Privacy Policy
Effective date: October 29, 2026
This Privacy Policy explains how YXES STUDIO LLC ("YXES," "we," "us," or "our") collects, uses, shares, and protects personal information through Mimarr (the "Service"). Words defined in our Terms of Service have the same meaning here.
In short: we collect what we need to run Mimarr, we do not sell personal information, we do not use your data for advertising, and we do not use your data to train AI models.
1. Information we collect
Information you give us
- Account information: name, work email, company name, job title or role, and password (stored only in hashed form).
- Customer Data: projects, tasks, comments, files, budgets, invoices, time entries, financial figures, pay rates and other compensation information, client and contact details, survey answers, and other content you or your team enter into the Service. This may include information about your employees, contractors, and clients.
- Client portal and guest information: names, email addresses, and comments of people your organization invites to the client portal or shares a task with, and the answers they give to surveys.
- Billing information (from January 1, 2027): your billing contact, your plan, your subscription status, and your invoice history. You enter your card or other payment details on Stripe's secure pages. Stripe handles and stores them, and we do not store your full card number.
- Communications: messages, support requests, and feedback you send us.
Information collected automatically
- Usage and device information: IP address, browser and device type, operating system, pages and features used, dates and times of access, and error logs. These are collected by our hosting, analytics, and error-monitoring providers.
- Security information: our registration page uses hCaptcha to block bots. hCaptcha may process your IP address and browser and device signals to confirm you are a person. If you turn on two-factor authentication, we store the data needed for it.
- Cookies: see section 6.
What we do not collect. We do not knowingly collect biometric identifiers or biometric information, precise geolocation, or government ID numbers. We do not store your full payment card number. Stripe handles payment details (see sections 1 and 4).
2. How we use information
We use personal information to:
- create and manage accounts and provide the Service, including sending the emails and notifications the Service is built to send
- generate AI Outputs you request, such as task suggestions and answers about your workspace
- process payments and manage subscriptions through Stripe, and send billing and renewal notices (from January 1, 2027)
- secure the Service, prevent fraud and abuse, and fix errors
- respond to support requests and send service and security notices
- understand how the Service is used and improve it, using aggregated or anonymized data where possible
- send product updates and announcements, which you can unsubscribe from at any time
- comply with legal obligations and enforce our Terms
We do not sell personal information. We do not share it for cross-context behavioral advertising or targeted advertising. We do not use Customer Data to train AI models.
3. AI processing
When you use AI features, the relevant Customer Data is sent to our AI provider, Groq, to produce AI Outputs for you.
- Task suggestions: the text you type, plus the names of the people on your team (or their email addresses if they have no name) and the names of the project's phases, so the AI can match them.
- Questions about your workspace: your question and, depending on what it asks, figures the app has already calculated. These can include project budgets and costs, team members' names, hourly rates, salary costs, hours logged, spare capacity this week, people the app flags as a retention risk, and client relationship ratings. What can be sent follows the asker's role: pay and financial figures only for administrators, and client information only for administrators and project leads.
We do not use Customer Data to train AI models. Groq processes this data under its own terms to provide the service. AI Outputs are generated automatically and may be inaccurate. We do not use them to make decisions about you that have legal or similarly significant effects.
4. How we share information
We share personal information only in these situations:
- Within your workspace: with other users your administrator has added, according to the roles and permissions your administrator sets.
- Service providers: with companies that process data for us to run the Service, as listed below.
- Services you connect: if you connect Slack, Microsoft Teams, webhooks, or API keys, data is sent to those destinations at your direction.
- Legal reasons: when required by law, subpoena, or court order, or to protect the rights, safety, or property of YXES STUDIO LLC, our users, or others.
- Business transfers: to a successor or buyer as part of a merger, acquisition, reorganization, financing, or sale of assets, subject to this Policy.
