Privacy Policy

Who we are

Mellon by TS Labs is an experimental software product operated by [FULL LEGAL NAME — to be supplied], an individual/sole trader based in Victoria, Australia, using the TS Labs brand. TS Labs is not an incorporated company. References to ‘we’, ‘us’ and ‘our’ mean that individual operator, not a separate TS Labs or Mellon company.

Business contact address: [PUBLIC BUSINESS CONTACT ADDRESS — to be supplied]. ABN: [ADD ONCE ISSUED]. ABN and TS Labs business-name registration are being prepared; these drafts do not represent either as completed. Contact: support@tslabs.cloud.

This policy covers Mellon, its website, AI companions and support. It does not automatically cover other TS Labs products. The individual operator identified above is responsible for Mellon's handling of personal information and is the controller where data-protection law uses that term. For privacy questions or requests, email support@tslabs.cloud.

Mellon is an English-language service for adults aged 18 or older. Miso and Biscuit are fictional AI characters. They are not real animals or people.

Information we collect

We collect information you provide and information needed to operate the service:

• Account and access information: your email if you register, authentication identifiers, session records, and records of the notices and terms you accept. Registration, sign-in and password recovery also process credentials or reset information through Mellon's server and Firebase Authentication. Guest accounts have an identifier even though no email is required.
• Your companion and conversations: your chosen pet, messages, generated replies, and the times and status of exchanges.
• Memories and dates: saved or suggested scrapbook entries, their source excerpts, corrections, approval and forgetting records, and important dates, timezones, and acknowledgement choices you provide or confirm.
• Feedback and support: reply ratings, reasons, optional notes, and the information you include when contacting us. Send feedback saves your message and any optional reply email, and queues an internal notification addressed to support@tslabs.cloud. Email delivery is not yet configured; this does not send an automatic reply to you.
• Paid-plan interest: if you register interest, we store one current choice per account, your account email for internal support identification, the displayed offer version and choice times. We also queue an internal notification addressed to support@tslabs.cloud. Interest does not subscribe you to launch emails, create a subscription or change your chat allowance. You can withdraw through Your account; withdrawal clears the copied email and pending notification, retaining a minimal version record to prevent stale requests restoring your interest. Both conversation and account deletion include these records and queued notifications. Interest records are separate from optional usage analytics and are not supplied to the pet or AI provider. Email delivery is not configured in the current implementation.
• Technical and usage information: message allowances, request and failure information, security counters, and model usage measurements. Our hosting and authentication providers also process connection information such as IP addresses and browser details. Mellon's network abuse controls use a keyed representation of a network address rather than saving the raw address in those counters; this does not mean providers never process an IP address.

Messages can contain sensitive information, such as health, grief, relationships, or financial circumstances. You do not need to provide sensitive details to use Mellon. Please share only what you want the operator and service providers to process. Do not put passwords, payment details, government identification numbers, or other people's private information into chats or support messages. Enter credentials only in the appropriate account forms.

How we use information

We use information to maintain your account, provide conversations, remember relevant things you have shared, deliver confirmed in-app occasion greetings, operate your scrapbook controls, respond to support and privacy requests, investigate faults and feedback, and protect the service against abuse.

We record operational measurements to understand reliability and running costs. Our model-usage events record counts, timing, and outcomes rather than conversation or memory text. This does not remove the conversations and memories stored as part of the companion experience.

We do not sell personal information or use private conversations for targeted advertising. We do not publish private conversations or use them as testimonials without separate permission.

Payments — future service only

The current beta does not collect payment-card details or offer paid subscriptions. Stripe is the planned processor for a future paid offer, not a current Mellon billing integration. Before payments begin, this policy must identify the actual billing information Mellon receives and retains, Stripe's role and international processing, and the applicable retention arrangements. [PAYMENT DATA DETAILS — complete against the final integration before paid launch]. Do not send card details to support.

Optional usage counts

Sharing basic onboarding and return-visit counts is optional and off unless you choose it separately. It is not required for your pet, chat allowance or AI-processing consent. You can change the choice under Privacy choices beside your account controls. Turning it off removes your account-linked usage records.

If you opt in, we store limited first-party lifecycle metadata: whether adoption and early completed-chat milestones occurred, guest registration, coarse UTC visit days and whether a later visit included a completed exchange. Fixed catalogue character IDs and fixed campaign-source labels may be included. These records are linked to your account, including a guest account; they are pseudonymous, not anonymous. We do not include chat or reply text, memories, dates, feedback notes, email, passwords, reset links/codes, raw URLs/referrers, IP addresses or detailed device information in these usage records. No external analytics vendor or session replay is added.

