Privacy Policy

Mneia is operated by Saad Kadri, trading as Mneia, a sole proprietorship established in California, United States. Where this policy says "we", "us", or "Mneia", it means that person and that business. Where it says "you", it means whoever is reading: a visitor to this website, someone on the waitlist, or a user of the Service.

For anything in this policy, including exercising a right described below, write to privacy@mneia.dev. We answer from a monitored mailbox, not an autoresponder.

We do not currently have an establishment in the EU or the UK. If we begin offering the Service to people in the EEA or the UK at a scale that requires a representative under Article 27 of the GDPR or the UK GDPR, we will appoint one and name them here before that processing begins.

This policy covers three different things, and it is worth separating them, because right now they are not all live.

Today, the only personal data we hold is a work email address if you joined the waitlist, plus the technical diagnostics described in section 4. Everything this policy says about the Service describes what will happen when you use it. We are telling you now so the terms are not a surprise later, not because it is already happening.

This policy does not cover third-party websites we link to, or the AI coding tools you use Mneia alongside. Claude Code, Cursor, Codex, and the rest each have their own policies and their own relationship with you.

Data protection law distinguishes between deciding why data is processed and merely processing it on someone else’s instructions. We do both, in different places, and your rights differ depending on which applies.

If you use Mneia through an employer or a team, that organisation is the controller of everything you put into it. It decides what is captured, who can see it, and when it is deleted. We will not hand your workspace content to you against your organisation’s instructions, and we will not withhold it from your organisation on yours. If you want your content deleted and your organisation says otherwise, that is a conversation to have with them.

Where we act as a processor, a Data Processing Addendum forms part of our agreement with your organisation and governs that processing. It incorporates the Standard Contractual Clauses where they are required.

We set no cookies on this website. We run no advertising, no analytics product, and no session recording. There is no tracking pixel, no fingerprinting script, and no data broker relationship. We are not being modest; there is genuinely nothing there.

Two things do happen when you use this site.

The waitlist. If you submit the form, we receive the work email address you typed. We use it for one thing: telling you when access opens. We do not sell it, rent it, share it for anyone else’s marketing, or add you to a newsletter you did not ask for. Every message we send will let you unsubscribe in one click, as the CAN-SPAM Act requires, and unsubscribing removes the address rather than merely suppressing it.

Error reporting. When something breaks on this site, our error reporting sends us a diagnostic report. That report includes your IP address, operating system name and version, browser name and version, device characteristics, the page you were on, and a technical stack trace. It is processed by Sentry on our behalf and used only to find and fix the fault.

An IP address is personal data in the EEA, the UK, India, and California. We collect it because a crash you cannot reproduce is a crash we cannot fix. If you would rather we did not, write to us and we will suppress IP collection for reports we can identify as yours.

Mneia is a hosted service. There is no local database and no offline mode; every surface is an authenticated client against one hosted API and one Postgres database. Your content is on our servers by design, not by accident, and you should decide whether that is acceptable to you before you put anything in it.

Context items are the sensitive part, and we will not pretend otherwise. A decision captured from an engineering session can contain architecture, credentials someone pasted carelessly, commercial terms, personnel matters, or anything else that was said while the work was being done. Mneia captures what your agent session produced. It cannot know in advance what that will contain.

You control this through scope. Every item carries a visibility scope (private to the person who asserted it, project, team, workspace, or an explicit grant list), and scope is enforced at the API, not in the client. Choose it deliberately.

Checkpointing sends your content to a large language model. When you checkpoint, the relevant portion of your session is sent to Anthropic PBC, under our commercial account, to extract structured items and detect contradictions. We pay for that call; you do not bring your own key. It is the only marginal cost in the product, which is why it is the only thing we meter.

We do not train models on your content. Not on your context items, not on your rationale, not on your handoffs. Model improvement uses behavioural signals only: which items were shown, referenced, ignored, confirmed, edited, or rejected, and which side of a conflict a human chose. Those signals travel as identifiers and outcomes, not as the words you wrote.

