Privacy Policy

Last updated: 27 October 2026

This Privacy Policy describes how BELESIOTIS SOFTWARE AND CONSULTING SERVICES SINGLE MEMBER P.C., trading as “BELESIO SCS” ("we", "us", or "our"), collects, uses, stores, and protects information when you use Mermix ("the Service"). We are committed to protecting your privacy in compliance with the General Data Protection Regulation (GDPR), the Greek Data Protection Act (Law 4624/2019), and other applicable data protection legislation.

1. Data Controller

BELESIOTIS SOFTWARE AND CONSULTING SERVICES SINGLE MEMBER P.C. (BELESIOTIS SOFTWARE AND CONSULTING SERVICES ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε.), trading as “BELESIO SCS” — registered seat Pantanassis 1, 73100 Chania, Crete, Greece; GEMI no. 194842158000; VAT / ΑΦΜ EL803336283 — is the data controller for personal data collected through the Service's account management, marketing, and billing functions.

For Customer Data (Jira project data, resource allocations, worklogs, time-off records): the Customer is the data controller and we act as a data processor on the Customer's behalf. Processing is governed by our Terms of Service and the Data Processing Addendum that forms part of them.

Contact for data protection matters: privacy@mermix.io

Mermix connects to Jira, but it is not an Atlassian product. Belesio SCS, not Atlassian, is responsible for the personal data Mermix processes, including the data it reads from your Jira site. Atlassian's privacy policy does not apply to Mermix; this policy does. Where that data is stored is set out in §5.

2. Information We Collect

We collect the following categories of personal data:

Account information (provided by you at registration):

• Full name, work email address, organisation name.
• Password (stored as a one-way cryptographic hash — we cannot read your password).

Early-access requests (provided by you on the early-access form, while registration is not yet open):

• Your name, work email address and company name, and how you heard about us.
• If you choose to tell us: roughly how many people you plan, whether you use Jira Cloud, and anything you write in the message field.
• We use these details only to contact you about access to Mermix. We do not send you an automatic email, add you to a mailing list, or share the details with anyone other than the service providers in §7.

Billing information (provided by you when subscribing):

• Company name, VAT number, billing address, billing country, billing email.
• Payment card details are collected and processed exclusively by Stripe — we never see, store, or have access to your card number.
• VAT number verification results. Where you supply a VAT number we verify it before issuing an invoice, and again shortly before each renewal: EU numbers through a direct query to the European Commission's VIES service, UK numbers through Stripe (which queries HMRC), and Greek ΑΦΜ numbers through a direct query to the Greek tax authority's public registry service (AADE RgWsPublic2). We keep a record of each check — its outcome, the date, the registered name and address it returns, and the consultation number VIES issues — as evidence for our tax records. Please note that AADE notifies the entity whose ΑΦΜ has been queried.

Team member records (imported from your Jira instance at your direction, and entered by your administrators):

• Name, email address, avatar URL and Jira account ID.
• Country of residence — used to apply the correct public-holiday calendar when calculating that person's available capacity.
• Cost rate and billable rate per person, where your administrators choose to enter them, together with the rates in force at the time each worklog was recorded. These are used by the profitability and cost reports.
• Absence records: absence type, start and end dates, and approval status — imported from your Jira instance or from a spreadsheet you upload. The absence type is free text that you supply, and Mermix stores the value as given. As set out in §1 you are the controller for this data, and you are responsible for ensuring you have a lawful basis for any health-related or otherwise sensitive information you choose to record in that field.

Jira project data (imported from your Jira instance at your direction):

• Issue keys, titles, assignees, dates, effort estimates and sprint data.
• Worklogs — the Jira account ID and display name of the person who logged the work, the issue and project it was logged against, the date, and the time spent.
• Atlassian OAuth tokens (issued by Atlassian when you grant access to your Jira instance) — stored encrypted (AES-256-GCM) and never logged. You can revoke these tokens at any time from your Atlassian account settings, which immediately disconnects Mermix from your Jira data.

