Privacy Policy

1. Who We Are

mykka.ai operates the Pretzel AI data loss prevention platform ("Pretzel", the "Service"). References to "mykka.ai", "we", "us", or "our" in this policy refer to mykka.ai and its Pretzel product. You can reach us at privacy@mykka.ai.

2. Data We Collect

We collect the following categories of data:

• ✓Account data. Name, email address, and organisation details collected when you sign up via Clerk (our identity provider).
• ✓Member data. Employee email addresses imported by your organisation administrator to enrol members in Pretzel policy enforcement.
• ✓Scan event data. When the Pretzel extension evaluates a prompt, we record: which rule matched, which AI site was used, which organisation member submitted the prompt, the action taken (warn/block/allow), and a timestamp. For rules configured to report matched content, a brief excerpt of the matched text may also be retained for audit purposes. Full prompt text is never transmitted to or stored on our servers.
• ✓Billing data. Payment is processed by Stripe. We store only Stripe customer and subscription reference IDs — no raw card numbers, CVVs, or expiry dates are stored by mykka.ai.
• ✓Usage and analytics data. Aggregate statistics about AI tool usage patterns within your organisation (e.g., which AI sites are used most, total scans per day). This data is linked to your organisation, not to individual employees in reports you do not explicitly request.
• ✓AI assistant inputs. If you use the AI Policy Assistant feature, your natural-language inputs to the assistant and the assistant's replies are stored to support conversation continuity. These inputs are also transmitted to your chosen LLM provider (see Section 4).
• ✓Error and diagnostic data. Anonymised application error logs are retained on our infrastructure to help us diagnose and fix issues.

3. How We Use Your Data

• — To provide and operate the Pretzel Service under your subscription contract.
• — To enforce the DLP policy rules your organisation administrator has configured.
• — To display analytics dashboards and audit logs to your organisation administrators.
• — To send transactional emails (e.g., subscription confirmations, policy alerts).
• — To improve the Service through aggregate, anonymised usage analysis.
• — To comply with legal obligations and respond to lawful requests.

We do not sell your data to third parties. We do not use employee scan data to train AI models.

4. Third-Party Processors (Sub-processors)

We share data with the following sub-processors as necessary to deliver the Service. All sub-processors are engaged under data processing agreements consistent with GDPR Article 28:

Enterprise customers may request a full sub-processor addendum as part of their DPA. Contact privacy@mykka.ai.

5. Data Retention

We retain data for as long as your organisation account is active and as needed to provide the Service. Specific retention periods:

• — Scan event records (audit log): retained for the period covered by your subscription plan (30 days on Solo, 30 days on Starter, 12 months on Business, configurable on Enterprise). Records are deleted or anonymised at the end of this window.
• — Account and member data: retained for the lifetime of your account. Deleted within 30 days of account closure.
• — AI assistant conversation history: retained for 90 days, then deleted.
• — Billing records: retained for 7 years to comply with accounting regulations.

6. Your Rights (GDPR & CCPA)

If you are located in the European Economic Area, United Kingdom, or California, you have the following rights regarding your personal data:

• — Access: request a copy of the personal data we hold about you.
• — Rectification: correct inaccurate data.
• — Erasure: request deletion of your personal data (subject to legal retention obligations).
• — Restriction: request that we limit processing of your data.
• — Portability: receive your data in a structured, machine-readable format.
• — Objection: object to processing based on legitimate interests.

To exercise any of these rights, email privacy@mykka.ai. We will respond within 30 days.

7. Data Transfers

mykka.ai infrastructure is hosted via third-party sub-processors including Fly.io (backend compute), Neon (database), and Vercel (frontend delivery), which operate primarily in the United States. Some additional sub-processors (Clerk, Anthropic, OpenAI, Groq) also process data in the United States. Where international transfers occur, we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms under GDPR Chapter V.

8. Security

All data in transit is protected by TLS 1.3. Data at rest is encrypted with AES-256. Organisation tokens are hashed with bcrypt. We are working toward SOC 2 Type II certification (targeted Q3 2026). For our full security posture, see our Security & Trust page.

9. Cookies

The Pretzel marketing website (mykka.ai) uses functional cookies required for authentication and session management. We do not use third-party advertising or tracking cookies on the marketing website. The Pretzel Chrome extension does not set cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified to account administrators by email at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact Us

For privacy questions, data subject requests, or to request our Data Processing Agreement (DPA), contact: privacy@mykka.ai