Privacy Policy

Mneia is operated by Saad Kadri, trading as Mneia, a sole proprietorship established in California, United States. Where this policy says "we", "us", or "Mneia", it means that person and that business. Where it says "you", it means whoever is reading: a visitor to this website, someone on the waitlist, or a user of the Service.

For anything in this policy, including exercising a right described below, write to privacy@mneia.dev. We answer from a monitored mailbox, not an autoresponder.

We do not currently have an establishment in the EU or the UK. If we begin offering the Service to people in the EEA or the UK at a scale that requires a representative under Article 27 of the GDPR or the UK GDPR, we will appoint one and name them here before that processing begins.

This policy covers three different things. All three are live, and it is worth separating them, because what we hold differs sharply between them.

The Service is open, and you can create an account without an invitation. If you are on the waitlist and have not signed up, the only personal data we hold about you is the work email address you gave it, plus the technical diagnostics described in section 4. Once you have an account, sections 5 onward describe what we hold in the present tense: your identity, the details you gave us about yourself and your company, and whatever you put into your workspace.

This policy does not cover third-party websites we link to, or the AI coding tools you use Mneia alongside. Claude Code, Cursor, Codex, and the rest each have their own policies and their own relationship with you.

Data protection law distinguishes between deciding why data is processed and merely processing it on someone else’s instructions. We do both, in different places, and your rights differ depending on which applies.

If you use Mneia through an employer or a team, that organisation is the controller of everything you put into it. It decides what is captured, who can see it, and when it is deleted. We will not hand your workspace content to you against your organisation’s instructions, and we will not withhold it from your organisation on yours. If you want your content deleted and your organisation says otherwise, that is a conversation to have with them.

Where we act as a processor, a Data Processing Addendum forms part of our agreement with your organisation and governs that processing. It incorporates the Standard Contractual Clauses where they are required.

This website sets no cookies at all today, and loads no analytics or advertising tags. Not Google Analytics, not Google Ads, not the Meta Pixel. There is no session recording, no data broker relationship, and nothing is written to your browser by us when you read these pages.

If that changes, you will be asked before anything is set. The consent controls are already built and already refuse by default: in the EEA, the UK, and Switzerland no tag would load until you accept, and elsewhere you could turn them off from the Cookie Policy link in the footer. The Cookie Policy lists what would be set, and says plainly that none of it is set today.

Three other things happen when you use this site.

The waitlist. If you submit the form, we receive the work email address you typed. We use it for one thing: telling you that access has opened. We do not sell it, rent it, share it for anyone else’s marketing, or add you to a newsletter you did not ask for. Every message we send will let you unsubscribe in one click, as the CAN-SPAM Act requires, and unsubscribing removes the address rather than merely suppressing it.

Error reporting. When something breaks on this site, our error reporting sends us a diagnostic report. That report includes your IP address, operating system name and version, browser name and version, device characteristics, the page you were on, and a technical stack trace. It is processed by Sentry on our behalf and used only to find and fix the fault.

An IP address is personal data in the EEA, the UK, India, and California. We collect it because a crash you cannot reproduce is a crash we cannot fix. If you would rather we did not, write to us and we will suppress IP collection for reports we can identify as yours.

Mneia is a hosted service. There is no local database and no offline mode; every surface is an authenticated client against one hosted API and one Postgres database. Your content is on our servers by design, not by accident, and you should decide whether that is acceptable to you before you put anything in it.

Context items are the sensitive part, and we will not pretend otherwise. A decision captured from an engineering session can contain architecture, credentials someone pasted carelessly, commercial terms, personnel matters, or anything else that was said while the work was being done. Mneia captures what your agent session produced. It cannot know in advance what that will contain.

You control this through scope. Every item carries a visibility scope (private to the person who asserted it, project, team, workspace, or an explicit grant list), and scope is enforced at the API, not in the client. Choose it deliberately.

Checkpointing sends your content to a large language model. When you checkpoint, the relevant portion of your session is sent to OpenAI, L.L.C., under our commercial account, to extract structured items. If OpenAI is unavailable, the same call goes to Anthropic PBC instead, under our commercial account there. We pay for that call; you do not bring your own key. It is the only marginal cost in the product, which is why it is the only thing we meter.

Two things are removed before your session leaves your machine. Tool output is truncated, and anything matching a credential - an API key, a password, a connection string, a private key - is replaced with a redaction marker. That scanning is best effort and not a guarantee: treat it as a second line of defence, not a reason to paste a secret into a session.

We also send the text of your context items to OpenAI to compute the embeddings that decide what a rehydration returns. Those calls carry the item text and nothing about who you are.

We do not train models on your content. Not on your context items, not on your rationale, not on your handoffs. Model improvement uses behavioural signals only: which items were shown, referenced, ignored, confirmed, edited, or rejected, and which side of a conflict a human chose. Those signals travel as identifiers and outcomes, not as the words you wrote.

That distinction is deliberate and we intend to keep it. If it ever changes, it will change by advance written notice and, where consent is the lawful basis, by asking you, not by an edit to this page.