The optional choice and its account-linked usage records expire no later than 90 days after the choice. Expired records are immediately excluded from usage reports. Physical removal uses bounded maintenance batches and depends on the protected daily maintenance job or authorised cleanup being run; it is not a guarantee that every stored copy disappears at the exact 90-day instant. Turning the choice off removes the current records, and account or full conversation-history deletion also removes them. After conversation-history deletion, usage sharing is off until you choose it again. Provider-managed logs/backups can have different retention.

Optional invited beta study and service reliability — draft update

An invited adult may separately opt into the beta study at /research before starting a live account or pet journey. Reading the notice creates no account or participant identifier. After explicit study consent, we save a random enrolment identifier, consent version/time, a fixed recruitment wave and coarse source, then only the usage milestones and UTC return days described above. Enrolment counts include consenting people who never adopt or send a first message. The same optional usage permission applies when linked to a verified account; there is no separate tracking store that overrides an opt-out. An invitation issued is not proof of delivery, participation or voluntary return.

Study permission and attributable enrolment records expire after 90 days. Invitations expire after 14 days. Before starting, withdraw at /research using the same browser; after account linking, use Privacy choices or sign into the original account to withdraw there. Opt-out, conversation deletion and account deletion remove linked study records; expiry is excluded immediately and bounded daily maintenance removes remaining copies. No chat, memory, date, feedback, email, raw IP/referrer or device fingerprint is recorded in this study. Recruitment reports omit participant identities and explain missing telemetry, immature windows and removal of withdrawn participants.

Separately, essential service-health measurements count fixed access/adoption/recovery failures, chat stages, provider work, browser-reported display timings and memory processing outcomes. Daily aggregates contain counts and coarse latency histograms, with no user/request IDs, content, emails, credentials, raw URLs, network addresses or device fingerprints. These diagnostics operate independently of optional research consent and cannot identify a participant or form an account behaviour trail. Existing owned reply/job records keep small deduplication guards, removed with those records. Aggregates expire logically after 14 days following their UTC day; physical cleanup uses bounded maintenance batches and can lag. Browser timings are best-effort observations, not proof of reading, and missing metrics are not evidence of healthy service. No external analytics vendor, session replay, email alert or production log drain is added by this change.

AI processing and memory

We send conversation content and relevant context to OpenAI to generate replies, identify possible memories and dates, and support memory search. Search can send eligible saved memories and text from your current or recent conversation to create numerical representations used to find relevant memories.

This processing can include sensitive information before you approve any scrapbook entry. Approval controls whether an entry can be used as a saved memory; it does not prevent a message you send from being processed to reply or suggest memories. Automated classification and recall can make mistakes.

We request that generated responses are not saved as OpenAI response history. This is not a zero-retention guarantee. OpenAI's published API default is not to use API content for model training unless the account holder opts in. Its data controls also allow security/abuse logs and temporary processing caches; standard abuse logs can retain content for up to 30 days, with longer retention in stated legal or safety circumstances. See OpenAI's API data controls.

Mellon does not run its own model-training or fine-tuning pipeline on your chats. Processing replies or building scrapbook memories is different from training model weights.

Providers, team access, and overseas processing

We use Google Firebase Authentication for account authentication and password-reset emails/codes, Google Cloud Firestore for application records, Vercel to host and operate the app, and OpenAI for AI processing. These providers process information needed to perform their functions and maintain their services.

Information can be processed outside Australia and outside your country, including in the United States. Provider locations and subprocessors can change. Contact us if you need information about the arrangements relevant to your data.

The operator and authorised people assisting with Mellon can access stored information where needed to operate the service, handle support and privacy requests, investigate faults or abuse, and review submitted feedback. Conversations are not end-to-end encrypted between you and the fictional companion. We can also disclose information when required by law or where legally permitted to protect people or the service. Support correspondence is also processed by the operator's email service. [SUPPORT EMAIL PROVIDER AND PROCESSING LOCATIONS — confirm before publication].

Provider information is available from Google's Firebase privacy information, Vercel's Privacy Policy and OpenAI's API data controls. These describe provider practices; they do not replace this policy or reduce our responsibilities. We do not represent that all data stays in Australia or that a particular international-transfer safeguard has been verified.

Cookies and guest access

Mellon uses the essential mellon_pet_session cookie to recognise your browser and maintain access, with a lifetime of up to 30 days. It is protected from access by page scripts and sent securely over HTTPS. Blocking or clearing it can prevent signed-in or guest access. The current app does not add advertising cookies, third-party analytics or session replay. Optional usage measurement is described separately above.

You can browse fictional previews without adopting a pet. Continuing as a guest creates a server account and saves conversations; it is not an anonymous or temporary mode with automatic deletion. Clearing or losing the cookie can remove your way back to that guest account. It does not delete the stored records. Registration provides a way to return using your email and password.

Your choices and requests

You can review scrapbook entries and their sources, approve suggestions, correct entries, change available privacy/expiry choices, or choose Forget. You can also review and remove important dates, and change or remove reply ratings.

