Privacy policy

1. Who is responsible

The controller for the data this policy describes is SAR-SOFT:

Name

SAR-SOFT

VAT number (ΑΦΜ)

—

Tax office (ΔΟΥ)

—

Address

—

Email

[email protected]

This policy covers this website (mitos.sar-soft.com), the Mitos app (app.sar-soft.com) and the MCP address (mcp.sar-soft.com).

When we read data from the sources a business customer connects (for example the customers of a Magento store), we act as a processor on behalf of that business, which is the controller. That processing is governed by the data processing terms, and the business's own privacy notice applies to its customers' data.

2. Account and organization data

• Your account: name, email address, a password stored only as a hash, and, if you turn them on, two-factor details (an encrypted secret and recovery codes) and your passkeys' public keys. Sign-in codes we send by email are valid for a few minutes.
• Your organization: its name, and optionally its website, business type, country, the markets it sells in and its timezone.
• Your team: who belongs to each organization, their roles, and pending invitations.
• Which AI apps you authorized, for which organization, and roughly when each was last used.
• The language you chose and your sign-in sessions, so you stay signed in.
• The saved instructions (skills) your organization sets for its AI apps.

3. Connection data

For each source you connect we keep the address of the site or store, the properties or site you chose and the site each property is used for, the email address of the Google account you signed in with (for Google sources), the connection's status and the results of its checks, and the credential that lets us read it: a Google authorization, the WordPress plugin's authorization or a Magento access token. Credentials are encrypted at rest, are never shown back to anyone, and are used only to provide the service.

4. Data from your sources

We read your sources only when an AI app you authorized asks, and only the sources and the properties or sites you chose. What we read is sent to that app. We do not store the analytics, search, order or content data itself, apart from short-lived technical caches that expire automatically. We do not record the questions asked or the data returned.

What we do keep:

• A short technical record of each request: which tool, which organization, how long it took and whether it failed, without its contents.
• Usage counts: each action is recorded as a usage event kept for 90 days; daily totals per organization are kept as a usage history.
• The activity history: who connected, disconnected, approved or changed what, and when, and the details of changes waiting for approval or approved. For WordPress changes the previous version is kept, so the change can be undone for 30 days.
• Files you upload from your device through the Mitos upload page, so your AI app can add them to your site, only for as long as that takes.
• Reference images for visual checks of your site: up to 50 per organization, deleted after 90 days.

Magento connections can include your customers' names, email addresses and order history, if you grant that access when you create the integration. WordPress connections never include a shop customer's name, email address, phone number or address, nor a commenter's email or IP address; they can include the names of your site's users and commenters and users' email addresses in shortened form. Google Analytics and Search Console do not include individual customer records.

5. Billing data

When you buy a subscription we keep your billing details (business or personal name, address, country, email for tax documents), your tax number and tax office or EU VAT number, the result and date of the VIES check, your plan and subscription status, and the invoices, receipts and credit notes we issued with their myDATA numbers.

You enter your card details on Stripe's page and only Stripe processes them. We never see or store your card number; we receive only limited information about the payment method, such as its type and last four digits.

6. Support messages

When you write to us by email or through the contact form, we process your name, email address, topic and message, and technical details of the submission (IP address, time) to protect against abuse.

7. This website

• Visit statistics. The website sets no cookies and loads no analytics unless you allow it. If you do, Google Analytics 4 measures the pages you view and interactions such as clicks on buttons and links, guide views and starting sign-up, together with device and browser details, the approximate location Google derives, and the campaign details in the link you arrived from. Advertising signals, remarketing and enhanced conversions are off. Your answer is stored in your browser. Details are on the cookies page.
• The “Start with your site” field. The address you type on the home page is sent to the app's sign-up page, so it can be prefilled there. The website does not store it and does not send it to Google Analytics. If you complete sign-up, it is stored with your account as your organization's website.
• Logs. Cloudflare and our servers process your IP address and the details of each request to serve pages and protect them from attacks.

8. Where a sign-up came from

If you sign up from a link that carries campaign details (utm_source, utm_medium, utm_campaign, utm_term, utm_content) or a referral code, we store them with your account, so we know which campaign or referral brought the sign-up.

If you had allowed visit statistics on this website before signing up, our server sends Google Analytics conversion events, such as completing sign-up, linked to the Google Analytics identifier in your browser, without your name or email address. If you had not allowed it, nothing is sent.

9. Purposes and legal bases

• Performance of a contract (Article 6(1)(b) GDPR): your account, organizations, connections, reading your sources when your AI app asks, approvals, billing your subscription, support, and the messages the service needs (email verification, sign-in codes, invitations, security alerts, trial reminders, tax documents).
• Legal obligation (Article 6(1)(c)): issuing tax documents and transmitting them to myDATA, keeping accounting and tax records for as long as Greek law requires, checking VAT numbers in VIES, and answering lawful requests from authorities.
• Legitimate interests (Article 6(1)(f)): keeping the service secure, preventing fraud and abuse, technical records and the activity history, enforcing our terms, knowing which campaign brought a sign-up, usage statistics without content, and product emails to customers, with an unsubscribe link in each.
• Consent (Article 6(1)(a)): the website's visit statistics and the conversion events our server sends to Google Analytics. You can withdraw it at any time, without affecting the lawfulness of processing before you withdrew.

