Privacy policy

1. Who we are

Mellos is run by RiseSystems Bartosz Korzeniowski, ul. Gen. Józefa Longina Sowińskiego 46/1c, 40-018 Katowice, Poland, tax ID (NIP) 6282306462, REGON 545249507 (“we”, “us”). We are the controller of the personal data described here: we decide why and how it's processed, except where section 2 says otherwise. For anything about your data, write to hello@mellos.app.

This policy covers the website, the waitlist, the Neutral critic, accounts and everything in the dashboard. Section 11 has the rules for Gmail data that Google requires.

2. Content your team puts in Mellos

A project's content (cards, notes, docs, files, chat messages, mail drafts and the like) is added by its members and belongs to the team. When a company or other organisation uses Mellos for its work, it decides what goes into its projects and who sees it, and we process that content on its behalf, as its processor (Article 28 GDPR). If your organisation needs a data processing agreement with us, write to hello@mellos.app.

Questions about the content of such a project are best sent to its admins too; requests we receive about it, we pass on to the organisation.

3. Visiting the website

To show you a page, our server receives your IP address and what your browser sends with each request. We don't use analytics, tracking or advertising tools.

To stop abuse, we count requests for a short time per IP address and, for sign-in links, per email address. The counts disappear within an hour.

The server keeps a technical log: for each request the time, your IP address and how it was answered, and the details of anything that failed, so we can find and fix faults and stop abuse. These logs are kept for 30 days and then deleted.

The legal basis is our legitimate interest in keeping the service working and safe (Article 6(1)(f) GDPR).

4. The waitlist (closed)

Before Mellos opened, people could join a waitlist. If you did, we keep your email address, the language version of the site you used and the date and time you gave consent, to tell you that Mellos is open. The legal basis is your consent (Article 6(1)(a) GDPR). The waitlist no longer takes new sign-ups.

You can withdraw your consent at any time by writing to hello@mellos.app; this doesn't affect the lawfulness of processing before you withdrew it.

We keep these addresses until we've told everyone that Mellos is open or you withdraw consent, but no longer than 12 months from signing up; after that they're deleted on their own.

5. The Neutral critic

When you use the free Neutral critic, the idea you type is sent to OpenAI (USA), the provider of the AI model, which processes it on our behalf to write the review. We don't store the idea or the review.

To prevent abuse, we keep a one-way hash of your IP address and the time of each review for up to 48 hours, and use it only to limit how many reviews can be requested. The legal basis is our legitimate interest in protecting the service (Article 6(1)(f) GDPR).

6. Your account

You sign up and sign in with Google, GitHub or a link we email you. We keep your email address, your name and profile picture if the provider shares them, which ways you sign in, and the tokens Google or GitHub issue when you sign in with them. A sign-in link works once, for 10 minutes, and we keep only a hash of it.

Each signed-in device has a session that lasts up to 30 days, with the IP address and browser it was started from, so you stay signed in and sessions can be checked for misuse.

We also keep your settings, such as your name in Mellos, your language and which emails you want. When you start, you can answer a few optional questions (what you do, how you heard about Mellos, the size of your team and what you'll use Mellos for); the answers help us understand who uses Mellos.

If you sign up after opening someone's referral link, we record that you joined through it. The person who shared it sees only how many people joined, not who.

We process this to give you the account and the service (Article 6(1)(b) GDPR) and, for sessions and security, on the basis of our legitimate interest in keeping accounts safe (Article 6(1)(f) GDPR). Without an email address we can't create an account.

We keep your account until you delete it, in Settings → Account (or write to hello@mellos.app from the address you sign in with, and we'll delete it within one month). It leaves the backups 14 days later.

7. Projects

In a project, Mellos keeps what its members add: cards with their comments and checklists, notes, frames and arrows on the canvas, reactions, goals, chat messages, docs with their last 30 versions, uploaded files, mail drafts, and the project's agents and settings. Each item records who added it and when; an activity log and alerts show the project's members who did what.