Usage data (collected automatically):

• A record of significant actions taken in the Service — for example signing in, synchronising with Jira, changing a plan, or applying an AI copilot proposal. Each record is linked to the user account that performed it and, for security-relevant events, to the IP address it came from.
• AI copilot metering records: the model used, the credits charged, and the number of tokens sent and received. We do not store the content of your AI copilot conversations — see §8.
• Request logs: the application, HTTP method, path, response status code and duration of API requests, linked to the organisation and user account that made them. Values passed in the query string are never stored — only the names of the parameters.

Technical and analytics data (collected automatically):

• IP address — used for rate limiting, and stored alongside security-relevant events (audit records and fraud-detection signals) for the retention periods set out in §6. Marketing analytics do not store your IP address; see the page-views entry below.
• Country of origin — derived from the Cloudflare CF-IPCountry request header and stored with marketing page views.
• HTTP referrer — stored for marketing analytics (where visitors come from).
• Page views on the marketing website — server-side logging, no client-side tracking scripts. Each page view stores the path visited, the country, the referrer, and a one-way daily hash derived from your IP address and browser user agent. That hash lets us count unique visitors without identifying them; neither the IP address nor the user agent is itself stored against a page view.

3. Legal Basis for Processing

We process personal data under the following legal bases (GDPR Article 6):

• Performance of a contract (Art. 6(1)(b)) — processing necessary to provide the Service: account management, Jira synchronisation, billing, email communications. It also covers the steps you ask us to take before a contract: replying to an early-access request.
• Legitimate interest (Art. 6(1)(f)) — fraud detection (IP rate limiting, disposable email blocking), server-side web analytics, security monitoring, verification of VAT numbers supplied for invoicing, and product improvement based on how the Service is used.
• Legal obligation (Art. 6(1)(c)) — retention of billing records for tax and accounting compliance (Greek tax law: 7-year retention for invoices).
• Consent (Art. 6(1)(a)) — only used if we introduce optional marketing communications in the future. We do not currently process data based on consent.

4. How We Use Your Information

• To provide and operate the Mermix service, including Jira synchronisation, resource planning, and reporting.
• To process payments and issue invoices via Stripe and Elorus.
• To send transactional emails: account verification, password reset, trial warnings, billing receipts, ownership transfer, and account cancellation notifications.
• To provide AI-powered planning assistance via the AI copilot (see §8).
• To detect and prevent fraudulent registrations and abuse.
• To measure website traffic and marketing effectiveness (server-side analytics only).
• To improve the product based on how the Service is used.

5. Data Storage and Security

Hosting and location: Your data is stored in PostgreSQL databases hosted by Neon (eu-central-1, Frankfurt, Germany). Application servers are hosted by Render (Frankfurt, Germany). All infrastructure is within the European Union.

Tenant isolation: Each organisation's data is held in its own separate database, with its own credentials. One organisation cannot access another's data.

Encryption:

• In transit: all data is transmitted over TLS 1.2+ (HTTPS).
• At rest: database encryption provided by the hosting provider.
• Sensitive fields: Atlassian OAuth tokens are encrypted using AES-256-GCM with a per-deployment key before storage.

Access control: Access to production systems is restricted to authorised personnel only. Administrative portals are protected by additional authentication layers.