Our agreements with OpenAI and with Anthropic both prohibit them from training their models on data submitted through our commercial accounts. We do not control either company’s own practices beyond those contracts, and their terms are worth reading if this matters to you.

Extraction is automated, but it does not decide anything about you. It produces suggestions you confirm, edit, or reject. No legal or similarly significant decision about any person is made by automated means, so the right to object to solely automated decision-making under Article 22 of the GDPR does not arise. If that ever changes, we will say so here first.

For people in the EEA and the UK, Article 6 of the GDPR requires a lawful basis for every purpose. Ours are set out below. Where the basis is legitimate interests, you can object; see section 12.

Where we act as a processor on your organisation’s behalf, the lawful basis is your organisation’s to establish, not ours.

We do not sell your personal information for money, and we never have. We have no data broker relationships to register.

We do not share it for cross-context behavioural advertising either. No advertising tag runs on this website, so no identifier and no browsing activity reaches Google, Meta, or anyone else for advertising. Under the CCPA as amended by the CPRA there is currently no “sharing” to disclose, and nothing that other US state statutes would call “targeted advertising”. If we ever start, this section will say so before it happens, and the Do Not Sell or Share My Personal Information link in the footer, rejecting advertising cookies, and Global Privacy Control will each stop it immediately without an account. Those controls are live now, and today they have nothing to switch off.

This applies to the website only. Content you put into the Service is never disclosed to any advertising platform, and neither is the waitlist.

We do use service providers to run the product. Each is bound by contract to process data only on our instructions and to standards no weaker than this policy.

We will give notice before adding a sub-processor that handles customer content, so that organisations with a Data Processing Addendum can object.

We may also disclose data where we are legally compelled to, to establish or defend legal claims, or to protect the rights and safety of people. Where the law permits us to tell you about a demand for your data, we will, before we comply. We will push back on requests that appear overbroad or defective.

If the business is acquired or its assets transferred, data may move with it. You will be told before that happens, and any acquirer remains bound by commitments made here until you are given notice and a genuine choice.

We are based in the United States and our infrastructure is in the United States. If you are outside it, using Mneia means your data is transferred there.

For transfers from the EEA, the UK, and Switzerland, we rely on the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum where the UK GDPR applies and the Swiss addendum where the revised FADP applies. Where a provider is certified under the EU-US Data Privacy Framework and its UK and Swiss extensions, we rely on that certification as well.

We assess the destination country’s law before relying on those clauses, and we apply encryption in transit and at rest as a supplementary measure. You can request a copy of the relevant clauses from us.

For transfers from India, we comply with the Digital Personal Data Protection Act, 2023 and will not transfer to any country the Central Government restricts. For Canada, Brazil, Australia, Japan, South Korea, and Nigeria, we rely on the contractual and consent mechanisms each of those regimes provides.

When you close an account we delete or irreversibly anonymise the associated personal data within 90 days, except where we must keep it to meet a legal obligation or to establish or defend a legal claim. Behavioural signals already separated from identity are not restored to identity in order to delete them; they are no longer personal data at that point.

• Encryption in transit (TLS) and at rest
• Access scoped and enforced at the API, never merely hidden in the client
• Authentication through a specialist provider rather than passwords we store ourselves
• Least-privilege access to production, limited to those who need it
• Secrets kept out of source control, with automated checks that they stay out

No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach affects your personal data, we will notify the relevant supervisory authority within 72 hours where the GDPR requires it, notify you without undue delay where the risk to you is high, and meet the six-hour reporting requirement of India’s CERT-In directions where they apply. State breach notification laws in the United States will be met on their own timetables.

If you have found a vulnerability, please tell us at security@mneia.dev. We will not pursue legal action against good-faith security research that respects user privacy and does not degrade the Service.

• Access: get a copy of the personal data we hold about you
• Rectification: have inaccurate data corrected
• Erasure: have data deleted where the grounds in Article 17 apply
• Restriction: have processing paused while a dispute is resolved
• Portability: receive data you gave us in a structured, machine-readable format
• Objection: object to processing based on legitimate interests, including profiling
• Withdraw consent: at any time, without affecting processing already carried out
• Complain: to your national supervisory authority, without coming to us first

Write to privacy@mneia.dev. We respond within one month, extendable by two further months for genuinely complex requests, and we will tell you if we extend. We do not charge for this, and we will not make you justify why you are asking.

If you are unhappy with our answer, you can complain to the supervisory authority where you live, work, or where you believe the problem occurred. In the UK that is the Information Commissioner’s Office. You do not need our permission and you do not need to exhaust our process first.

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents the rights below. We neither sell personal information nor share it for cross-context behavioural advertising, so today the right to opt out has nothing to act on. We keep the controls working anyway: use the Do Not Sell or Share My Personal Information link in the footer, or send Global Privacy Control, and we will record it as a valid opt-out without asking you to prove anything - so it is already in force if we ever do enable advertising.

