Privacy Policy

Effective date: 2026-10-09

MYTE is a platform and managed service provided by Myte Group Inc for designing, building, and operating governed custom operating models. It connects business context, rules, workflows, evidence, communications, and software delivery. We process personal data and the content you provide to deliver and secure your service. Optional use of Customer Content to improve MYTE is a separate choice, explained below.

Data Use Summary

Your intent and workspace: we turn the needs, context, and rules you share into work on your mission board. Workspace content is not public by default; access depends on organization and project permissions, authorized collaborators, and service delivery needs.
Your ideas stay yours: we do not turn your project ideas or Customer Content into products of our own.
Sharing to improve MYTE is optional: you may separately choose to contribute specific data or feedback to improve MYTE's human-governed tools and workflows. Using the service is not permission for this additional use.
AI-assisted processing: OpenAI is the default inference provider for workspaces. Content needed for AI-assisted features may leave MYTE-managed infrastructure; access to Myte AI is restricted as described below.
MYTE-managed records: we retain inputs, outputs, decisions, approvals, and delivery evidence on systems operated by MYTE or by service providers acting on our behalf only as needed to deliver, secure, and govern the service.
Portability and deletion: you can use available exports or request a copy of your data to take elsewhere. Account deletion removes active account data and related content, but is not complete erasure of all records; the exceptions and shared-organization limits are explained below.
Collaboration: if you invite builders, experts, or other collaborators, they can access the workspace content you share with them so they can pick up work across ideation, delivery, and maintenance.
Limits: AI outputs are non-deterministic and bound by context window size ("memory").
Operational logging: we log minimal security and reliability metadata (e.g., auth errors, rate-limit events, timestamps) to prevent abuse and operate the service. We do not run marketing analytics or behavioral tracking.

Scope

This policy applies to mytecody.com, subdomains, the MYTE web app, related APIs and services, and communications with us.

Language and Quebec Notice

This policy is available in English and French to meet Quebec requirements. If you reside in Quebec, the laws of Quebec apply alongside applicable Canadian federal law.

Information We Collect

Account data: name, email, organization, preferences, authentication data.
Authentication and device trust data: passkey/public-key credential metadata, optional device labels, trusted-device hashes/status, login timestamps, and security events. Your device handles biometric or PIN verification locally; we do not receive or store raw biometric templates, fingerprints, face scans, or device PINs.
Customer content: information you upload, enter, record, or connect (e.g., notes, proposals, messages, audio for transcription) and related metadata.
Integrations: data from services you connect (e.g., GitHub metadata and files as configured), Stripe billing metadata, Google OAuth profile.
Operational and security data: service logs, diagnostics, timestamps, and rate-limit/security events needed to operate the service.
Payments: processed by Stripe; we receive limited records (e.g., customer ID, status, amounts).
API keys and telemetry: project API key prefix/fingerprint, usage counts, last used time/IP, rate-limit events (6 requests/hour/key), and audit entries tied to key metadata (not the raw key, which is only shown once on creation).
Cookies: session, authentication, preference, and security cookies.

Speech and Audio Capture

Audio you upload or record for transcription may be sent to OpenAI to produce a transcript. We retain transcripts used in your work and may retain audio as needed to process the request, provide the feature, or resolve reliability and security issues. Provider processing is subject to the controls described below.

OpenAI and Other AI Processing

Workspaces use the OpenAI API by default, including codebase retrieval and analysis and quality control for software being built. Depending on the feature, we send prompts, selected source code, retrieved context, or other content needed to produce the requested result. OpenAI may retain content and related records under its applicable API policies and configuration; retention varies by endpoint and feature. We do not promise that all processing stays on MYTE-managed infrastructure or that providers retain no data. See OpenAI's data-control documentation.

We do not opt Customer Content into provider model training or use it to train proprietary foundation models. Keeping your workspace non-public is different from keeping every processing step local. Authorized people and the providers needed to deliver a feature may process its content.

Provider Configuration and Restricted Myte AI Access

The proposal's inference configuration governs its linked project and workspace. Available OpenAI storage and processing options depend on the selected configuration; storage in a region does not by itself guarantee processing in that region. Text-generation requests disable response storage, but this is not a guarantee that all provider records are deleted. Modified Abuse Monitoring is not a blanket no-retention guarantee, and controls differ by endpoint.

Myte AI runs on private, MYTE-managed inference infrastructure and is available only to explicitly authorized organizations working directly with Myte Group, not as a general self-service option. Selecting it does not mean every feature avoids third-party services: unsupported capabilities may be unavailable or use a separately disclosed provider. Workspace data remains subject to MYTE's access controls and retention practices regardless of the inference provider.

Retrieval, Snapshots, and Embeddings

When you enable retrieval, we may store repository/project content, embeddings, and snapshot metadata to build context bundles for answers. Retrieval context can become stale; you can remove source data to remove future use in answers. We do not train proprietary foundation models on your Customer Content.

Project API Keys

Project-scoped API keys (e.g., for the Project Assistant) are tied to a single project with one active key at a time. Raw keys are shown once; we store hashed prefixes/fingerprints and usage telemetry (usage counts, last_used_at/IP, rate-limit events). Abuse events may be logged with key metadata for security and fraud prevention.

Secrets Service

The internal Secrets Service stores secret values in MongoDB encrypted with AES-GCM using an envelope key file mounted at runtime. Access is limited to authorized requests; audit trails are retained for sensitive actions. Secret values are not sent to model training and are decrypted only to fulfill explicit operations you invoke.

Integrations and Billing

If you connect third parties (e.g., GitHub, Google OAuth) we access the scopes you grant to deliver features (such as repository metadata/files or profile data). Billing is processed by Stripe; we receive customer/profile IDs, payment method metadata, invoices, portal session IDs, and webhook events to operate subscriptions, wallet balances, and refunds.

