Privacy Policy
1. Who we are
myrt.cloud (“we”) operates the myrt AI-native application platform. This policy explains what personal data we collect, why, how long we keep it, and the rights you have. It applies to myrt.cloud and its APIs.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data — email address, hashed password, account tier, signup/login timestamps. | Create and secure your account; authenticate; rate-limit password resets. | Contract; security. |
| Authentication tokens — signed session tokens (JWT-style). Passwords are stored only as salted hashes. | Keep you signed in. | Contract; security. |
| API keys — stored as hashes, never in plaintext. | Programmatic access to your tenant. | Contract. |
| Agent sessions & runs — prompts, tool calls and results, outputs, job definitions you create, and sandbox worker files. | Operate the Service you asked for (running your agents and jobs). | Contract. |
| Metering data — run counts, tool-call counts, cost estimates per run and tenant. | Billing, budget limits, abuse and fair-use enforcement. | Contract; legitimate interests. |
| License & billing records — license keys, tier, purchase timestamps. Card data is never handled by us; our Merchant of Record (Polar) processes payments. | Deliver paid features; accounting. | Contract; legal obligation. |
| Service logs — request logs including IP address, timestamps, errors, and security events. | Debugging, incident response, rate limiting, intrusion detection. | Legitimate interests; security; legal. |
| Emails we send you — transactional email (password resets, receipts via Polar, security notices) through an email provider. | Operate your account. | Contract; security. |
3. What we do not do
- We do not sell personal data.
- We do not use your prompts or Content to train models.
- We do not read passwords, plaintext card data (never touches our servers), or private keys you store for outbound model providers — those are stored as configured by you and used only to fulfil your requests.
4. Processors and sharing
We share data only with processors needed to run the Service:
- Polar (Merchant of Record) — payment, tax, refunds, receipts. Polar is the seller of record for paid plans; its privacy terms apply to payment data.
- Email delivery provider — transactional email delivery.
- Model providers you configure — your prompts/outputs are dispatched to the model endpoints your tenant uses, under those providers' terms.
- Infrastructure providers — the hosting and network providers that run the server.
We may also disclose data where required by law, or to protect rights and safety.
5. International transfers
The Service is hosted on servers in the United States. Processors may be located elsewhere. Where required, transfers rely on adequacy decisions or standard contractual clauses plus additional safeguards.
6. Retention
- Account data — until you delete your account or 30 days after your last login for dormant free accounts.
- Agent sessions and run outputs — until you delete them, or per your plan's retention window. Deleting a session deletes its outputs across active storage.
- Backups — rolling window (approximately 7–14 days). Deletions propagate to backups as cycles age out.
- Logs — operational logs are kept for a limited window (weeks, not years) for debugging and security.
- Billing records — retained as long as tax/accounting law requires.
7. Security
TLS is enforced on the public entry point; passwords and API keys are hashed; tokens are single-purpose (password-reset tokens are one-time use and expire in 1 hour); tenants are isolated at the data layer; agents run in sandboxed workers with restricted filesystem and network access; admin functions pass a role check. No system is perfectly secure — if a breach affects your data, we will notify affected accounts and the competent authorities per applicable law.
8. Your rights
Depending on your jurisdiction (e.g. GDPR, CCPA/CPRA, UK GDPR), you may have rights to: access; rectification; erasure (“delete my data”); restriction; portability (export your sessions and data in a machine-readable form); objection; and to complain to your supervisory authority. To exercise any right, email privacy@myrt.cloud from your account address. We respond within 30 days.
We do not knowingly process data of children under 16. If you believe a minor created an account, contact us and we will remove it.
9. Cookies and local storage
We use no advertising or tracking cookies. We use a single auth cookie/local token to keep you signed in, and a local preference (theme) in your browser's storage. No third-party analytics run on the console.
10. Changes
Material changes will be announced in-product (and by email for paid accounts) at least 14 days before they take effect. The effective date at the top always reflects the current version.