That distinction is deliberate and we intend to keep it. If it ever changes, it will change by advance written notice and, where consent is the lawful basis, by asking you, not by an edit to this page.

Our agreement with Anthropic prohibits them from training their models on data submitted through our commercial account. We do not control Anthropic’s own practices beyond that contract, and their terms are worth reading if this matters to you.

Extraction is automated, but it does not decide anything about you. It produces suggestions you confirm, edit, or reject. No legal or similarly significant decision about any person is made by automated means, so the right to object to solely automated decision-making under Article 22 of the GDPR does not arise. If that ever changes, we will say so here first.

For people in the EEA and the UK, Article 6 of the GDPR requires a lawful basis for every purpose. Ours are set out below. Where the basis is legitimate interests, you can object; see section 12.

Where we act as a processor on your organisation’s behalf, the lawful basis is your organisation’s to establish, not ours.

We do not sell your personal information, and we never have. We do not share it for cross-context behavioural advertising. Under the CCPA as amended by the CPRA, and under every US state privacy statute that uses those terms, we neither sell nor share, and we have no data broker relationships to register.

We do use service providers to run the product. Each is bound by contract to process data only on our instructions and to standards no weaker than this policy.

We will give notice before adding a sub-processor that handles customer content, so that organisations with a Data Processing Addendum can object.

We may also disclose data where we are legally compelled to, to establish or defend legal claims, or to protect the rights and safety of people. Where the law permits us to tell you about a demand for your data, we will, before we comply. We will push back on requests that appear overbroad or defective.

If the business is acquired or its assets transferred, data may move with it. You will be told before that happens, and any acquirer remains bound by commitments made here until you are given notice and a genuine choice.

We are based in the United States and our infrastructure is in the United States. If you are outside it, using Mneia means your data is transferred there.

For transfers from the EEA, the UK, and Switzerland, we rely on the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum where the UK GDPR applies and the Swiss addendum where the revised FADP applies. Where a provider is certified under the EU-US Data Privacy Framework and its UK and Swiss extensions, we rely on that certification as well.

We assess the destination country’s law before relying on those clauses, and we apply encryption in transit and at rest as a supplementary measure. You can request a copy of the relevant clauses from us.

For transfers from India, we comply with the Digital Personal Data Protection Act, 2023 and will not transfer to any country the Central Government restricts. For Canada, Brazil, Australia, Japan, South Korea, and Nigeria, we rely on the contractual and consent mechanisms each of those regimes provides.

When you close an account we delete or irreversibly anonymise the associated personal data within 90 days, except where we must keep it to meet a legal obligation or to establish or defend a legal claim. Behavioural signals already separated from identity are not restored to identity in order to delete them; they are no longer personal data at that point.

• Encryption in transit (TLS) and at rest
• Access scoped and enforced at the API, never merely hidden in the client
• Authentication through a specialist provider rather than passwords we store ourselves
• Least-privilege access to production, limited to those who need it
• Secrets kept out of source control, with automated checks that they stay out

No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach affects your personal data, we will notify the relevant supervisory authority within 72 hours where the GDPR requires it, notify you without undue delay where the risk to you is high, and meet the six-hour reporting requirement of India’s CERT-In directions where they apply. State breach notification laws in the United States will be met on their own timetables.

If you have found a vulnerability, please tell us at security@mneia.dev. We will not pursue legal action against good-faith security research that respects user privacy and does not degrade the Service.

• Access: get a copy of the personal data we hold about you
• Rectification: have inaccurate data corrected
• Erasure: have data deleted where the grounds in Article 17 apply
• Restriction: have processing paused while a dispute is resolved
• Portability: receive data you gave us in a structured, machine-readable format
• Objection: object to processing based on legitimate interests, including profiling
• Withdraw consent: at any time, without affecting processing already carried out
• Complain: to your national supervisory authority, without coming to us first

Write to privacy@mneia.dev. We respond within one month, extendable by two further months for genuinely complex requests, and we will tell you if we extend. We do not charge for this, and we will not make you justify why you are asking.

