Téarmaí, beartais agus fógraí.

Effective: October 31, 2026

This Privacy Notice explains how Mellovy handles personal data when you use Mellovy as an individual consumer. It describes the information we collect, why we use it, how long we keep it, and the choices and rights available to you.

1. Who is responsible for your personal data?

Mellovy AB, Swedish company registration number 559598-6257 and VAT number SE559598625701, Lyngavägen 15G, 305 64 Gullbrandstorp, Sweden, is the controller for the processing described in this notice. Contact us at [email protected]. Mellovy has not appointed a Data Protection Officer.

If an employer or another organization provides your Mellovy account, that organization may be the controller for content it asks Mellovy to process, and Mellovy may act as its processor under a separate data processing agreement. The organization's privacy information applies to that processing. This notice still covers Mellovy's own purposes, such as account administration, billing and service security.

2. Personal data we process

The information we process depends on the features and connections you use.

• Account and contact information: your name, email address, account settings and information needed to administer your account.
• Purchase and payment information: your subscription, payment status, billing information and payment events. Card details are handled by the payment provider and are not provided to Mellovy where that provider collects them directly.
• Use and technical information: the features you use, when you use them, plan and usage measurements, and records needed to administer usage limits and billing. These events may be associated with your account, organisation, workflow and time of use. We also process device and browser information, IP address, diagnostics, error reports, and service and security logs.
• Content and agent information: instructions, prompts, files, messages, feedback and other content you provide, together with AI-generated responses and information needed to run agents and workflows you request.
• Connected sources: information from email, calendar or other services that you choose to connect and authorize Mellovy to access. This information may include personal data about other people.
• Support communications: messages you send to us and the information needed to handle your request.
• Business and professional contact information: names, professional roles, company affiliations and publicly available business contact details for representatives of prospective or current business customers. We obtain this information from public company registers and annual reports, company websites, public job advertisements, public news and public procurement notices, business-information providers, HubSpot records and people or organisations who contact us.
• Website and form information: when you submit an email capture form, the email address you enter, the page name and URL, browser language, and the company domain derived from your email address.
• Waitlist application: the email address you enter, and any of these optional answers you choose to give: your role (chosen from a list, with a short detail if you chose “other”), the company you work for and its website (typed in), the operating systems you use (chosen from a list, with a short detail if you chose “other”), the first thing you want to try in Mellovy, and how you found us (an option, and a short detail if you chose “other” or “event”). You can leave all of them empty. If you accepted the analytics cookie category, the application also includes the domain of the website that linked you to mellovy.com and any campaign tags in the link, as described in the Cookie Notice.
• Website statistics: when you open a page on mellovy.com, our server records the page view. The record is labelled with the page address, the domain of the site that linked to it, any campaign tags in the link, the country Cloudflare derives from your IP address, and whether the page was the first one of the visit. The server reads this from the request your browser already sends to load the page, and uses no cookie and nothing stored on your device. It sends PostHog these labels as a page_served event, together with your IP address, your browser’s user agent, your time zone and the site’s host name. PostHog uses these only to compute a daily visitor ID, a hash made with a secret that changes every day, so the same visitor can be counted once per day. PostHog then deletes your IP address and user agent before it stores the event, and creates no person profile. Requests from automated programs, such as search engine crawlers and AI agents, are recognised by their user agent and sent to PostHog as an $http_log event with the address requested, the user agent and the IP address, so we can see which programs read the site.
• Cookies and similar technologies: information collected through cookies and similar technologies, if used, as described in our Cookie Notice.

Please provide information about another person only when it is needed for your use of Mellovy and you are entitled to provide it. Do not submit special category or other sensitive personal data unless a feature expressly supports it and you are entitled to use it.