Only the project's members can see it, as far as the roles and permissions set by its admins allow. When an admin invites someone, we keep the invited email address and send an invite to it.

Who is typing, who has a doc open, and teammates' pointers on the canvas and the board are passed between browsers as they happen and are never stored.

Docs are kept in the database; uploaded files are kept as they are, on our server's disk. Images, PDFs, videos and text files are shown in the browser; other files are downloaded.

We keep a project's content while the project exists, until its members delete it. Deleted content leaves the backups within 14 days.

When you delete your account, what you added to a project you share with others stays in it for them, with your name taken off; a project only you are in is deleted with your account.

We process it to provide the service you or your organisation use (Article 6(1)(b) GDPR), or on the organisation's behalf as described in section 2.

8. AI agents

Agents work only when someone in the project asks one: in chat, on Home, in a card's comments, on the canvas, in a doc or in the mail. If a project's admins turn on the weekly summary, an agent also writes it every Monday.

To answer, the request and the part of the project it needs are sent to the provider of the AI model: for example the project's name and the names of its members, the board, goals, recent chat messages or the week's activity, the card, the notes someone picked, the doc or the uploaded PDF or image, or the email being answered. The answer comes back to Mellos and is kept in the project like any other content, marked as the agent's.

Agents' answers come from models by OpenAI (USA). It processes the data on our behalf only to answer, under business terms that don't let it use the data to train its models; how long it keeps it (for example, to detect abuse) is set by those terms. We don't train AI models on your data either.

A project's admins can give the project's own agents integrations: outside services such as Notion or Slack, connected through the Model Context Protocol. When such an agent works, the AI provider connects to those services for the project, so what the agent sends them and gets back passes through them. The admins choose these services, and their own terms and privacy policies apply. Integration tokens are encrypted and never sent to a browser.

To count AI credits, we record each agent answer: who asked, which agent, when and how many credits it used. Not what was asked.

The legal basis is the contract (Article 6(1)(b) GDPR): agents are part of the service, and they read only what someone asked them to work on or what the project's admins turned on.

9. Email from Mellos

We send email through Resend (USA), which delivers it on our behalf: sign-in links, invites, the note that you've been added to a project, cards assigned to you, things due tomorrow and the weekly summary.

You choose which notifications you get, for each project, and every one has a link to unsubscribe in one click.

An email waiting to be sent, and the record of one that was sent, are kept for 30 days.

10. Paid plans and payments

Paid plans are sold by Polar (polar.sh), which acts as the merchant of record: Polar is the seller, takes the payment, issues the invoice and handles sales tax. Polar processes your payment and billing details as a separate controller, under its own privacy policy. We never see your card number.

From Polar we receive and keep your Polar customer ID, which plan was bought for which project, and the subscription's status and billing period, so the project gets the plan it paid for. We keep this while your account exists. The legal basis is the contract (Article 6(1)(b) GDPR).

11. Gmail and Outlook mailboxes

On paid plans, you can connect your own Gmail or Outlook mailbox to a project, which only you can see, and a project's admins can connect a shared mailbox that the project's members use.

You connect through Google's or Microsoft's own sign-in (OAuth), where you decide whether to allow access. Mellos asks to read your mail and to send the emails you choose to send: for Gmail, the gmail.readonly and gmail.send permissions; for Outlook, Mail.Read, Mail.Read.Shared, Mail.Send and offline access. We also receive the mailbox's address and name.

The access tokens are encrypted (AES-256-GCM) and kept where only our server can read them; they never reach a browser.

Messages are fetched from Google or Microsoft when someone with access opens the mailbox or a message, and shown to them. We don't store them. We store drafts: what a person or an agent writes, the recipients, the subject and which message it answers.

A message goes to the AI provider (section 8) only when someone asks an agent to draft a reply to it: then the message and the request are sent, to write that draft. Nothing from a mailbox goes to an AI provider otherwise.