Forgetting clears the saved memory text and copied source excerpts and keeps limited topic/bookkeeping information to prevent old processing from recreating it. The original conversation remains stored. Memory controls can also make earlier messages unavailable as context for later replies; the app explains the effect when you use them.

For access, a copy of your information, correction, withdrawal of AI-processing consent, or a request to delete your account or conversations, email support@tslabs.cloud. We may need proportionate ownership verification before disclosing or changing records. We will explain any information needed, limitations, or lawful reason why a request cannot be fulfilled. The beta does not currently provide a self-service account-deletion or full-history export tool. Signing out stops your session, but does not itself withdraw processing consent or delete stored data; pending background processing may continue until consent is withdrawn or deletion is arranged.

Full conversation-history deletion is different from forgetting a card: it covers all conversations and their derived memories, copied excerpts, search representations, dates, greetings and reply feedback, including manually entered dates and corrected cards, while retaining your account and pet identity. Account deletion additionally covers the account and its linked authentication identity. These are operator-assisted requests, not an in-app option to delete individual messages. We explain the scope and verify ownership before acting. Limited security counters and pseudonymous deletion/replay records can remain to prevent abuse or recreation; provider logs and backups are outside the application's direct erase operation.

Retention and security

We retain your account, conversations, and scrapbook records to maintain your shared history. The current beta does not automatically erase inactive accounts or chat history after a fixed period. Signing out, clearing a cookie, or allowing a memory to expire for recall does not delete all associated records. Some expired security/session records remain stored until cleanup.

We consider deletion requests separately from memory-forgetting controls. Information that must be kept for legal, security, or dispute purposes, and provider-managed logs or backups, can have different retention requirements. We will explain relevant limits when handling a request rather than promise immediate removal from every system.

We use authenticated access, server-side ownership checks, protected sessions, and the security facilities of our providers. No internet service can guarantee complete security. Avoid sending information you cannot accept being processed in the ways described here.

International privacy rights

Privacy rights depend on the law applicable to the operator and your use of Mellon. Where the EU GDPR, UK GDPR or another data-protection law applies, you may have rights to access and correct information, request erasure, restrict or object to processing, receive eligible data in a portable form, and withdraw consent without affecting earlier lawful processing. These rights have legal conditions and exceptions. Contact support@tslabs.cloud; we will handle requests within applicable statutory time limits, explain any refusal and available review or complaint route, and notify you of any lawful extension.

If GDPR applies, each purpose needs an appropriate lawful basis. [LEGAL REVIEW BEFORE RELEVANT LAUNCH: confirm and finalise the basis for each purpose — contract necessity for requested account/companion services; legitimate interests, with an assessment, for proportionate security, troubleshooting and support; consent for optional usage counts; and legal obligation for legally required records. Separately confirm the basis for core AI processing and any explicit-consent or other permitted condition for health or other special-category data.] The existing AI acknowledgement must not be assumed to satisfy every country's consent requirements. Withdrawing consent can prevent further AI use where that processing depends on consent; it does not require giving up unrelated privacy rights.

[INTERNATIONAL TRANSFERS AND REPRESENTATIVES — complete before an EEA/UK offer where required: identify the applicable transfer mechanisms, how to obtain information or a copy of safeguards, and any required EU/UK representative and contact details]. We have not verified contractual safeguards or adequacy arrangements for every transfer and make no claim of GDPR certification or blanket compliance. Overseas processing is described above; using Mellon is not, by itself, consent to waive transfer protections.

Mellon uses automated systems to generate replies, suggest memories and operate security limits. The companion is not designed to make decisions with legal or similarly significant effects about you. Contact support to question an account restriction or an inaccurate record. You may complain to your competent data-protection authority where the relevant law applies, including the EEA supervisory authorities or the UK Information Commissioner's Office.

Children, complaints, and changes

Mellon is not intended for anyone under 18. If you believe a child has provided personal information, contact support@tslabs.cloud so we can investigate and take appropriate action. Do not send identification documents in an initial email.

For a privacy complaint, email us with a description of the concern. We will consider it and respond, asking for further information where necessary. Depending on the law that applies to you, you may also have access, deletion, restriction, objection, portability, withdrawal-of-consent, or complaint rights. Contact us to exercise applicable rights. Withdrawing consent does not undo earlier lawful processing; it can prevent further live use where that processing is necessary. You can complain to the privacy regulator relevant to you. In Australia, information is available from the Office of the Australian Information Commissioner.

We will update this policy when our practices change and revise the date above. We will bring material changes to your attention before they apply where required and obtain fresh consent when legally necessary. If Mellon later moves to a separate company or another operator, we will identify the new operator, explain relevant data handling and give any notice or obtain any consent required by law before the change. This policy does not authorise unrelated use of your chats across other TS Labs products.