- With your consent or at your direction.
| Service provider | Purpose |
|---|---|
| Supabase | Database: stores account information and Customer Data |
| Render | Hosting for the Service's servers |
| Vercel | Hosting for the Service's website and web app |
| Groq | AI features |
| Resend | Sends account and service emails |
| Our email provider for product updates | Sends product updates and announcements |
| hCaptcha | Bot protection on the registration page |
| PostHog | Product usage analytics, only after you accept analytics cookies |
| Sentry | Error monitoring |
| ImageKit | Storage and delivery of uploaded files and images |
| Upstash | Short-lived queues and live updates |
| Stripe | Payment processing and subscription billing, from January 1, 2027. Stripe handles and stores payment details, and its own privacy policy applies to the information it handles |
5. Information about people entered by Customers
Customers may enter information about their own employees, contractors, clients, and other individuals into the Service. For that information, we act as a service provider and process it on the Customer's behalf and under its instructions. The Customer is responsible for giving any required notices and getting any required consents.
If you are a client portal user or someone who has been given a shared task link or a survey, the organization that invited you controls the information about your projects and your answers, and we provide the Service for it. If your information was entered by a Customer and you want to access, correct, or delete it, please contact that organization. We will help it respond.
6. Cookies and similar technologies
We use essential cookies to keep you signed in, protect the Service from cross-site request forgery, and remember your light or dark mode setting. These are required for the Service to work. Sign-in cookies last up to 30 minutes (access) and 7 days (refresh).
We use analytics cookies (PostHog) only after you accept them in the cookie banner. When you accept, we send PostHog an identifier for your account, your name, and your email address along with your usage. You can block or delete cookies in your browser settings, but parts of the Service may not work without essential cookies. Our Cookie Policy lists the cookies we use.
7. How long we keep information
| Information | How long we keep it |
|---|---|
| Account information and Customer Data | While your workspace is active. If an administrator deletes a workspace, it is hidden at once and can be restored for 30 days. After that it is permanently deleted from our active systems. |
| Backups | Held by our database provider on its own schedule. Deleted data may remain in backups until they are overwritten. |
| Logs, error reports, and records of emails the Service has sent | As long as reasonably needed for security, troubleshooting, and support. |
| Support communications | As long as needed to handle your request and keep a record of it. |
| Billing records | As long as tax, accounting, and legal rules require. |
We may keep information longer if the law requires it or to resolve disputes. Anonymized data that cannot identify you may be kept indefinitely.
8. Security
We use reasonable technical and organizational measures to protect personal information, including encryption in transit, hashed passwords, role-based access controls (including restricted projects), optional two-factor authentication, and bot protection. No system is completely secure, and we cannot guarantee absolute security. If a security breach affects your personal information, we will notify you as required by law, including the Illinois Personal Information Protection Act.
9. Your choices and rights
You can view and update your account information in your settings at any time. You can choose which notification emails you receive in your settings, except account and security emails, which we always send. Workspace administrators can export their workspace data at any time using the export tools in the Service.
You may also ask us to:
- give you access to or a copy of your personal information
- correct inaccurate personal information
- delete your personal information
- export your Customer Data in a portable format
- stop sending you marketing emails (you can also use the unsubscribe link in any marketing email)
To make a request, email support@mimarr.com. We may need to verify your identity before acting. We will respond within the time required by applicable law, and within 45 days in all cases. We will not discriminate against you for exercising these rights.
State privacy rights. Depending on where you live, state laws such as the California Consumer Privacy Act may give you additional rights, including the right to know what personal information we collect and to appeal a decision about your request. We honor these rights where the law applies to us. If we deny your request, you may appeal by replying to our decision, and we will respond within the time the law requires.
10. Children
The Service is for business use by adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.
11. Where data is stored
We are based in the United States. Our service providers may store and process information in the United States and in other countries where they operate. If you use the Service from outside the United States, you understand that your information will be transferred to and processed in the United States and possibly other countries, where privacy laws may differ from those in your country.
12. Changes to this Policy
We may update this Policy. For material changes, we will notify you by email or in the Service before they take effect. The effective date at the top shows when it was last updated.
13. Contact us
YXES STUDIO LLC
Privacy requests and support: support@mimarr.com
General questions: hello@mimarr.com