Privacy Policy

Effective date: 2026-09-27

MYTE is a platform and managed service provided by Myte Group Inc for designing, building, and operating governed custom operating models. It connects business context, rules, workflows, evidence, communications, and software delivery. To provide and improve the service, we process personal data and the content you choose to share.

Data Use Summary

AI-assisted processing: MYTE uses AI as an accelerant within human-governed delivery. When a feature uses the OpenAI API, Customer Content is sent through Myte-controlled API projects configured for Zero Data Retention (ZDR) and through ZDR-eligible endpoints.
MYTE-managed records: we retain inputs, outputs, decisions, approvals, and delivery evidence on systems operated by MYTE or by service providers acting on our behalf only as needed to deliver, secure, and govern the service.
Collaboration: if you invite builders, experts, or other collaborators, they can access the workspace content you share with them so they can pick up work across ideation, delivery, and maintenance.
Limits: AI outputs are non-deterministic and bound by context window size ("memory").
Operational logging: we log minimal security and reliability metadata (e.g., auth errors, rate-limit events, timestamps) to prevent abuse and operate the service. We do not run marketing analytics or behavioral tracking.

Scope

This policy applies to mytecody.com, subdomains, the MYTE web app, related APIs and services, and communications with us.

Language and Quebec Notice

This policy is available in English and French to meet Quebec requirements. If you reside in Quebec, the laws of Quebec apply alongside applicable Canadian federal law.

Information We Collect

Account data: name, email, organization, preferences, authentication data.
Authentication and device trust data: passkey/public-key credential metadata, optional device labels, trusted-device hashes/status, login timestamps, and security events. Your device handles biometric or PIN verification locally; we do not receive or store raw biometric templates, fingerprints, face scans, or device PINs.
Customer content: information you upload, enter, record, or connect (e.g., notes, proposals, messages, audio for transcription) and related metadata.
Integrations: data from services you connect (e.g., GitHub metadata and files as configured), Stripe billing metadata, Google OAuth profile.
Operational and security data: service logs, diagnostics, timestamps, and rate-limit/security events needed to operate the service.
Payments: processed by Stripe; we receive limited records (e.g., customer ID, status, amounts).
API keys and telemetry: project API key prefix/fingerprint, usage counts, last used time/IP, rate-limit events (6 requests/hour/key), and audit entries tied to key metadata (not the raw key, which is only shown once on creation).
Cookies: session, authentication, preference, and security cookies.

Speech and Audio Capture

Audio uploaded for transcription (e.g., proposal intake) is processed through our speech pipeline (16 kHz mono WAV, ~0.8–12s). We may forward the audio to OpenAI through our ZDR-configured API project to return a transcript. MYTE may retain short-lived copies on MYTE-managed systems for reliability and security. Recording can run in a web worker or ScriptProcessor fallback, and transfers may be rate limited.

OpenAI Zero Data Retention and Human-Governed Delivery

When MYTE invokes OpenAI, we use Myte-controlled API projects approved and configured for Zero Data Retention (ZDR), together with ZDR-eligible endpoints. Under OpenAI's ZDR controls, Customer Content is excluded from abuse-monitoring logs, and OpenAI does not retain prompts or model responses after the request is processed. We do not opt Customer Content into model training. OpenAI's current endpoint eligibility and limitations are described in its data-control documentation.

ZDR governs Customer Content sent to OpenAI; it does not mean that MYTE keeps no delivery record. To provide a human-governed service, MYTE may retain prompts, source context, model outputs, decisions, approvals, audit evidence, and related metadata on MYTE-managed systems, subject to access controls, retention schedules, and your rights. OpenAI may retain system data that is not Customer Content, such as account, usage, billing, or support records. If an AI feature cannot meet this ZDR boundary, we will not send Customer Content through that feature without an updated disclosure and appropriate authorization.

Retrieval, Snapshots, and Embeddings

When you enable retrieval, we may store repository/project content, embeddings, and snapshot metadata to build context bundles for answers. Retrieval context can become stale; you can remove source data to remove future use in answers. We do not train proprietary foundation models on your Customer Content.