3. Why we use personal data

Purpose	Legal basis
Create and administer your account, provide the service, and run features or agents you request.	Necessary to perform our contract with you (GDPR Article 6(1)(b)).
Measure work in Mellovy credits, apply the plan allowance and limits, and calculate any usage charges expressly accepted for your account. Metered work includes model input and output, cached input, tool invocations, evaluation and judge runs, and stored data.	Necessary to perform our contract with you (Article 6(1)(b)).
Process purchases, payments and refunds, and meet bookkeeping duties.	Contract performance (Article 6(1)(b)) and legal obligation (Article 6(1)(c)).
Operate, secure and troubleshoot the service, and prevent fraud or abuse.	Our legitimate interests in maintaining secure, reliable operations and preventing misuse (Article 6(1)(f)).
Answer support requests and send service communications.	Contract performance or our legitimate interests, depending on the communication (Articles 6(1)(b) and 6(1)(f)).
Identify relevant business organisations, manage prospective-customer records, and contact business representatives about Mellovy’s services.	Our legitimate interests in developing and maintaining business relationships and offering relevant services (Article 6(1)(f)). You may object to direct marketing at any time.
Receive and respond to an email capture form submission.	Steps taken at your request before a possible contract (Article 6(1)(b)) or our legitimate interests in responding to your request (Article 6(1)(f)), depending on the request.
Receive and review your waitlist application, decide the order in which we invite people, and send your invitation. A person reviews every application, and no decision is made solely by automated means.	Our legitimate interest in reviewing applications and deciding whom to invite first (Article 6(1)(f)). You can object to this at any time, as described in section 10.
Count page views and daily visitors on mellovy.com on our own server and in PostHog, without cookies, and see which automated programs read the site, as described under Website statistics in section 2.	Our legitimate interest in knowing which pages people read, how many people visit and how they find the site (Article 6(1)(f)). PostHog deletes your IP address and user agent when it has computed the daily visitor ID. You can object as described in section 10.
Count waitlist applications in PostHog with the application ID and the number of optional questions answered, without your email address or your answers.	Our legitimate interest in knowing how many people apply (Article 6(1)(f)).
Measure how the website is used with Google Analytics and PostHog, after you accept the analytics cookie category.	Your consent (Article 6(1)(a)).
Measure how the website is used before you answer the cookie banner and after you decline, with Google Analytics in consent mode with storage denied and with Cloudflare Web Analytics, without cookies.	Our legitimate interest in understanding how the site is used and how fast it loads (Article 6(1)(f)). You can object as described in section 10.
Understand which websites and campaigns bring people to the waitlist, using the attribution described in the Cookie Notice.	Your consent, given by accepting the analytics category in the cookie banner (Article 6(1)(a)). You can withdraw it at any time. If you withdraw it after applying, we delete your application, because our waitlist provider does not let us edit it, and you can apply again.

If you do not provide information needed to create an account, take payment, or operate a feature you request, we may be unable to provide that account or feature.

4. AI features and usage measurement

When you use an AI feature, we process your instructions and the content needed to generate a response or carry out the action you requested. The chat interface identifies when you are interacting with AI. We also process usage measurements to apply the plan allowance and limits shown before purchase. The app shows a weekly usage percentage as an indicator; it is not a cash amount or a fixed amount of work. The work available within a limit may vary with the model, context, files and tools used. Current usage and billing are available in the account at app.mellovy.com.

Mellovy uses several model providers to run AI-agent features and picks the model for each task. Today they are Anthropic, PBC; OpenAI Ireland Limited; Berget AI AB; and TypeSafe AI, Inc. Depending on the task and the tools you enable, a request may include your prompts and instructions, files or connected-source content, retrieved information, tool results, and earlier or generated outputs needed to complete the task. Mellovy does not include a direct Mellovy account ID, user ID or email address in a model request by default. Content you submit or connect may itself identify you or another person. Each provider may process this data in the locations described in the Data Processing Addendum and its linked terms.

5. Model training

Mellovy does not use your conversations or agent data to train or fine-tune models. Accepting the Terms does not opt you into model training, and the product has no setting for it today. If we ever offer one, it will be separate, voluntary and off by default, and we will update this notice before it opens.

6. Personal data about other people

If you connect email, calendar or another source, we may process information about people who do not have a Mellovy account. We use that information only to the extent needed for the feature you requested, secure operation and support. Where required, we provide those people with information under GDPR Article 14. We rely on an exception to that information duty only where its legal conditions are met and appropriate safeguards have been assessed.

7. Recipients and service providers

We disclose personal data to the service providers below only where the relevant website or product feature is used. A provider may process data in the locations stated below and through its own listed affiliates or subprocessors. The exact features enabled for your account appear in your service settings or order.