Mellos never sends email on its own. Agents only write drafts; an email goes out only when a person presses Send and confirms.

You can disconnect a mailbox in Mellos at any time, which deletes the tokens and drafts we keep for it. You can also remove Mellos's access in your Google or Microsoft account settings.

Mellos's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

In particular, data from Gmail: we use only to show the mailbox to the people it was connected for, and to write and send the emails they ask for; we transfer only to the AI provider when someone asks an agent for a draft, and otherwise only where security or the law requires it; we don't use for advertising, don't sell, and don't use to develop, improve or train generalised AI or machine learning models; and none of our people read it, unless you ask us to for specific messages, it's needed for security (for example, investigating abuse) or the law requires it. We treat mail from Outlook the same way.

The legal basis is the contract (Article 6(1)(b) GDPR): a mailbox is connected only by choice, yours or your project's admins'.

12. Who else receives data

We don't sell personal data or share it for advertising. We may disclose it when the law requires us to, for example to a court or a public authority.

Besides a project's members, these receive personal data, each only as far as described above:

• SkyPass Solutions Sp. z o.o. (Poland): the server Mellos runs on, with the database, the files and the backups;
• OpenAI (USA): the AI models behind the agents and the Neutral critic;
• Resend (USA): sending email;
• Polar: selling paid plans, as a separate controller;
• Google, GitHub and Microsoft: signing in and mailboxes, when you choose to use them, under their own privacy policies;
• services a project's admins connect as integrations (section 8).

13. Data outside the European Economic Area

OpenAI, Resend and GitHub are based in the USA, and Google, Microsoft and Polar may process data there too. Where personal data goes outside the European Economic Area, we rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework when the recipient is certified under it, and otherwise on the standard contractual clauses in the recipient's data processing terms. You can ask us for a copy of these safeguards at hello@mellos.app.

14. Where data is kept and how it's protected

Mellos runs on one server we rent from SkyPass Solutions Sp. z o.o. (Poland). On it, in separate containers: the database (PostgreSQL) with accounts, projects, sessions and security counters; a cache (Redis); and the app itself, with the uploaded files. Only the HTTPS entrance is reachable from the internet.

Every night the database and the uploaded files are backed up and encrypted, and each backup is kept for 14 days, then deleted.

Connections to Mellos are encrypted (HTTPS). Mailbox and integration tokens are encrypted in the database. Every request to the database runs as the person signed in, and the database's own rules decide what they may read or change.

15. Cookies and browser storage

Mellos uses only what it needs to work: no analytics, tracking or advertising cookies. Polar's checkout page, where you pay, sets its own cookies under Polar's policy.

Mellos stores:

• sign-in cookies, which keep you signed in for up to 30 days;
• the language you picked, in a cookie kept for a year, only once you switch language;
• the project you had open, in a cookie kept for a year;
• a referral code, in a cookie kept for 30 days, after you open someone's referral link;
• a check code for 10 minutes while you connect a mailbox, so the answer from Google or Microsoft comes back to the same browser;
• your colour theme, in your browser's local storage.

16. Your rights

You have the right to access your data and get a copy of it, to have it corrected or deleted, to restrict its processing, to data portability, and to object to processing based on our legitimate interest. Where we rely on your consent, you can withdraw it at any time; this doesn't affect the lawfulness of processing before you withdrew it.

You can do much of this in Mellos: change your name, choose your emails, delete what you've added, disconnect a mailbox. For the rest, write to hello@mellos.app; we answer within one month. A copy of your data, and deleting your account, are in Settings → Account.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

You can lodge a complaint with a data protection authority: in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa), or the authority in the EU country where you live or work.

Mellos is meant for people aged 16 and over.

17. Changes to this policy

When Mellos changes what it does with personal data, we update this policy and the date at the top. If a change matters to you, we'll tell you by email or in Mellos before it applies.