Privacy Policy

Mithos The Village is run by Mithos Limited, trading as Mithos, a private limited company registered in England and Wales (company number 17459676). Our registered office is 9 Crake Valley Road, Harwell, Oxfordshire, OX11 6LS, United Kingdom.

We are registered with the Information Commissioner's Office (ICO) under reference ZC249870. For anything about privacy, email info@mithos.co.uk.

Controller. For your own account details and how you use Mithos The Village, we decide how and why the data is used, so we are the controller.

Processor. When you connect your business accounts, such as a calendar, they may contain personal data about other people (for example, the attendees of a meeting). We handle that data only on your behalf and on your instructions, as a processor, under our Data Processing Addendum.

• Account: your name, company name, email address and password (the password is stored only as a secure hash by our sign-in provider, and we never see it), plus when you signed up and last signed in.
• Company details you enter: company name, legal name, company number, VAT number, website, industry, address and the web domains you add.
• Connected calendar (Microsoft 365 or Google): we store the connection's access tokens, encrypted and on our servers only, plus the connected account's email address and when it last synced. To show today's meetings we fetch each meeting's title, start and end time, location, whether it is online, and the number of attendees. These meeting details are fetched live each time you look and are not stored in our database. We do not read attendee names or email addresses into the app. Access is read-only.
• Village layout: which buildings you have chosen to show.
• Requests and feedback: the tool you ask for, your message, and your email if you choose to give it.
• Simulator: the products, prices, costs, suppliers, volumes, cost shocks, hiring plans and price tests you enter.
• People: team-level HR totals you enter (team names, headcount, average pay, pension %, joiners, leavers, absence days and open roles), your workplace pension duties start date, and key dates such as right-to-work, probation and contract dates, described by role rather than by name. Mithos The Village is designed not to hold records about named individuals, so please do not enter people's names.
• Research Centre: the sector, region, competitors and topics you enter, the questions you ask, and the research briefs, daily digests, cost signals and competitor prices we produce and store for you, with their sources.
• Cyber Security: results of automated checks on the domains and company you add: DNS records, certificates, email security settings, lookalike domains and their evidence, and changes on the Companies House register.
• Usage: which parts of the product you open (opening the app, opening a building or panel, and starting, finishing or skipping the tour). These are counts and dates only, never what you type.
• AI usage and cost records: for each AI request, which feature it was for, the model, the number of tokens and web searches, and an estimated cost.
• Legal acceptances: which version of our Terms and this policy you accepted, when, and the IP address it was accepted from.
• Onboarding progress: whether you have finished the welcome tour or hidden the setup checklist.
• Technical: IP address, browser and device details in standard server logs and error reports kept by our hosting providers.

• Contract: to create your account and provide the service you signed up for, including every building in the village.
• Legitimate interests: keeping the service and your account secure, preventing fraud and misuse, understanding which features are used so we can improve them, and keeping our running costs (such as AI costs) under control. We keep this to counts and dates rather than content.
• Legal obligation: keeping business, accounting and tax records, and responding to lawful requests.
• Consent: connecting your Microsoft or Google account. You can withdraw consent at any time by disconnecting the account in the app, which deletes the stored tokens.

To write plain-English explanations, research briefs, daily digests and competitor price checks, we send the relevant inputs to Anthropic's Claude API. Depending on the feature, this can include your company name, the figures in a simulation, price test or hiring plan, and your research questions, sector, region, competitors and topics. For research, Claude also searches the public web.

We do not make any automated decisions about people that have legal or similarly significant effects. The numbers shown in the Simulator are calculated by our own code, not by the AI; the AI only puts them into words.

AI output can be wrong or out of date. Please check anything important before you act on it.

We do not sell personal data. We use trusted service providers (processors and subprocessors) to host the service, run sign-in, provide AI and run security checks. Each one only gets the data it needs. The full list is on our Subprocessors page. We may also share data if the law requires it, or to protect our rights or someone's safety.

Some of our providers are based outside the UK, mainly in the United States and the European Economic Area. Where applicable, transfers are protected by UK adequacy regulations, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework. You can ask us for more detail at info@mithos.co.uk.

• Account data: until you delete your account. You can do this yourself from your account page; it deletes your account and everything linked to it immediately. If you ask us to delete it instead, we do so within 30 days. We keep only what the law requires us to keep, such as accounting records.
• Usage records: 13 months, then deleted automatically each week.
• Requests and feedback: kept for 24 months. If you sent one without an account and want it deleted sooner, email us at info@mithos.co.uk.
• Records of what you accepted: records that you accepted our Terms and Privacy Policy (document, version, date, and IP address if recorded) are kept for 6 years after you leave, without your name or email, so we can show what was agreed if there is a dispute. Our lawful basis is legitimate interests (establishing, exercising or defending legal claims).
• Calendar connection tokens: until you disconnect the account or delete your account.
• Simulator, Research Centre and Cyber Security data: until you delete it or delete your account.
• Sign-in links used while connecting a calendar expire after 10 minutes.
• Server logs and error reports: kept by our hosting providers for a limited period under their own retention settings.

Calendar connection tokens are encrypted and are only ever handled by our servers, never sent to your browser. Our database uses access controls and row-level security so each account can only reach its own data. Admin access is limited to a small number of people and is checked on our servers for every request. Data is stored on managed cloud infrastructure. More detail is on our Security page.

We use only storage that is needed to run the service. We do not use advertising or third-party tracking.

• Sign-in session (browser local storage): keeps you signed in.
• Onboarding progress (mithos.onboarding, local storage): remembers whether you finished the tour, as a fallback if our servers can't be reached.
• Opened this session (mithos-opened, session storage): makes sure an app open is only counted once per visit. Cleared when you close the tab.
• Reload guard (lazy-reload:…, session storage): stops the page reloading repeatedly if part of the app fails to load after an update.

Because these are strictly necessary or purely functional, we do not show a cookie banner.

A small number of authorised staff can see account and usage information (such as email addresses, sign-up and sign-in dates, which features are used, and AI costs) for support and to run the service. They cannot see what you type into the Simulator or Research Centre, except where it is needed to fix a fault.

Mithos The Village is for businesses. It is not meant for anyone under 18.

Under UK data protection law you have the right to:

• get a copy of your data (access), which you can also download from your account page;
• have inaccurate data corrected (rectification);
• have your data deleted (erasure);
• limit how we use it (restriction);
• receive your data in a reusable format (portability);
• object to our use of it, including for legitimate interests;
• withdraw consent at any time, for example by disconnecting a calendar.

To use any of these rights, email info@mithos.co.uk. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the ICO at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

If we change this policy, we will update the version number and date at the top. For significant changes we will tell you by email or in the app, and ask you to confirm you have read the new version before you carry on.

Mithos Limited, 9 Crake Valley Road, Harwell, Oxfordshire, OX11 6LS, United Kingdom. Email info@mithos.co.uk.