01. Introduction
At Mivlet, we take your privacy seriously. This policy explains how we collect, use, protect, and manage your information when you use our platform, including our AI widget builder, embedding runtimes, SDKs, and workspace administration tools.
By accessing Mivlet, creating a workspace, or embedding our chat widget on your web properties, you acknowledge that you have read and understood the data practices described in this document.
02. Information We Collect
We only collect what we need to make Mivlet work better for you. We never collect speculative personal telemetry or monetize user information.
Account information
Name, email address, password hash, and profile details you provide when creating an account or joining a workspace.
Usage Information
How you use Mivlet, including features, preferences, widget customization settings, and operational interactions.
Strict AI Training Boundaries
Zero Foundation Model Training: We explicitly guarantee that your customer conversations, private uploaded knowledge documents, and proprietary workflow data are never used to train public third-party foundation models (such as those from OpenAI, Anthropic, or Meta). Your context remains exclusively yours.
Uploaded Knowledge Sources: When you connect documentation, website URLs, or text snippets into Mivlet Knowledge, those contents are converted into private vector embeddings stored securely in isolated tenant partitions.
03. How We Use Information
We use collected information solely for legitimate operational and platform delivery purposes:
- AI Response Generation: Retrieving relevant context from your knowledge base to accurately answer visitor queries in real-time.
- Widget Customization: Storing brand themes, colors, launcher avatar positions, and custom widget behaviors across your domains.
- Workspace Collaboration: Enabling multi-user team access, role-based permission validation, and team audit logs.
- Security & Anomaly Defense: Rate-limiting abusive IP addresses, detecting brute-force intrusions, and preserving immutable audit records.
- Billing & Account Maintenance: Processing subscription limits, usage tier allocations, and invoice notifications.
04. Data Sharing & Subprocessors
We do not sell, rent, or trade your personal data. We only share information with trusted infrastructure subprocessors under strict enterprise data protection agreements:
| Subprocessor | Purpose | Location | Data Protection |
|---|---|---|---|
| Supabase / AWS | Relational database, auth credentials, vector embeddings | US / EU Regions | AES-256 encryption at rest, SOC 2 Type II |
| Inference Gateways | Real-time generative LLM token completion | US / Global Edge | Zero-data-retention enterprise API SLAs |
| Cloudflare | Edge routing, CDN delivery, DDoS defense | Global Edge | TLS 1.3 encryption, ISO 27001 |
In the event of a lawful court order or government subpoena, we will only disclose data if legally required and will notify you unless prohibited by law.
05. Data Security
Security is foundational to Mivlet. We implement defense-in-depth protocols across every layer of the platform:
Cryptographic & Architectural Safeguards
• Encryption at Rest: All database stores, vector spaces, and user records are encrypted with AES-256.
• Encryption in Transit: All HTTP communications and widget streams mandate TLS 1.3 encryption.
• Append-Only Audit Logs: Sensitive team actions and permission modifications are recorded in immutable audit tables.
• Tenant Isolation: Workspaces are strictly separated by unique workspace UUIDs preventing cross-tenant leakage.
06. Your Rights
Regardless of your geographic location, we extend full GDPR and CCPA/CPRA rights to all Mivlet workspace creators and collaborators:
- Right to Access: You can inspect and review all personal and workspace records stored on our servers.
- Right to Data Portability: Export your knowledge files, conversation logs, and team audit logs into structured CSV or JSON formats at any time.
- Right to Rectification: Edit and update your personal profile, email, or team assignments directly from workspace settings.
- Right to Erasure ("Right to be Forgotten"): Request complete purging of your account, widgets, and vector databases with permanent deletion within 30 days.
- Non-Discrimination: We never degrade service quality or withhold features if you exercise your privacy rights.
07. Cookies & Tracking
Mivlet does not use cross-site advertising or third-party behavioral cookies. We use only essential and functional storage tokens:
• Authentication Cookies: Secure session cookies (HTTPOnly, SameSite=Lax) to keep you logged in.
• Active Workspace Memory: Preserving your active workspace slug and preference states across dashboard tabs.
• Widget Client Session: Temporary local storage in the embedded widget to maintain visitor chat continuity during active sessions.
08. Children's Privacy
Mivlet is an enterprise SaaS application intended for business owners, developers, and team administrators. We do not knowingly collect or solicit personal information from individuals under 16 years of age. If we learn that personal data of a child has been collected, we will take immediate steps to delete such data from our systems.
09. Changes to This Policy
We may update this Privacy Policy from time to time to reflect evolving regulatory frameworks or platform capabilities. When changes are made, we will revise the "Last updated" date at the top of this page. For material updates, we will notify workspace owners via dashboard alerts or direct email notifications at least thirty (30) days prior to the effective date.
10. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact our Data Protection Team:
Mivlet Data Protection Office
Email: [email protected]
Support Desk: [email protected]
Entity: Mivlet Inc., Privacy & Legal Compliance Division
Response Window: We acknowledge all privacy inquiries within 48 business hours.