Privacy policy

1. Who we are

Myelin AI Inc. operates the marketing site at vmyelin.ai and the product at app.vmyelin.ai. This policy describes what the product actually collects. A lawyer should confirm the legal name, the mailing address, and whether EU or health-data rules apply before this draft is treated as final.

Postal address: [Postal address placeholder — counsel to insert the registered mailing address. This is not a real address.]

Privacy questions: jonathan@vmyelin.ai.

2. Information we collect

Account data: name, email, password hash or a Google profile, job title, organization, role (Owner, Manager, or Rep), and settings such as language and email preferences.

Billing: Stripe customer and subscription records. Checkout collects a phone number and a billing address for Stripe. We do not store card numbers. Stripe Tax is not turned on in the application.

Calls and practice: audio, transcripts, scores, scenarios, scripts, and feedback you upload, paste, import, or generate. Practice sessions include your voice. Free lost-call review collects an email plus either audio or a pasted transcript, and a hashed IP and device id used for rate limits.

Product use: pages and named events (for example that a session started), after you allow analytics. We do not send call transcripts or your email address to the analytics tool.

Support: messages you send through the contact form or feedback, which can include your email and the text you wrote. Feedback can be forwarded to Linear.

Integrations you connect (Zoom, Fireflies, Fathom, Slack, HubSpot, and the ingest API) send the data those connections are built to send: transcripts, recording URLs, names, emails, and scores. Partner sessions can load a Facebook pixel or an allowlisted head script only after you allow analytics.

3. How we use it

We use this information to run the product: sign-in, practice, call review, billing, support, and the emails described below. We do not sell personal information.

Commercial emails (a first-session note, trial reminders, and weekly practice nudges) include an unsubscribe link and a postal-address placeholder. Receipts, sign-in mail, invites, and the free-review confirmation are transactional and do not include that unsubscribe.

4. AI providers

Call audio, transcripts, prompts, and practice audio are sent to OpenAI and, for transcription, AssemblyAI, so the product can transcribe, score, and speak. The application does not set a zero-retention or “do not store” flag on those API calls. OpenAI’s default API terms say they do not train on API data; abuse-monitoring retention is separate and is not opted out in this code. We do not use your content to train a model that we offer to other customers. We do not claim an enterprise data-processing agreement in this policy, because that contract is not in the repository.

AI output can be wrong. It is training material, not legal, medical, or financial advice.

5. Subprocessors and other recipients

These companies receive personal information when the feature that uses them is on. Customer-configured integrations send data only after that customer connects them.

• Vercel — hosting, request logs, and (after consent) Web Analytics and Speed Insights.
• Neon — Postgres database for accounts, transcripts, billing, and integration secrets.
• Amazon Web Services (S3) — call audio, practice audio, transcripts, free-review audio, and logos.
• Stripe — checkout, subscriptions, and the phone number and billing address collected there.
• OpenAI — prompts, transcripts, analysis, and live voice.
• AssemblyAI — call audio for transcription.
• PostHog — product analytics after consent. Proxied to the United States.
• Sentry — application errors. Email is not attached. AI inputs and outputs are not recorded.
• Resend — email delivery. Sign-in mail can also go through the auth SMTP provider.
• Upstash QStash — background jobs (billing events, analysis, free-review ids, webhook deliveries).
• Cloudflare — Turnstile bot checks on sign-in and free review.
• Google — sign-in, if you choose Google.
• Zoom, Fireflies, Fathom, Slack, HubSpot — only after you connect them.
• Whop — partner billing webhooks, when a partner uses Whop.
• Linear — support feedback text, email, and user agent.
• Meta — a partner Facebook pixel, only after analytics consent and only if that partner enabled it.
• Calendly — only if you open a demo link. We do not embed it.

Customer webhooks and the ingest API send names, emails, scores, and transcript or audio URLs to endpoints the customer configures.

6. Cookies

Essential cookies are described in the Cookie Policy. Analytics cookies and similar tools stay off until you allow them. There is no separate “account settings” control that changes how long call media is kept.

7. Retention

Account data stays while the account is open. You can delete individual calls and practice sessions in the product. There is no self-serve “close my account” button and no automatic job that deletes an account 30 days after it closes. Email jonathan@vmyelin.ai to ask for access, correction, export, or deletion. We will act on that request. We do not promise a 30-day purge, because that job does not exist.

Free-review audio is deleted after 7 days. The email, transcript, and analysis row are kept so the review can be opened and, if you later create an account with the same email, claimed onto that account. The view link expires in 14 days. That expiry is the link, not a deletion of the row.

Outbound webhook delivery rows are pruned after about 30 days. There is no 180-day media purge in the application.

8. Recording consent

You may upload or import a call only if you have the consent the law requires, including from the other people on the call. Every upload, the free review, and each recording integration asks for that attestation, and the server rejects the request without it. Laws differ by state and country. Do not upload a call that includes a child or protected health information. Myelin is not a HIPAA service and does not offer a business associate agreement in this repository.

9. Your rights

Depending on where you live, you may have the right to know, access, correct, delete, or export personal information, and to opt out of sale or sharing and of certain profiling. California residents can use the Cookie settings control and email jonathan@vmyelin.ai with “Do Not Sell or Share” in the subject. We will not discriminate against you for exercising a privacy right.

If GDPR applies, the same email is how you ask for access, correction, deletion, restriction, or portability, and how you object. We do not block visitors from the EU. The security page still marks GDPR work as in progress. That is accurate.

You can also complain to a regulator. We ask that you email us first so we can respond.

10. Children

The service is for people 18 or older. We do not knowingly create accounts for children. Do not upload a recording of a child.

11. Changes

We will update the date on this page when the draft changes. Material changes will also be noted in the product or by email when we have a final policy.