Privacy

Last updated 13 August 2026

Mycel drafts the client work a service firm sends. That means we process two very different things: data about you, the founder using Mycel, and data about your customers, which passes through Mycel because your business is doing work for them. This document keeps those separate, because the answers are different.

Your data, as a Mycel customer

We collect what an account needs and nothing we don't use:

• Account — email, and a password hash or the identifier from Google/GitHub if you sign in that way. We never see your Google or GitHub password.
• Business configuration — the services you run, the knowledge you write, the schedules you set.
• Operational records — tasks, their cost, approvals and the audit log.
• Billing — handled by Stripe. We store a customer id; we never see your card.

No advertising trackers, no ad networks, no session recording, and nothing sold or shared with anyone. We do use one third-party product analytics tool, PostHog — it does not run until you say yes to it, and the Cookies section below says exactly what it records and how to turn it off again.

Your customers' data

When your business does work for a client, their data flows through Mycel. Here we are a processor and you are the controller — you decide what is collected and why; we act on your instructions. The terms are in the Data Processing Agreement.

When you add Mycel notes to a Meet, Zoom or Teams call, it joins as a visible participant named Mycel notes (transcript). It records audio onlyand stores a transcript on that person so the next conversation is better prepared. We do not keep a video of anyone's face. You confirm this in the product before it joins. Amazon Transcribe (below, under AWS) turns the audio into text; language is detected automatically.

Two commitments worth stating plainly:

• We do not train models on your data, or your customers' data. Not ours, not anyone's.
• Credentials are encrypted at rest and never sent to a model. The AI agent receives an opaque handle; Mycel holds the secret and makes the call. This is architectural, not policy — see the source.

Sub-processors

Everything below is provisioned in our infrastructure repository, so this table can be checked against it rather than believed. London means eu-west-2 — the UK, not the EEA, which matters for where transfer safeguards start.

PostHog is the narrowest, and the only one you have to agree to. It records which pages you open — the path, never the query string — and which setup steps you finish, identified by an internal account id, notyour email address, and never the contents of a form. Session recording is switched off, because this product shows your customers' financial data on screen. It does not start until you accept the cookie banner, and it is absent entirely from a self-hosted install.

Sentrytells us when something breaks. It receives the error and the stack trace, and we strip the rest before it is sent: no request body, no cookies, no headers, no query strings, and no IP address. Where a URL is included it is reduced to its path with ids removed, so a link that would sign someone in can't travel inside a crash report. Session replay is off, and errors are tagged with the same internal account id rather than your email. It sets no cookies and stores nothing on your device, which is why it isn't part of the choice below. Like PostHog, it is absent from a self-hosted install. It runs in the US, under the transfer safeguards described below.

Crisp is the support chat. It is the one thing here that is not behind the cookie banner, and that is deliberate: it is how you reach a human about a product that handles money, and a support channel that only works after someone accepts analytics is not a support channel. It sees what you type into it and which account you are, nothing else. It runs in France, so nothing in it leaves the EEA. A self-hosted install without a Crisp key does not load it at all.

What crosses a border, and what doesn't.Your account, your clients' data and the record of the work stay in London. What leaves the UK is narrower than that list looks: the prompt and the response of a model call, the files a run works on inside its sandbox, the specific app call you approved, an email we send you, a payment, an accepted page-view, and a stripped crash report. Those transfers rely on the EU-US Data Privacy Framework, Standard Contractual Clauses and the UK Addendum.

Two lookups that fill in pictures.When a prospect's stored photo has expired — LinkedIn signs them and they stop working after a few weeks — we ask unavatar.io for a replacement by their public LinkedIn handle, and we ask icons.duckduckgo.comfor a company's favicon by its domain. Those two things are all that is sent, and only for prospects, never for your clients or your own work. We make those requests, from our servers: your browser talks only to us, so neither service sees your IP address or which of your prospects you are looking at together. Both fail closed — no answer means initials, and nothing else changes.

One you choose yourself.Connecting a LinkedIn account requires a residential proxy, and you supply it — every LinkedIn request, including message content, goes through the proxy provider you picked. It isn't our sub-processor and we don't pick it for you, but you should know it is in the path, because we won't connect the account without one.

We'll give 30 days' notice before adding one. Self-hosting the open-source kernel removes every sub-processor except the ones you configure yourself.

Cookies

Two kinds, and only one of them is your decision.

Strictly necessary — no consent needed, and no way to turn them off without breaking the thing they do.Your sign-in session, your client's portal session, the one-time token that protects the Google/GitHub handshake, which business you're currently looking at, and whether you left the sidebar collapsed. All first-party, all set by us, none of them shared with anyone, and none of them used to work out anything about you.

Analytics — yours to decide, and off until you decide it.One PostHog cookie and its matching browser storage. It is not written before you answer, which is the part most cookie banners get wrong: the banner appears while the tracker is already running. Ours doesn't load PostHog at all until you accept.

Accept and reject are one click each, side by side, the same size, with nothing pre-ticked. Rejecting changes nothing about how the site or the product works. You can change your mind whenever you like — Cookie settings in the footer here, and in the account menu inside the app — and withdrawing consent clears what PostHog stored.

A self-hosted install has no analytics configured, so there is nothing to consent to and no banner appears. The client portal your own customers use sets one cookie, their session, and nothing else.

Retention

• Operational data — for the life of your account, then 30 days.
• The audit log — kept for the account's life and not editable by anyone, including us. It is append-only and hash-chained; that is the point of it.
• Backups — taken and retained by our database provider on their schedule; we add none of our own. Ask and we'll tell you the current retention.

Your rights

Access, correction, export, deletion, and objection — under UK GDPR and GDPR. Email islam.hachimi@trymycelai.comand we'll respond within 30 days. Export is self-service through the API; you don't have to ask.

Breaches

If your data is compromised we will tell you within 72 hours of becoming aware, with what happened, what was affected, and what we're doing. Even when it's embarrassing.