Privacy Policy

This policy explains what personal data Mellonbot collects, why, who we share it with and what your rights are.

1. Who is responsible

The controller of your personal data is Individual Entrepreneur Anastas Vartanyan Avetisi, registration number 282.1209172, TIN 26589075, 16 Nelson Stepanyan St., Apt. 13, Nor Nork, Yerevan 0062, Armenia. Contact us through the contact page or at support@mellonbot.app.

2. What we collect

• Account data: your email address, name, the profile picture you upload, your password (stored only as a secure hash) or the ID of the Google or GitHub account you sign in with, two-factor authentication secrets and recovery codes, and your accessibility preferences.
• Workspace data: workspace names and images, members, the email addresses of people you invite, roles, settings and notifications.
• Server data: what the agent sends to diagnose problems — system metrics, service status, short log excerpts and the output of checks and fixes. Passwords and secrets the agent detects are filtered out before anything is sent. When this data includes other people's personal data, such as visitors' IP addresses in logs, we process it on your behalf as processor, as our Terms of Service describe.
• Billing data: your plan, credits and usage, and the customer, subscription and order references from Polar, our merchant of record. Polar collects and stores your payment details; we never see your card number.
• Security data: sign-in sessions with IP address and browser, one-time verification and reset codes, and an activity log of actions you take, including IP address and browser. We include the IP address and browser in new sign-in alert emails.
• Website forms: what you send through the contact form, plus how you found us (referring site and campaign tags).

3. Why we use it

• To provide Mellonbot: run your account, workspaces, checks and fixes (contract).
• To bill you through Polar, our merchant of record, and keep records the law requires (contract, legal obligation).
• To keep Mellonbot secure and prevent abuse, such as farming Free workspaces (legitimate interest).
• To answer your messages (legitimate interest).
• To improve Mellonbot using aggregated, anonymised statistics (legitimate interest). We will only use your data to train our own models if you opt in.

We don't sell your data and we don't use it for advertising.

4. Who we share it with

We use these providers (subprocessors) to run Mellonbot. Except where noted, they process data only on our instructions:

• DigitalOcean — hosting for the API, database and file storage.
• Vercel — hosting for the website and dashboard.
• MongoDB Atlas — database for website content and forms.
• xAI — AI analysis of server problems with its Grok models. We send only what the analysis needs.
• Polar Software, Inc. — payments, tax, invoices and the billing portal. As merchant of record it processes your payment details as an independent controller under its own privacy policy, which is linked at checkout; it uses Stripe to process cards.
• Resend — sending emails.
• Google and GitHub — signing in, if you choose them.

We will tell you about new subprocessors before they start processing your data.

We may also share data when the law requires it.

5. International transfers

Our providers may process data outside Armenia and outside your country, including in the United States and the European Union. Where needed, we rely on standard contractual clauses or equivalent safeguards.

6. How long we keep it

• Account and workspace data: while your account exists. Deleting your account deletes it, apart from what we must keep by law.
• Data from a removed server: deleted within 30 days.
• Sign-in sessions: until you sign out or they expire. Verification and reset codes: until used or expired.
• Activity log: 7 days.
• Billing records: as long as tax and accounting law requires.
• Contact messages and earlier sign-up requests: until we've answered you, at most 24 months.

7. Your rights

You can access, correct, export or delete your data, object to or restrict how we use it, and withdraw consent at any time. You can edit and delete your account yourself in the dashboard; for anything else, contact us and we will reply within 30 days. You can also complain to the Personal Data Protection Agency of the Republic of Armenia or to the data protection authority where you live.

8. Cookies

We use only the cookies Mellonbot needs to work: a sign-in session cookie for the dashboard and a cookie that remembers your light or dark theme. The website remembers how you found us (referring site and campaign tags) in the open page only, to send it with a form you submit; nothing is stored on your device. We don't use advertising or tracking cookies. Polar's checkout and billing portal may set their own cookies; see Polar's privacy policy.

9. Children

Mellonbot is not meant for anyone under 18, and we don't knowingly collect their data. If you think a child has given us personal data, contact us and we will delete it.

10. Changes

We will post updates to this policy here and tell you about important changes by email or in the dashboard.