If you are unhappy with our answer, you can complain to the supervisory authority where you live, work, or where you believe the problem occurred. In the UK that is the Information Commissioner’s Office. You do not need our permission and you do not need to exhaust our process first.

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents the rights below. We do not sell or share personal information, so there is nothing for you to opt out of, but the right exists and we are telling you about it rather than staying quiet.

• Know: what we collect, where it came from, why, and who we disclose it to
• Access: a copy, covering the preceding 12 months and beyond on request
• Delete: subject to the exceptions in the statute
• Correct: inaccurate personal information
• Opt out of sale or sharing: we do neither, so this is nothing to exercise
• Limit use of sensitive personal information: we do not use it for inferring characteristics
• Non-discrimination: exercising a right will never change your price or service

Make a request at privacy@mneia.dev. We confirm within 10 business days and answer within 45 days, extendable once by a further 45 where the request is complex. You may use an authorised agent; we will ask for proof of their authority and for you to verify your own identity.

Shine the Light. California Civil Code section 1798.83 lets residents ask about personal information disclosed to third parties for their direct marketing. We disclose none, and never have.

Sensitive personal information. We do not collect government identifiers, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, union membership, genetic or biometric data, or health or sex life data. Card details go directly to Stripe and never reach our servers.

Comprehensive privacy statutes are in force in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island. They differ in detail; we apply the most protective standard to everyone rather than sorting people by postcode.

Wherever you live in the United States, you may confirm whether we process your data, access it, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale, and profiling with legal or similarly significant effects. We do none of those last three.

If we refuse a request, you may appeal. Colorado, Connecticut, Virginia, Texas, Montana, Oregon, Delaware, New Jersey, Minnesota, Maryland, and others require an appeal route, and we offer it to everyone. Reply to our refusal and a person will reconsider it within 45 days. If we still refuse, we will tell you how to contact your state Attorney General.

Washington My Health My Data Act. We do not collect consumer health data as that statute defines it, and we do not sell it. Its definition is broad, so we monitor this rather than assuming.

Under the Digital Personal Data Protection Act, 2023 and the rules made under it, you are a Data Principal and we are a Data Fiduciary. You have the right to access a summary of your personal data and its processing, to correction and erasure, to nominate another person to exercise your rights if you die or become incapacitated, and to a grievance redressal process.

Our Grievance Officer can be reached at grievance@mneia.dev. We respond within the period the rules prescribe. If you are not satisfied, you may complain to the Data Protection Board of India.

Where we rely on your consent, our notice is available in English and we will provide it in any language listed in the Eighth Schedule to the Constitution on request. You may withdraw consent as easily as you gave it. We also comply with the Information Technology Act, 2000 and the SPDI Rules, 2011 in respect of sensitive personal data.

If your country grants you a right this policy does not mention, you still have it, and asking us for it is enough.

This website sets no cookies. Because we set none, the consent requirements of the ePrivacy Directive and the UK PECR are not engaged, and there is no cookie banner for you to dismiss.

When the Service launches, it will set strictly necessary cookies for authentication and security. Those are exempt from consent requirements because without them you cannot stay logged in. We will not add analytics or advertising cookies without asking first.

Global Privacy Control. We honour the GPC browser signal as a valid opt-out of sale and sharing, as California and Colorado require. Since we neither sell nor share, the signal changes nothing in practice, but it is respected rather than ignored.

Do Not Track. There is still no common standard for how sites should respond to DNT, so like most sites we do not respond to it differently. California law requires us to tell you that plainly, so we have.

Mneia is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16, and we do not permit under-16s to create accounts. If you believe a child has given us data, write to us and we will delete it. We comply with the Children’s Online Privacy Protection Act and, in India, with the DPDP Act’s requirement of verifiable parental consent for anyone under 18, which in practice means we do not offer the Service to them.

We will update this policy as the product changes; the Service launching will require it. The date at the top always reflects the current version.

For material changes that reduce your protections or widen what we do with your data, we will give at least 30 days’ notice by email to account holders before they take effect, and where consent is the lawful basis we will ask again rather than assume. Continuing to use the Service after a change takes effect means you accept it; if you do not, you can close your account and export your data first.