mithran

Privacy Policy

Last updated: 2026-08-13

1. Who we are

Mithran, Inc. ("Mithran", "we", "us") is a Delaware corporation. Our mailing address is 1111B S Governors Ave #77003, Dover, DE 19904, USA.

Mithran is the controller of the personal data described in this policy. We decide why it is collected and how it is used.

2. What this policy covers

"The Site" means the mithran.ai website and its paths, including /docs/, /aegis-method/, /case-studies/, /agentic-journey/, and /thank-you/.

This policy does not cover:

Cookies and local storage are described in Cookie Policy. The terms governing your use of the Site are in Terms of Use.

3. What the Site collects

3.1 Contact form submissions

When you submit the contact form, we receive:

Field Required
Your name Yes
Your email address Yes
Your company No
Your role, chosen from nine fixed options (Founder / CEO through to Other) Yes
Your message, up to 2,000 characters Yes
The path on the Site you submitted from Recorded automatically

The form also carries a hidden field and a timing value. The server uses both only to reject automated submissions, then discards them. They are never stored or sent onward.

The server does not write your form values to its logs. The browser does not send your form values to analytics. On submission the browser emits a single lead_submitted event carrying a generated submission ID and nothing else.

3.2 Analytics, only if you consent

The Site uses PostHog for analytics. Nothing analytics-related runs until you select Allow analytics. If you decline, or if you never answer, no analytics runs and no PostHog cookie is set.

Analytics is not yet operating in production. The content security policy on the currently deployed Site blocks the PostHog script, so no analytics data is collected today even from visitors who select Allow analytics. This section describes what happens once analytics is enabled.

With your consent we collect: page views and page leaves, scroll depth at 25, 50, 75 and 90 percent, section views, clicks with their visible label, CTA names, the destination domain of outbound links, contact intent, page performance timings, JavaScript exceptions, dead clicks, and aggregate heatmaps.

We have turned the following off in code:

The analytics events your browser sends do not contain your IP address. PostHog does see the address your connection comes from, as every web server sees the address it is talking to, so we have set our PostHog project to discard it rather than store it, and we have turned off the enrichment that would derive your approximate location from it.

We also do not let PostHog use anything from this site to develop its products or train its models.

We also rewrite the page URL and the referrer to origin plus path, so the query string and the fragment are stripped from both before they are sent.

Campaign attribution is the exception. Where you arrive by a tagged link, the analytics library records the campaign parameters (utm_source, utm_medium, utm_campaign, and similar) as their own properties. Those tell us which campaign brought you here. They do not identify you.

3.3 Links in email we send you

Where we send you email directly, the links in it may carry an opaque identifier in the URL. It works like a campaign parameter, except that it is generated for a single message rather than for a campaign, so it tells us that a link in that message was followed.

The identifier is a random value. It contains no name, no address, and nothing else about you, and it is not readable as anything on its own.

It is not treated as a campaign parameter by the analytics library, so it is removed along with the rest of the query string before any page URL is sent to PostHog. It does appear in our server and infrastructure logs, described below, because those record the URL that was requested.

You can remove the parameter from the address bar before loading the page, or type the address by hand, and the page will work the same way.

3.4 Server and infrastructure logs

Our hosting platform writes request logs that include your IP address. We use these to operate the Site and to investigate faults and abuse.

Load-balancer request logging is not enabled. DNS query logging is enabled on the mithran.ai zone.

For rate limiting we hash your IP address with SHA-256, truncate the result, and hold it in memory for a fifteen-minute window. That value is never written to disk.

4. Why we collect it, and our legal basis

Category Purpose GDPR Article 6 basis
Contact form submissions To read your enquiry and reply to it Article 6(1)(b), steps taken at your request before entering a contract
Analytics To understand which pages and content are useful Article 6(1)(a), your consent
Server logs To operate and secure the Site Article 6(1)(f), our legitimate interest in keeping the Site available and defending it against abuse

5. Who receives your data

We do not sell your personal data and we do not share it for advertising.

The vendors that process Site data on our behalf are listed in sub-processor page. They are:

Each of these providers uses its own sub-processors. Our sub-processor page names the ones we have recorded, and we add to it as we review each provider.

Your contact-form submission is emailed to hello@mithran.ai with your address set as the reply-to, so that a person can answer you directly.

We may also disclose personal data where the law requires it, or to establish or defend a legal claim.

6. How long we keep it

Personal data collected through the Site is kept for 18 months by default. We delete analytics data associated with you when you withdraw your consent.

Server request logs are kept for 30 days.

If you ask us to delete your data sooner, we will, subject to any record we are legally required to keep.

7. Your rights

We offer the same rights to everyone who uses the Site, wherever you are. You can ask us for a copy of your data, ask us to delete it, ask for it in a portable form, ask us to correct it, object to processing we base on our legitimate interest, and ask us to restrict processing.

We offer these rights as a matter of policy, not only where a law compels them. Mithran is a small US company and some of these regimes may not reach us. We would rather give you the right than argue about whether you have it.

Mithran does not sell personal information. Mithran does not share personal information for cross-context behavioural advertising. The Site carries no advertising trackers.

We answer every rights request within 30 days. Contact us using the address in section 11.

Withdrawing analytics consent

You can withdraw analytics consent at any time using the Analytics choices control in the Site footer. Withdrawing takes effect immediately for future page views and does not affect the lawfulness of anything processed before you withdrew.

8. International transfers

Mithran, Inc. is a Delaware corporation. We have no subsidiary outside the United States. Personal data collected through the Site is stored in the United States, by us and by the vendors named in section 5. Analytics requests reach our provider through a global edge network, so they may pass through servers outside the United States before they are stored.

If you contact us from the EU or the UK, your message reaches people who work from there, so it is read in the EU or the UK as well as stored in the United States.

This section describes our current arrangement. It is not a data-residency commitment.

9. Do Not Track

The Site honours the Do Not Track browser signal. If your browser sends Do Not Track, the consent panel does not appear and analytics does not run. You are not asked to opt out, because you already have.

10. Children

The Site is not directed to children under 16. We do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.

11. How to contact us

For any privacy question or rights request, write to privacy@mithran.ai, or to Mithran, Inc., 1111B S Governors Ave #77003, Dover, DE 19904, USA.

12. Changes to this policy

When we change this policy we update the Last updated date at the top and publish the new version at the same URL. If a change materially affects how we handle your personal data, we will say so on the Site before the change takes effect. If the change requires your consent, we will ask for it.