• Know: what we collect, where it came from, why, and who we disclose it to
• Access: a copy, covering the preceding 12 months and beyond on request
• Delete: subject to the exceptions in the statute
• Correct: inaccurate personal information
• Opt out of sale or sharing: we do neither, so this is nothing to exercise
• Limit use of sensitive personal information: we do not use it for inferring characteristics
• Non-discrimination: exercising a right will never change your price or service

Make a request at privacy@mneia.dev. We confirm within 10 business days and answer within 45 days, extendable once by a further 45 where the request is complex. You may use an authorised agent; we will ask for proof of their authority and for you to verify your own identity.

Shine the Light. California Civil Code section 1798.83 lets residents ask about personal information disclosed to third parties for their direct marketing. We disclose none, and never have.

Sensitive personal information. We do not collect government identifiers, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, union membership, genetic or biometric data, or health or sex life data. Card details go directly to Stripe and never reach our servers.

Comprehensive privacy statutes are in force in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island. They differ in detail; we apply the most protective standard to everyone rather than sorting people by postcode.

Wherever you live in the United States, you may confirm whether we process your data, access it, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale, and profiling with legal or similarly significant effects. We do not conduct targeted advertising on this website, we do not sell personal information, and we do not profile in any way that produces legal or similarly significant effects.

If we refuse a request, you may appeal. Colorado, Connecticut, Virginia, Texas, Montana, Oregon, Delaware, New Jersey, Minnesota, Maryland, and others require an appeal route, and we offer it to everyone. Reply to our refusal and a person will reconsider it within 45 days. If we still refuse, we will tell you how to contact your state Attorney General.

Washington My Health My Data Act. We do not collect consumer health data as that statute defines it, and we do not sell it. Its definition is broad, so we monitor this rather than assuming.

Under the Digital Personal Data Protection Act, 2023 and the rules made under it, you are a Data Principal and we are a Data Fiduciary. You have the right to access a summary of your personal data and its processing, to correction and erasure, to nominate another person to exercise your rights if you die or become incapacitated, and to a grievance redressal process.

Our Grievance Officer can be reached at grievance@mneia.dev. We respond within the period the rules prescribe. If you are not satisfied, you may complain to the Data Protection Board of India.

Where we rely on your consent, our notice is available in English and we will provide it in any language listed in the Eighth Schedule to the Constitution on request. You may withdraw consent as easily as you gave it. We also comply with the Information Technology Act, 2000 and the SPDI Rules, 2011 in respect of sensitive personal data.

If your country grants you a right this policy does not mention, you still have it, and asking us for it is enough.

This website sets no cookies today. The Cookie Policy lists what would be set if we ever enable analytics or advertising, by name, purpose, and lifetime - and states plainly that none of it is set now. That policy is part of this one, and is where you change your choices.

Consent, if it ever becomes relevant. In the EEA, the UK, and Switzerland, the ePrivacy Directive and the UK PECR require your consent before a non-essential cookie is set. Our banner is built and defaults to refusing, so nothing would load until you answered, and rejecting would be one click in the same place and of the same prominence as accepting. Elsewhere such cookies would be on by default and you could withdraw at any time. None of this is running today, so you will not see a banner - asking permission for something we do not do would tell you something untrue.

Signing in to the Service, at app.mneia.dev, sets strictly necessary cookies for authentication and security. Those are exempt from consent requirements because without them you cannot stay logged in, and they cannot be switched off while you are using an account. They are set when you sign in, not when you read this website.

Sharing for advertising. There is none. No Meta Pixel and no Google Ads remarketing runs on this website, so no personal information is disclosed to either company, and there is nothing that the CCPA as amended by the CPRA would count as “sharing”. We do not sell personal information for money, we do not share the waitlist with anyone, and we do not upload waitlist addresses to any advertising platform. If that ever changes we will say so here first. The Do Not Sell or Share My Personal Information link in the footer works today, requires no account and no verification, and records your objection in advance.

Global Privacy Control. We honour the GPC browser signal as a valid opt-out of sale and sharing, as California and Colorado require. Today there is nothing for it to stop, because no tag loads for anyone. The handling is live rather than promised: when your browser sends GPC, advertising and analytics are treated as refused in every region, whether or not you have ever seen a banner - so it will already be in force if we ever do enable a tag.

Do Not Track. There is still no common standard for how sites should respond to DNT, so like most sites we do not respond to it differently. California law requires us to tell you that plainly, so we have.

Mneia is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16, and we do not permit under-16s to create accounts. If you believe a child has given us data, write to us and we will delete it. We comply with the Children’s Online Privacy Protection Act and, in India, with the DPDP Act’s requirement of verifiable parental consent for anyone under 18, which in practice means we do not offer the Service to them.

We will update this policy as the product changes. The date at the top always reflects the current version.

For material changes that reduce your protections or widen what we do with your data, we will give at least 30 days’ notice by email to account holders before they take effect, and where consent is the lawful basis we will ask again rather than assume. Continuing to use the Service after a change takes effect means you accept it; if you do not, you can close your account and export your data first.