• Hetzner Online GmbH: hosting and server operations in the EU.
• HubSpot, Inc.: our CRM provider for business account and contact records and website email-capture submissions. The website email-capture form sends the email address entered, the email's company domain where available, preferred language, lead-status fields, and the page name and URL. It also sends the form's data-processing notice. This submission does not depend on whether you accept optional analytics or advertising cookies and does not include campaign identifiers. HubSpot tracking technologies are enabled only after the relevant cookie choice. The Mellovy HubSpot portal is hosted in HubSpot’s EU1 region (Germany). HubSpot affiliates may access data from the countries listed on its subprocessor page, including the United States and Singapore. HubSpot’s DPA describes its transfer terms, including the EU-U.S. Data Privacy Framework where available and Standard Contractual Clauses where required. HubSpot’s website tracking technologies are enabled only after you accept the relevant analytics or advertising cookie category.
• Google Ireland Limited: website analytics through Google Analytics 4 in Google’s consent mode. Before you answer the cookie banner, and if you decline, Google receives cookieless pings with the page you view, the referrer, your browser and device details, the time of the visit and your IP address, which Google uses to model visits and does not store as an identifier on your device. If you accept the analytics cookie category, Google also receives an online identifier stored in a cookie. Mellovy keeps Google signals and ad personalisation signals off. Google may transfer data to the United States and other countries where Google LLC and its subprocessors operate, under the Google Ads Data Processing Terms, including the EU-U.S. Data Privacy Framework where available and Standard Contractual Clauses where required.
• Stripe Payments Europe Limited and Stripe, Inc.: payment processing and payment fraud prevention if billing features are enabled. Stripe may transfer data to the United States and other countries where its affiliates and subprocessors operate. Its DPA and Data Transfers Addendum describe use of the EU-U.S. Data Privacy Framework where applicable and Standard Contractual Clauses as an alternative where required.
• Cloudflare, Inc.: content delivery, DNS and security where those features are enabled, and Cloudflare Web Analytics, which receives the page address, the referring site, your browser details and page loading times for every visit, without a cookie and without using your IP address to identify you. Its global network may process information at locations outside the EEA. Transfers are governed by the Cloudflare DPA and its applicable transfer safeguards, including Standard Contractual Clauses.
• WorkOS, Inc.: sign-in, organisation identity and our waitlist. When you apply to the waitlist, WorkOS stores your application: the email address, the optional answers listed under Waitlist application in section 2 and, if you accepted the relevant cookie category, the linking domain and campaign tags. WorkOS stores and accesses this data in the United States, and its subprocessors are located in the United States. Transfers from the EEA are governed by the Standard Contractual Clauses adopted by the European Commission, which are part of WorkOS's DPA. You can ask us for a copy of these safeguards at [email protected].
• Google Ireland Limited and Apple Distribution International Limited: sign-in providers, only if you choose Continue with Google or Continue with Apple. These buttons are not offered before launch. When they are, the provider confirms your email address to us through WorkOS. Mellovy receives no password, and the provider handles your sign-in under its own privacy terms.
• Anthropic, PBC: live AI-agent inference. Depending on the task and enabled tools, Anthropic may receive prompts and instructions, files, connected-source content, retrieved information, tool results, and earlier or generated outputs needed to complete the task. Mellovy does not include a direct account ID, user ID or email address in the request by default, but content may itself identify a person. Anthropic may process data in selected locations in the United States, Europe, Asia and Australia and stores data in the United States unless the parties agree otherwise. Its commercial terms and DPA include Standard Contractual Clauses for transfers where required.
• OpenAI Ireland Limited: live AI-agent inference. Depending on the task and enabled tools, OpenAI may receive the same prompts, instructions, files, connected-source content, retrieved information, tool results and outputs described for Anthropic above, and content may itself identify a person. OpenAI may process data in the United States and other locations where its affiliates and subprocessors operate. Its Data Processing Addendum includes Standard Contractual Clauses for transfers where required.