6. Data Retention

• Active accounts: Customer Data is retained for the duration of the active Subscription, subject to plan-specific data retention limits (e.g. worklogs and completed tasks may be pruned based on your plan's retention period).
• Post-cancellation: After Subscription cancellation or trial expiry, Customer Data is preserved in read-only mode for 30 days (grace period). After 30 days, Customer Data is permanently and irreversibly deleted.
• Account shell: Identity records, billing history, and invoice data are retained after data deletion for legal, accounting, and resubscription purposes.
• Billing records: Invoices and payment records are retained for 7 years as required by Greek tax law.
• Fraud signals: Fraud detection records — the signal type, the email address and IP address the registration attempt came from, the workspace name requested, and a timestamp — are retained for as long as the abuse-prevention purpose requires. We are reviewing a fixed retention period for these records; you may request erasure of a fraud signal relating to you under §11.
• Unfinished sign-ups: registration details (name, email and password hash) that were never verified, or whose sign-up link was used or expired, are deleted 30 days after the sign-up started.
• Early-access requests: the details you gave on the early-access form are deleted 90 days after your request. You can ask us to delete them sooner at any time (§11).
• Server-side analytics: Marketing page-view records are retained for 180 days and then deleted.
• Operational logs: Audit records of significant account actions are retained for 365 days. Error logs and scheduled-job logs are retained for 90 days. API request logs and system health snapshots are retained for 60 days.

7. Sub-processors and Third-Party Services

We use the following third-party services (sub-processors) to provide the Service:

• Neon (neon.tech) — PostgreSQL database hosting, Frankfurt, Germany. Stores all Customer Data.
• Render (render.com) — Application hosting, Frankfurt, Germany. Runs all application servers.
• Cloudflare (cloudflare.com) — CDN, DNS, DDoS protection, SSL termination. Processes IP addresses for routing and security. Any transfers of personal data outside the EEA are covered by the EU Standard Contractual Clauses (SCCs).
• Stripe (stripe.com) — Payment processing. Collects and processes payment card details directly. We never handle card data. Stripe is a PCI DSS Level 1 certified provider.
• Elorus (elorus.com) — Invoice generation and Greek tax compliance (myDATA/AADE). Receives billing details (company name, VAT, address) for invoice creation. EU-based (Greece).
• Brevo (brevo.com) — Transactional email delivery (the account, billing and support emails we send you). Receives recipient email addresses and email content. Brevo counts how often our emails are opened and which links in them are clicked, using a small image in each email and by passing links through its own servers. We have set this counting to be anonymous, so opens and clicks are not linked to you, and we use the totals only to check that our emails arrive. Our email provider does not offer a way to switch this counting off. EU-based (France). GDPR-compliant.
• Infomaniak (infomaniak.com) — Hosts our company mailboxes (hello@, privacy@ and the other addresses we publish). Receives the messages you send us, including support and data-protection requests. Based in Switzerland, which the European Commission recognises as providing adequate protection.
• Anthropic (anthropic.com) — AI model provider for the AI copilot feature. Receives planning data context for AI processing (see §8). US-based, and processing takes place on global cloud infrastructure (Anthropic's own sub-processors include Google Cloud, AWS and Microsoft Azure) — transfers outside the EEA are governed by Standard Contractual Clauses (SCCs). Anthropic's commercial API terms prohibit training on customer data. Anthropic publishes its own sub-processor list at trust.anthropic.com/subprocessors.
• Jira Cloud (Atlassian) (atlassian.com) — Project management platform. We sync data from your Jira instance at your direction using credentials you provide. Your use of Jira is governed by Atlassian's terms. As Atlassian requires of apps that keep Jira users' personal data, we regularly send Atlassian the Jira account IDs we hold (with the date we last fetched each person's details, and nothing else); when Atlassian reports that an account has been closed, we erase that person's name, email address, avatar and worklog author name, and when it reports a change we refresh the details from Jira.
• Nager.Date (date.nager.at) — Public API for public holiday data by country. No personal data is sent.

We will notify you before adding new sub-processors that handle personal data, giving you the opportunity to object.