Project API Keys

Project-scoped API keys (e.g., for the Project Assistant) are tied to a single project with one active key at a time. Raw keys are shown once; we store hashed prefixes/fingerprints and usage telemetry (usage counts, last_used_at/IP, rate-limit events). Abuse events may be logged with key metadata for security and fraud prevention.

Secrets Service

The internal Secrets Service stores secret values in MongoDB encrypted with AES-GCM using an envelope key file mounted at runtime. Access is limited to authorized requests; audit trails are retained for sensitive actions. Secret values are not sent to model training and are decrypted only to fulfill explicit operations you invoke.

Integrations and Billing

If you connect third parties (e.g., GitHub, Google OAuth) we access the scopes you grant to deliver features (such as repository metadata/files or profile data). Billing is processed by Stripe; we receive customer/profile IDs, payment method metadata, invoices, portal session IDs, and webhook events to operate subscriptions, wallet balances, and refunds.

How We Use Information

Provide and secure the services.
Maintain and improve quality, reliability, performance, and safety.
Compliance and enforcement (security, fraud prevention, lawful requests).
Service communications (updates, onboarding, invoices, security notices).

Lawful Bases

Contract (to provide the service), legitimate interests (improvement, security, fraud prevention), consent (Google OAuth, experimental research, certain cookies), and legal obligations.

Sharing and Disclosure

We share data with service providers acting on our behalf to operate the platform (e.g., AWS, MongoDB Atlas, Stripe, and Google), integrations you enable, and as required by law or for business transfers. Customer Content sent to OpenAI is disclosed only for transient processing through the ZDR boundary described above. We also share workspace content with collaborators or experts you invite or authorize in your organization. International transfers use appropriate safeguards.

Cross-Border Transfers

Your data may be transferred outside Quebec and Canada. We use safeguards such as standard contractual clauses, supplier due diligence, and access controls to help ensure comparable protection. You can contact us for details on these measures.

Retention

OpenAI does not retain Customer Content processed through the ZDR-eligible API boundary described above. MYTE retains personal data on MYTE-managed systems only as long as needed to provide the services and for legitimate business purposes (security, legal, accounting, and accountable delivery). Examples include short-term audio uploads for reliability and security; retrieval embeddings and snapshots while a project is active; prompts, outputs, approvals, and delivery evidence needed to continue and audit the work; API key telemetry for rate-limiting and security; and billing records required by law. You can request deletion, subject to legal and operational limits.

Confidentiality Incidents (Quebec Law 25)

If a confidentiality incident presents a risk of serious harm, we will notify affected users and the Commission d'accès à l'information (CAI) as required. We maintain a log of incidents in line with Quebec law.

Your Choices and Rights

Access, correction, deletion, portability, restriction/objection where applicable.
Request that we limit use of your Customer Content beyond running the features you invoke by contacting support; some functionality or diagnostics may be reduced.
Quebec users may request cessation of dissemination or de-indexing where the law applies. You may withdraw consent where processing is based on consent.
Manage cookies via browser or available in-app controls.
Contact: info@mytegroup.com

AI-Assisted Operating-Model Delivery

MYTE uses AI to accelerate bounded tasks such as transcription, retrieval, extraction, comparison, drafting, and code reasoning while people retain authority over consequential delivery decisions. Prompts and context sent to OpenAI follow the ZDR boundary described above. MYTE's governed workflows, deterministic controls, builders, and experts connect those inferences to review, approval, implementation, and evidence. We may develop in-house heuristics, workflows, and routing strategies to make inference more reliable, but we do not develop proprietary foundation models using your Customer Content. You can export your work and delete your workspace data subject to legal and operational limits. We do not publish your raw private content. We may generate aggregated or de-identified statistics.

Security

We use technical and organizational measures (e.g., encryption in transit, access controls, monitoring). No method is 100% secure.

Children

Not intended for anyone under 18. By using MYTE you confirm you are at least 18 years old. If we learn we collected personal data from someone under 18, we will delete it.

Changes

We may update this policy and will adjust the effective date. Material changes will be notified.

Contact

Myte Group Inc (MYTE) - info@mytegroup.com

MYTE is a trademark of Myte Group Inc. Myte Group is a trademark of Myte Group Inc in Canada.

Privacy Officer (Quebec)

Privacy officer for Quebec and Canada: info@mytegroup.com. Contact this address for privacy rights requests or questions.