• Berget AI AB: live AI-agent inference on open models. Berget may receive the same categories of request content described above, and content may itself identify a person. Berget processes data in data centres within the EEA under its Data Processing Agreement.
• TypeSafe AI, Inc.: live AI-agent inference through its Jev decision model. TypeSafe may receive the prompts, state and other request content needed for the task, and content may itself identify a person. TypeSafe hosts its service in the United States. Its Data Processing Addendum covers transfers from the EEA with Standard Contractual Clauses and names its subprocessors.
• PostHog Inc.: product and website analytics, hosted in PostHog Cloud EU in Frankfurt, Germany. On mellovy.com it receives page views, clicks, text you copy from a page (never what you paste), errors, the site’s own console messages and session recordings in which all text and form input is masked, together with the page address, which can include campaign tags, device and browser details and an online identifier. When you enter your email address in the waitlist form, Mellovy’s server sends PostHog a waitlist_email_submitted event with whether the application was saved, together with the IP address and browser details described under Website statistics, never the email address itself. When you submit the waitlist form, Mellovy’s server sends PostHog a waitlist_details_submitted event with the ID of your waitlist application and the number of optional questions you answered (answered_count), whatever you chose in the cookie banner, so we can count every application. For every page opened on mellovy.com, the server also sends PostHog a page_served event with the labels, IP address and browser details described under Website statistics, whatever you chose in the cookie banner, and PostHog deletes the IP address and user agent once it has computed the daily visitor ID. If you accepted analytics, your browser also links its PostHog identifier to that application ID and sends how you found us (the option you chose) and the time you first submitted the form (waitlist_submitted_at), so we can see which visits lead to a signup. PostHog never receives your email address, your role, what you write about the first thing you want to try in Mellovy, or any detail you type about how you found us. Even in its cookieless mode, PostHog receives the address of each page you visit, including any campaign tags in it. Until you answer the cookie banner, and if you decline analytics, PostHog runs in its cookieless mode: PostHog’s script, which your browser loads and may keep in its cache, sends these events with your IP address and browser details, which PostHog uses only to compute the daily visitor ID described under Website statistics in section 2 and then deletes. PostHog sets no cookie, keeps no PostHog identifier in your browser and creates no person profile. Our legal basis for this cookieless counting is our legitimate interest in understanding how the site is used and finding errors (Article 6(1)(f)), and you can object to it at any time, as described in section 10. We start it before you answer the cookie banner and do not ask for your consent for it, and declining analytics does not stop it. Requests go through Mellovy’s own address t.mellovy.com. Prompts, files and connected-source content are not needed for analytics and are not intended to be sent as event properties. Its Data Processing Addendum governs the processing.
• Functional Software, Inc. (Sentry): error reporting, hosted in Sentry’s EU region in Germany. When something breaks in your browser, Sentry receives a report with the technical details of the failure. Mellovy turns off user information, cookies, request headers, request bodies and URL query strings in these reports and scrubs them before they are sent. Its Data Processing Addendum governs the processing.
• ClickHouse, Inc.: usage measurement, operational and diagnostic records sent to Mellovy’s data store. Records may include event details and identifiers; prompts and files are not needed for this function and are not intended to be stored there. If ClickHouse Cloud is used, the hosting region is selected for the service, while its published schedule also lists control-plane and support processing in the United States, Germany and Singapore. See ClickHouse’s DPA and subprocessor schedule.
• GitHub, Inc.: code repository and development collaboration. GitHub may receive repository content, source code, issues, pull requests, developer account information and technical logs. It is not used as the routine store for prompts or agent conversations. GitHub states that it processes personal data in multiple locations, including the United States and countries where its affiliates and subprocessors operate. See its privacy statement and subprocessor list.