Account details are needed to provide the service, and billing details are required by tax law; without them we cannot enter into the contract. We make no decisions based solely on automated processing that have legal or similarly significant effects on you.

10. Who receives data

• The processors that help us provide the service (hosting, email, payments, network, e-invoicing). They are listed on the subprocessors page.
• The AI app you authorized, which receives the answers to its questions. It is a recipient you choose, not our processor (see section 12).
• The providers of your sources (Google, your WordPress site, your Magento store) when we read them.
• AADE, the Greek tax authority, which receives tax documents by law.
• Courts or authorities where the law requires it, and a buyer of our business in the event of a transfer, under the same protections.

We do not sell personal data and do not use it for advertising.

11. Google user data

When you connect Google Analytics or Search Console, you sign in with Google and grant Mitos:

• Google Analytics: read-only access to your Analytics data (analytics.readonly), such as visitors, pages, traffic sources and events.
• Search Console: read-only access to Search Console data for your verified sites (webmasters.readonly), such as clicks, impressions, queries and pages.
• Your Google account's email address (openid, email), so you can see which account a connection uses. It gives access to no data.
• Only if an owner or admin allows changes to a Google Analytics source: permission to edit that Analytics account's configuration (analytics.edit). We use it only to create custom dimensions, custom metrics, key events and audiences in the properties chosen for that source, when an owner or admin asks. It is never requested for a read-only source.

How we use it. Only to answer questions that an AI app you connected to your organization asks, and only for the properties and sites you chose. We change nothing in your Google account unless an owner or admin allowed changes to that Analytics source, and then only the items listed above.

Who we share it with. The answer to each question is sent to the AI app that asked it, such as ChatGPT or Claude, because showing you that answer is the feature you connected it for. It is sent only at your request, through an app you authorized and can disconnect at any time. We do not share Google user data with anyone else, do not sell it, and do not use it for advertising.

No AI training. We do not use Google user data to develop, train or improve artificial intelligence or machine-learning models, and we do not allow it to be used for that on our behalf.

How we store and protect it. We keep only the Google authorization (a refresh token, encrypted at rest), the scopes you granted, your Google account's email address, and the names of the properties or sites that account can reach with the one you chose. We do not store the analytics or search data itself: it is read when a question is asked and passed straight to the AI app.

How long we keep it, and how to delete it. Until you disconnect the source, delete the organization or delete your account, which removes the stored authorization immediately. You can also remove the access Mitos has at any time from your Google Account at myaccount.google.com/permissions.

Mitos's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

12. AI apps

When you connect ChatGPT, Claude or another AI app, what it receives from us is covered by that app provider's own privacy policy (for example OpenAI or Anthropic). You can disconnect any AI app at any time from the AI access page, and it stops working within about a minute.

13. Transfers outside the EEA

Our servers and database are in the European Union. Some providers, such as Google, Stripe and Cloudflare, may also process data in the United States or in other countries outside the European Economic Area. Where they do, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework (for certified companies) or on the Commission's Standard Contractual Clauses (Decision (EU) 2021/914), with supplementary measures where needed. You can ask for more information at [email protected].

14. How long we keep data

• Account data: until you delete your account.
• Organization and connection data and credentials: until you disconnect the source or delete the organization; credentials are removed immediately.
• Usage events: 90 days. Daily totals per organization are kept as a usage history.
• Records of technical failures: 30 days.
• The activity history is kept when an account or organization is deleted, so past actions still have an author; a deleted account appears in it only as “Deleted user”.
• Backups: the most recent 14, replaced nightly, so deleted data leaves the backups within 14 days.
• Billing data and tax documents: as long as Greek tax law requires, as a rule five years from the end of the financial year they relate to, or longer where the law requires.
• Support messages: as long as needed to handle the request and its follow-up, and no longer than two years after it is closed.
• A sign-up's campaign and referral details: together with the account.
• Expired AI app tokens are deleted daily.
• The website's visit statistics: Google keeps event-level data for 14 months.

15. Your rights

You have the right to access your data, and to rectification, erasure, restriction of processing, portability and objection (Articles 15 to 21 GDPR), and you can object to product emails at any time. Where processing is based on consent, you can withdraw it at any time.

You can do much of this yourself: disconnect sources and AI apps, delete your organization (as its owner) or your account in Account settings, which erases your name, email, password, two-factor details and passkeys. For anything else write to [email protected]. We reply within one month (extendable by two months for complex requests) and may ask you to confirm your identity. Requests about data inside a business's sources are passed on to that business, which is the controller.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority or with the supervisory authority of the member state where you live or work.

16. Security

We encrypt connections (TLS) and stored credentials, isolate each organization, ask only for the permissions needed (read-only by default), offer two-factor authentication and passkeys, and keep encrypted backups, including off the server. Details are on the security page.

17. Children

Mitos is made for businesses and not for anyone under 18. We do not knowingly collect children's data; if you think we have, write to us and we will delete it.

18. Changes to this policy

When we change this policy, we update the date at the top of the page. For material changes we email account holders before they take effect.

19. Contact

For questions or requests about your data, write to [email protected] or use the contact page with the topic “Privacy”.