8. AI Data Handling

When you use the AI copilot feature, the following data flow occurs:

• Relevant planning data from your workspace (resource allocations, task details, worklogs, time-off, settings) is included as context in your AI request.
• Team members are pseudonymised before this context is sent — their names, email addresses, and country are replaced with internal identifiers (e.g. R001), so those personal identifiers are not transmitted to the AI provider. Operational text you author (task titles and descriptions, worklog comments, and the messages you type to the copilot) is sent as written.
• This data is sent securely (TLS) to Anthropic's API for processing.
• Anthropic processes the data to generate your requested response. Under Anthropic’s commercial API terms it deletes the request and the response within 30 days; content that its automated safety systems flag as violating its Usage Policy may be kept for up to 2 years.
• Your data is not used to train, fine-tune, or improve AI models. This is guaranteed by Anthropic's commercial API terms.
• AI interactions are logged on our servers for credit metering (model used, token count). Query content is not stored beyond the active session.

You may opt out of AI Features at any time. The core planning, scheduling, and reporting functionality works independently of AI.

9. International Data Transfers

Your data is primarily stored and processed within the European Union (Germany). Where data is transferred to service providers outside the EU — Anthropic in the USA for the AI copilot, and Stripe and Cloudflare, which may process payment and network data outside the EEA, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) — as adopted by the European Commission, incorporated into our agreements with non-EU sub-processors.
• Data minimisation — only the data necessary for the specific processing purpose is transferred.

10. Cookies and Local Storage

The Service uses two storage mechanisms — both strictly necessary and exempt from consent under the ePrivacy Directive (Article 5(3)):

• Planner application (your workspace, e.g. yourcompany.mermix.io) — browser local storage only (no cookies). Stores the JWT authentication token and user interface preferences (theme, calendar zoom level, active portfolio selection).
• Account portal (myaccount.mermix.io) — a single first-party session cookie (mermix_myaccount, HttpOnly, SameSite=Lax, Secure in production, 24-hour lifetime) required to maintain the login session. No tracking, no third-party.

Our marketing website (portal.mermix.io) uses server-side analytics only. No cookies, no tracking scripts, and no client-side storage are used on the marketing site. No consent banner is required.

We do not use advertising cookies or third-party analytics scripts anywhere in the Service or on our website. The only measurement outside our own servers is the anonymous counting of email opens and link clicks by our email provider, described under Brevo in §7.

11. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — request correction of inaccurate personal data.
• Right to erasure (Art. 17) — request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
• Right to restrict processing (Art. 18) — request limitation of processing in certain circumstances.
• Right to data portability (Art. 20) — receive your personal data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)) — where processing is based on consent, withdraw at any time.

To exercise any of these rights, contact us at privacy@mermix.io. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with your national data protection authority. For Greece, the supervisory authority is the Hellenic Data Protection Authority (HDPA / ΑΠΔΠΧ): www.dpa.gr.

12. Children

The Service is designed for business use and is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly.

13. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority (HDPA) within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
• Notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms, as required by GDPR Article 34.
• Document the breach, its effects, and the remedial actions taken.

14. Data Protection Officer

Given the current scale of our operations, we have not appointed a formal Data Protection Officer (DPO). For all data protection matters, please contact us at privacy@mermix.io. We will appoint a DPO if and when required by the scale of our processing activities under GDPR Article 37.

15. Automated Decision-Making

The Service does not make automated decisions that produce legal effects or similarly significantly affect you. The AI copilot provides suggestions and analysis, but all actions require explicit human confirmation. One registration check is automatic: sign-ups from known disposable email domains are refused, and you are asked to use a work email address instead. This has no legal or similarly significant effect, because you can register with another address. Other fraud signals are recorded for our team to review and do not block a registration.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email at least 30 days in advance. The updated policy will be posted on this page with a revised "Last updated" date. Continued use of the Service after the effective date constitutes acceptance.

17. Contact

For privacy-related questions or to exercise your data protection rights:

• Email: privacy@mermix.io
• Contact form: mermix.io/contact
• Data controller: BELESIOTIS SOFTWARE AND CONSULTING SERVICES SINGLE MEMBER P.C., trading as “BELESIO SCS” — GEMI no. 194842158000, VAT / ΑΦΜ EL803336283
• Postal address: Pantanassis 1, 73100 Chania, Crete, Greece