The providers used for Customer Personal Data when Mellovy acts as a processor are also listed in the Data Processing Addendum. Information about browser storage and website technologies is in the Cookie Notice. We do not sell your personal data. We may disclose data to public authorities where required by law, or where needed to establish, exercise or defend legal claims.

8. International transfers

The provider information above identifies the countries or regions in which each provider may process personal data and links to its transfer terms. We transfer personal data outside the EU/EEA only where a transfer mechanism permitted by GDPR Chapter V applies. The specific mechanism and any required supplementary measures depend on the provider and feature used. You may request information about the mechanism applicable to your data by contacting [email protected]. You may also request a copy of the safeguards that apply to a provider.

9. How long we keep personal data

We apply the following retention criteria. We delete or anonymise personal data when the relevant purpose ends, unless a legal obligation, security investigation or legal claim requires limited retention for longer.

• Account and access information: while the account is active and as needed to close it, resolve outstanding payments and protect the service.
• Prompts, files, conversations, outputs and workflow data: while retained in your account or needed to complete the workflow you requested. We remove them when you delete them or close the account, subject to limited records needed for security, billing disputes or legal claims.
• Data retrieved from connected sources: while needed for the enabled feature. We stop retrieving it when you disconnect the source and remove stored copies when they are no longer needed for that feature or your account is closed.
• Usage, diagnostic and security records: while needed to measure and bill for use, operate and secure the service, and investigate a specific incident or dispute. Records retained for an incident or dispute are deleted when that purpose ends, unless law requires longer retention.
• Accounting records: for the statutory retention period applicable to the relevant record.
• Business and professional contact records: while needed to evaluate or maintain a relevant business relationship or sales request. We remove or suppress records when they are no longer relevant, when a person objects to direct marketing, or when the purpose ends. We retain only the minimum contact information needed to honour an objection and prevent further marketing.
• Website and form information: until we have handled your request and no further follow-up is needed, unless you enter a customer relationship, separately request further contact, or law requires retention.
• Waitlist applications: we delete your application 12 months after you applied or after our latest decision or contact with you about it, whichever is later. If you become a customer, your account information is then kept as described above. You can ask us to delete your application at any time.
• Website statistics and cookieless analytics: our server does not store the request. PostHog stores page_served events, and the events your browser sends before you answer the cookie banner or after you decline, without your IP address or user agent and with a visitor ID that is computed again with a new secret every day. Once that day’s secret is deleted, the events can no longer be linked to you, and we keep them as anonymous statistics for as long as they help us understand and improve the site.
• PostHog analytics after you accept analytics: events, the PostHog identifier they are linked to and masked session recordings are kept while we have an ongoing need to understand how the site is used, compare it over time and find errors. We delete them when that need ends or when you ask us to delete them, and we stop linking new events to you when you withdraw your consent.
• Requests from automated programs ($http_log): kept while we have an ongoing need to see which programs read the site and to protect it from misuse.
• Website analytics: Google Analytics keeps event-level data for two months, the retention period set for Mellovy’s Google Analytics property, and then deletes it. Your cookie choice itself is stored in your browser for 182 days (about six months).
• Records of notices, withdrawals, deletion requests and marketing opt-outs: only the information needed to show what choice was made and to honour it. We retain that evidence while it may reasonably be needed to demonstrate compliance, address a related claim or respond to a regulatory question, then delete or anonymise it.

Operational, usage and security records are kept only as long as needed for the relevant operational, billing, security or investigation purpose. Accounting records are kept for the applicable statutory period. Backups and provider copies are removed under the applicable deletion processes; where immediate deletion from a backup is not technically practicable, the data remains protected and is deleted through the ordinary backup cycle.

10. Your rights

Subject to the conditions in the GDPR, you may request access to, correction or deletion of your personal data, restriction of processing, or data portability where the GDPR grants that right. In particular, portability applies to data you provided that is processed by automated means on the basis of consent or contract. You may object to processing based on legitimate interests and withdraw consent at any time. Contact [email protected]. We may need to verify your identity before responding.

You may object at any time to the use of your personal data for direct marketing, including related profiling. After you object, we will stop using your data for that purpose.

You may complain to the Swedish Authority for Privacy Protection (IMY) at imy.se.

11. AI transparency

Mellovy uses AI for agent and content-generation features. The chat interface identifies when you interact with AI. Depending on the feature and the parties' roles, applicable law may require other notices or markings for AI-generated content. This notice does not replace any in-product notice or marking required by law.

12. Security and changes

We use technical and organizational measures appropriate to the risks, as required by GDPR Article 32. If we change our processing in a way that requires new information, we will update this notice and notify you where the law requires it. The current version is published at mellovy.com/legal.

13. Contact

Mellovy AB
Lyngavägen 15G
305 64 Gullbrandstorp, Sweden
[email protected]
[email protected]