How We Use Information

Provide and secure the services.
Use operational metadata to maintain quality, reliability, performance, and safety. This is not permission to reuse your project ideas or Customer Content for our own products.
Use specific Customer Content for optional MYTE improvements only within a separately agreed scope.
Compliance and enforcement (security, fraud prevention, lawful requests).
Service communications (updates, onboarding, invoices, security notices).

Your ideas and Customer Content remain yours. We use them to deliver your work, not to turn your project into a product of our own. We do not retain a separate copy for MYTE product improvement without your separate, explicit permission. The service records described under Retention still apply.

If you want to help improve MYTE, you can choose to share specific data or feedback so we can make its human-governed tools more useful, from planning through delivery and operation. Before that use, we agree with you on what is shared, the specific improvement purpose, who may access it, how long it may be kept, and how it will be deleted. This is optional: declining does not remove access to the core service. Project delivery feedback is not automatically permission to improve MYTE with your content.

Contact info@mytegroup.com to discuss an optional contribution or withdraw permission. We record the agreed scope and stop future optional use when you withdraw. You can also request deletion of the contributed copy, subject to the disclosed legal and retention limits. Withdrawal does not itself delete your workspace or records still needed to provide your service. Permission to contribute does not transfer ownership or opt your content into provider model training.

Lawful Bases

Contract (to provide the service), legitimate interests (security and fraud prevention), consent (optional MYTE improvements, Google OAuth, experimental research, certain cookies), and legal obligations, where applicable. Optional use of Customer Content to improve MYTE requires separate, explicit permission.

Sharing and Disclosure

We share data with service providers acting on our behalf to operate the platform (e.g., AWS, MongoDB Atlas, Stripe, and Google), integrations you enable, and as required by law or for business transfers. OpenAI processes content needed for AI-assisted features under the provider controls described above. We also share workspace content with collaborators or experts you invite or authorize in your organization. International transfers use appropriate safeguards.

Cross-Border Transfers

Your data may be transferred outside Quebec and Canada. We use safeguards such as standard contractual clauses, supplier due diligence, and access controls to help ensure comparable protection. You can contact us for details on these measures.

Retention

We retain your intent, mission-board content, project context, messages, files, outputs, decisions, and evidence so we can display them to you and authorized collaborators, continue the work, and operate the service. We also retain records for security, accounting, and legal obligations. Provider-held data follows the applicable provider's retention controls, which can differ from MYTE's.

Exporting Your Work and Deleting Your Account

Your content remains yours. Use the available download and export tools to take your work elsewhere. For a copy not covered by those tools, contact info@mytegroup.com. We check your identity and authority over the requested data; an export must respect other people's rights and organization permissions. There is not currently one self-service export for every data type.

You can request account deletion through account settings or contact us for help. The current deletion process removes your active account and related content such as eligible proposals, chats, and profile records, but does not erase every record. Account and contact archives, transaction, billing, and usage records can remain, as can project or organization work not covered by that deletion process.

Shared-organization accounts may be blocked from self-service deletion until access and business continuity are handled through the organization's controls or with our help. Deleting an account is not the same as deleting an organization or all its shared work. Contact us for a deletion request covering retained records; we will explain the applicable scope and limits. Export what you need before deletion. Copies already held by collaborators or external services are not automatically erased by closing your MYTE account.

Confidentiality Incidents (Quebec Law 25)

If a confidentiality incident presents a risk of serious harm, we will notify affected users and the Commission d'accès à l'information (CAI) as required. We maintain a log of incidents in line with Quebec law.

Your Choices and Rights

Access, correction, deletion, portability, restriction/objection where applicable.
Decline optional sharing of Customer Content for MYTE improvements, or withdraw that permission by contacting support, without losing access to the core service.
Quebec users may request cessation of dissemination or de-indexing where the law applies. You may withdraw consent where processing is based on consent.
Manage cookies via browser or available in-app controls.
Contact: info@mytegroup.com

AI-Assisted Operating-Model Delivery

MYTE uses AI to accelerate bounded tasks such as transcription, retrieval, extraction, comparison, drafting, and code reasoning while people retain authority over consequential delivery decisions. Provider processing follows the disclosures above. MYTE's governed workflows, deterministic controls, builders, and experts connect those inferences to review, approval, implementation, and evidence. We may develop in-house heuristics, workflows, and routing strategies to make inference more reliable, but we do not develop proprietary foundation models using your Customer Content. We do not publish your raw workspace content. We may generate aggregated statistics from operational metadata for reliability and security; this does not authorize reuse of your Customer Content. Optional contributions follow the separate permission process described above.

You may write code by hand or use coding agents of your choice with context you are authorized to export. The MYTE framework is intended to keep the same requirements, rules, approvals, and evidence connected to the work across tools. External agents have their own terms and data practices; compatibility and adherence to your rules must be checked, not assumed. Exporting context does not automatically enforce MYTE's controls inside another tool.

Security

We use technical and organizational measures (e.g., encryption in transit, access controls, monitoring). No method is 100% secure.

Children

Not intended for anyone under 18. By using MYTE you confirm you are at least 18 years old. If we learn we collected personal data from someone under 18, we will delete it.

Changes

We may update this policy and will adjust the effective date. Material changes will be notified.

Contact

Myte Group Inc (MYTE) - info@mytegroup.com

MYTE is a trademark of Myte Group Inc. Myte Group is a trademark of Myte Group Inc in Canada.

Privacy Officer (Quebec)

Privacy officer for Quebec and Canada: info@mytegroup.com. Contact this address for privacy rights requests or questions.