Privacy Policy

The Service is operated by MIMOS AI LTD, a private limited company registered in England and Wales under company number 15265239, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. MIMOS AI LTD is the controller of the personal data described in this policy.

For privacy questions or requests, email support@hermes-ai.net.

If you build on the Service

If you use the Service to process personal data about your own end users (for example in prompts or uploaded media), you are responsible for telling them about it and having a lawful basis for it. Please contact us if you need to discuss data processing terms before sending such data.

Account information

• Your name or display name, email address, whether it is verified, when your account was created and your account role.
• From Google or GitHub, which are the only ways to sign in: your account identifier, name, email address and profile image link from that provider, and the sign-in tokens it issues. We ask only for basic profile and email access.
• If you created an account with a password before password sign-in was retired: that password's hash, never the plain text. It can no longer be used to sign in.

Sign-in and security information

• Session records, including IP address, browser user agent and when the session was created and expires.
• Rate-limit records used to prevent abuse, which may include IP addresses.
• Account status, such as whether an account is suspended and why.
• API key details: name, a short prefix, scopes, expiry, usage count and last use. Full API keys are not stored in plain text.

Task data

• Task records: the model, the full input parameters you submit (such as prompts, options and references to uploaded media), the idempotency key, status, error codes, price and timestamps.
• Results: text results are stored in the task record; image, video and audio results are stored as files.
• Uploaded media: images and videos you upload as inputs, with their type, size and upload time.

Please do not include personal data in prompts or uploads unless you need to, especially sensitive information or information about other people.

Credit and payment information

• Your credit balance and each ledger entry (grants, holds, charges and releases), with the related task and time.
• The reason recorded when we add credits to an account manually.
• When online purchase is available: order details from the payment provider, such as order number, product, amount, currency, tax, payment and refund status, and the information used to match the order to your account. We do not receive or store full card numbers.

Communications

If you email us, we receive your email address, the content of your message and any attachments.

Technical logs

Our application is designed to log only fixed error codes and request IDs when something goes wrong, not request bodies, API keys or raw error messages from the execution platform. Our hosting infrastructure, such as servers and reverse proxies, may record access logs containing IP addresses, request paths, times and status codes.

Under UK data protection law (and the GDPR, where it applies), we rely on the following legal bases:

Our legitimate interests are keeping the Service secure and reliable, preventing misuse and resolving disputes. You can object to processing based on legitimate interests (see Your rights).

We do not:

• sell your personal data or share it for cross-context advertising;
• send marketing emails (if we ever want to, we will ask for your consent first);
• use your inputs or outputs to train AI models of our own;
• make decisions about you that have legal or similarly significant effects based solely on automated processing.

We do not currently use analytics cookies, advertising cookies or third-party tracking. We only use storage that the Service needs to work or that supports a feature you choose to use:

Data in sessionStorage and IndexedDB stays in your browser and is only sent to us if you submit a task. You can clear it in your browser settings. Blocking the session cookies will prevent you from signing in.

Model execution platform

To run your tasks, we send the following to our third-party model execution platform, currently RunningHub:

• the input parameters you submit, including prompts;
• media you upload, which the platform downloads through a signed link that is valid for 1 hour.

We do not attach your name, email address or API key, but anything you include in a prompt or file is sent as it is. The platform runs the selected model and returns the result to us. It may keep task data and results in its own systems, and how it and the models it runs handle that data is governed by their own terms and privacy policies. Model brands shown in our catalog identify a model's developer; whether the platform passes data on to a model developer depends on the platform's arrangements.

Other service providers

• Google and GitHub: when you sign in with one of them, we exchange the information needed to sign you in.
• Payment provider (when online purchase is available): we intend to use Waffo Pancake. You give your payment details directly to the provider at checkout. Where it acts as merchant of record, it processes your payment, tax and billing information as an independent controller under its own privacy policy, and sends us the order information described above.
• Hosting provider: our database and stored files are kept on servers provided by our hosting provider.

Legal requirements and protecting rights

We may disclose information where required by law, court order or a lawful request from an authority, or where necessary to protect you, other users, the public or us, for example when handling misuse reports, fraud or security incidents.

Business transfers

If the Service or our business is transferred to another organisation, your data may be transferred with it. We will tell you before your data becomes subject to a different privacy policy.

We are registered in England and Wales. Our model execution platform and other service providers may process data in other countries, which may not have the same data protection laws as your country. Where UK data protection law (or the GDPR) applies to these transfers, we will take the steps it requires for them. Contact us if you would like more information about a particular transfer.

The model execution platform and other providers decide how long they keep the data they receive; this table does not cover them.

Our measures include:

• encrypting connections with HTTPS;
• storing API authentication values (and any legacy password) as hashes, plus encrypted copies of new API keys for viewing after sign-in;
• encrypting the credentials we use to call the execution platform;
• signed download links for uploaded media that are valid for 1 hour, and result files that can only be downloaded by the account that owns them or its API keys with read permission;
• API keys with access controls, optional expiry dates and rate limits;
• application logs designed not to record request bodies or keys.

No system is completely secure. If a security incident affects your personal data, we will notify you and/or the relevant authority where the law requires it.

Depending on where you live, you may have the right to:

• access your personal data and receive a copy;
• have inaccurate data corrected;
• have your data deleted in certain circumstances;
• restrict processing, or object to processing based on legitimate interests;
• receive data you provided in a common machine-readable format;
• withdraw consent at any time where we rely on consent, without affecting earlier processing;
• complain to a data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk); elsewhere, the authority where you live or work.

You can view your tasks, credit ledger and API keys in the console, and delete API keys there. For anything else, including closing your account and deleting data, email support@hermes-ai.net from your account email address. We may need to verify your identity first. We will respond within the time the law requires, normally one month.

Please note:

• account closure and data deletion are currently handled manually;
• we may need to keep some information to meet legal duties, such as tax and accounting records, or to handle an open dispute;
• deletion of data already sent to the model execution platform is governed by that platform's rules.

We would appreciate the chance to deal with your concerns before you approach the authority, so please contact us first.

The Service is only for people aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will deal with it.

The Service links to third-party sites and services, including checkout pages and third-party sign-in pages. Their handling of your data is governed by their own policies.

We may update this policy. For material changes, we will post a notice in the Service at least 14 days before the change takes effect and, where email delivery is available, also email the address on your account. The effective date and version at the top of this page show which version applies.

MIMOS AI LTD, registered in England and Wales, company number 15265239.
Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
Email: support@hermes-ai.net