Privacy Policy | AiMixUp

Last updated: October 5, 2026

AiMixUp is operated by a company incorporated in Portugal. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services.

1. Information We Collect

  • Account Information: name, email address, password.
  • Payment Information: processed securely by Paddle.com (web) and RevenueCat (Android/iOS). We do not store full payment card details.
  • AI Usage Data: prompts, conversations, uploaded files, generated outputs, and credit consumption.
  • Usage & Technical Data: IP address, device type, and product/usage analytics. On our website and in the web app this includes analytics tools that record the pages you view and the actions you take (named in Section 5). These load only if you accept them when we ask — if you decline, or make no choice at all, they are not loaded and nothing is recorded. We do not use session-recording or screen-replay tools.

2. Legal Basis for Processing (GDPR)

We process your personal data based on:

  • Contract – to provide the service and manage your subscription/credits.
  • Legitimate Interest – to improve our platform, prevent fraud, and ensure security.
  • Consent – for optional marketing communications (you can withdraw consent at any time), and for the non-essential analytics tools described in Sections 1 and 5. These are not loaded unless you accept them, and you can decline without losing access to the service.

3. How We Use Your Information

  • Provide, maintain, and improve the AiMixUp service (multi-agent conversations, image generation, Smart Folders, Kanban, local LLMs, etc.).
  • Calculate and manage credit usage.
  • Process payments and subscriptions.
  • Communicate with you about your account.
  • Send you newsletters, product updates, and promotional messages where permitted (see Section 4 — you can opt out at any time).

We do not use your private conversations or prompts to train external AI models.

4. Marketing & Newsletter Communications

With your consent, or where otherwise permitted by applicable law, we may send you newsletters, product updates, tips, and promotional messages by email about AiMixUp features, content, and offers. These marketing communications are separate from transactional and account messages (such as email verification, billing receipts, security alerts, and important service notices), which we need to send to operate your account and provide the service.

You can opt out of marketing and newsletter emails at any time by:

  • clicking the unsubscribe link at the bottom of any marketing email;
  • turning off the newsletter/digest toggle in your notification settings in the product (Profile → Notifications); or
  • emailing support@aimixup.com.

We will action your opt-out request without undue delay. Opting out of marketing communications does not affect the transactional and account emails required to provide the service.

5. Data Sharing & Third-Party Services

We do not sell your personal data.

To generate AI responses, we send your prompts, conversation history, uploaded files, and necessary context over authenticated HTTPS to the AI model provider you choose for that conversation. The providers we currently integrate are:

  • OpenAI – standard production API. OpenAI does not train its models on data sent through this API.
  • Anthropic – standard production API. Anthropic does not train its models on data sent through this API.
  • xAI – standard production API. xAI does not train its models on data sent through this API.
  • Google – Google Gemini paid API tier, billed through our Google Cloud project. Per Google's API terms, prompts sent through the paid tier are not used to train Google's models.

Each provider processes the data only as needed to generate the requested AI output, in accordance with their published terms.

We also use the following service providers:

  • Paddle.com (web payments)
  • RevenueCat (mobile in-app purchases)
  • Amazon Web Services – AWS (S3 storage and hosting in the United States)
  • LiveKit – real-time audio/video calls, including call recording and transcription
  • MailerSend – transactional, account verification, and newsletter email delivery
  • Cloudflare – bot protection (Turnstile) on sign-up
  • Sentry – application error monitoring

The following analytics providers are non-essential and are loaded only after you accept them. If you decline, or make no choice, neither of them runs:

  • Google Analytics – website traffic analytics on aimixup.com
  • PostHog – product analytics in the web app

These two are the only analytics providers we use. We do not use session-recording, screen-replay, heatmap or advertising-measurement trackers.

All service providers are bound by appropriate data processing agreements.

6. International Data Transfers

As a Portuguese company, we may transfer personal data outside the European Economic Area (EEA), primarily to AWS servers in the United States and to AI model providers via their APIs.
We rely on the Standard Contractual Clauses (SCCs) approved by the European Commission to ensure an adequate level of protection.

7. HIPAA Disclaimer

AiMixUp is NOT HIPAA compliant.
Our service is not designed or intended for the storage, processing, or transmission of Protected Health Information (PHI) as defined under the U.S. Health Insurance Portability and Accountability Act (HIPAA).
Do not use AiMixUp to handle any PHI or other regulated health data. We do not sign Business Associate Agreements (BAAs) at this time.

8. Your GDPR Rights

You have the right to:

  • Access, rectify, or erase your data
  • Restrict or object to processing (including objecting to direct marketing)
  • Data portability
  • Withdraw consent
  • Not be subject to automated decision-making (where applicable)

You can erase your account and export a copy of your data yourself from Profile → Security in the product. To exercise any other right, email support@aimixup.com. We will respond within 30 days.

9. Data Retention

We keep your data only as long as necessary:

  • Account data: duration of account + up to 2 years after deletion (legal/fraud prevention)
  • Conversations: until you delete them in the product, or your account is deleted. You can delete your account yourself from Profile → Security in the product; deletion deactivates the account immediately and permanently removes your data after a 7-day grace period, during which you can cancel by signing back in. You can also email support@aimixup.com if you prefer we handle it.
  • Payment records: up to 7 years for accounting/tax purposes

10. Security

We protect your data with HTTPS / TLS 1.2+ in transit; passwords are stored only as salted one-way hashes by our identity provider; and access to our databases is restricted to our internal network. Chat messages, AI replies and account tokens are encrypted at rest (AES-256-CBC), and database backups are encrypted before they leave the database server. See our Security & Trust page for current status and roadmap.

11. Children's Privacy

Our service is not intended for users under 18. When you register, we require you to confirm that you are at least 18 years old and to accept our Terms and this Privacy Policy, and we keep a record of that confirmation. We do not knowingly collect data from children. If you believe a child has provided us with personal data, email support@aimixup.com and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy and will notify you of material changes.

13. Contact

For any privacy questions or to exercise your rights, contact:
support@aimixup.com