent: no request body, no cookies, no headers, no query strings, and no IP address. Where a URL is included it is reduced to its path with ids removed, so a link that would sign someone in can't travel inside a crash report. Session replay is off, and errors are tagged with the same internal account id rather than your email. It sets no cookies and stores nothing on your device, which is why it isn't part of the choice below. Like PostHog, it is absent from a self-hosted install. It runs in the US, under the transfer safeguards described below.
What crosses a border, and what doesn't.Your account, your clients' data and the record of the work stay in London. What leaves the UK is narrower than that list looks: the prompt and the response of a model call, the files a run works on inside its sandbox, the specific app call you approved, an email we send you, a payment, an accepted page-view, and a stripped crash report. Those transfers rely on the EU-US Data Privacy Framework, Standard Contractual Clauses and the UK Addendum.
One you choose yourself.Connecting a LinkedIn account requires a residential proxy, and you supply it — every LinkedIn request, including message content, goes through the proxy provider you picked. It isn't our sub-processor and we don't pick it for you, but you should know it is in the path, because we won't connect the account without one.
We'll give 30 days' notice before adding one. Self-hosting the open-source kernel removes every sub-processor except the ones you configure yourself.
Cookies
Two kinds, and only one of them is your decision.
Strictly necessary — no consent needed, and no way to turn them off without breaking the thing they do.Your sign-in session, your client's portal session, the one-time token that protects the Google/GitHub handshake, which business you're currently looking at, and whether you left the sidebar collapsed. All first-party, all set by us, none of them shared with anyone, and none of them used to work out anything about you.
Analytics — yours to decide, and off until you decide it.One PostHog cookie and its matching browser storage. It is not written before you answer, which is the part most cookie banners get wrong: the banner appears while the tracker is already running. Ours doesn't load PostHog at all until you accept.
Accept and reject are one click each, side by side, the same size, with nothing pre-ticked. Rejecting changes nothing about how the site or the product works. You can change your mind whenever you like — Cookie settings in the footer here, and in the account menu inside the app — and withdrawing consent clears what PostHog stored.
A self-hosted install has no analytics configured, so there is nothing to consent to and no banner appears. The client portal your own customers use sets one cookie, their session, and nothing else.
Retention
- Operational data — for the life of your account, then 30 days.
- The audit log — kept for the account's life and not editable by anyone, including us. It is append-only and hash-chained; that is the point of it.
- Backups — taken and retained by our database provider on their schedule; we add none of our own. Ask and we'll tell you the current retention.
Your rights
Access, correction, export, deletion, and objection — under UK GDPR and GDPR. Email privacy@mycelai.devand we'll respond within 30 days. Export is self-service through the API; you don't have to ask.
Breaches
If your data is compromised we will tell you within 72 hours of becoming aware, with what happened, what was affected, and what we're doing. Even when it's embarrassing.