Privacy Notice

Website, account and service privacy notice · Version 0.2 · Effective date: 4 November 2026

1. Who we are

This Privacy Notice explains how CMB ROBOTICS SRL (“CMB Robotics”, “MimirOne”, “we”, “us” or “our”) collects and uses personal data in connection with the MimirOne website, account registration, communications and the MimirOne platform.

Controller: CMB ROBOTICS SRL, a limited liability company established under Romanian law, registered office at Bacau, str. Bicaz nr. 136 A 5, Romania, registration/CUI number RO 47236726.

Privacy contact: support@cmbrobotics.com (subject line: “Privacy request”). General support: support@cmbrobotics.com. Security reports: security@cmbrobotics.com.

2. Scope of this notice

This notice applies to personal data processed when you visit MimirOne websites, contact us, create or manage an account, subscribe to Huginn or Muninn, use the Professional Continuum and Opportunity features, request support, participate in a pilot or interact with our business communications.

This notice does not replace a separate Data Processing Agreement or other privacy terms that may apply to a business customer’s use of MimirOne. Where a business customer determines the purposes and means of processing personal data it uploads, MimirOne’s role and obligations must be established in the relevant contract.

3. Personal data we may process

3.1 Information you provide

• Account and identity information: name, email address, login identifiers and account preferences.
• Subscription and transaction information: selected plan, billing period, transaction identifiers, payment status, invoices and relevant tax details. Full payment card details are handled by the payment provider rather than stored by MimirOne.
• Professional Continuum content: professional history, skills, experience, examples, work products, evidence, reasoning descriptions, career goals and other materials you choose to submit.
• Opportunity content: role or project descriptions, criteria, prompts, drafts, notes, requested representations and related outputs.
• Communications: support requests, feedback, survey responses, emails and other correspondence.
• Optional information you choose to provide when participating in a pilot, interview, demonstration or research activity.

3.2 Information collected through use

We may process technical and usage information such as IP address, timestamps, browser and device information, authentication and security events, pages or features requested, error reports, performance metrics and service logs.

3.3 Information from other sources

We may receive limited information from payment providers, authentication providers, hosting or security providers, or a third-party platform you choose to connect.

If a recruiter or other opportunity provider invites you to an Opportunity, we receive from them your email address and the details of the Opportunity. They may also record their own evaluation of you in an Opportunity Package. We will update this section if MimirOne begins importing information from employers, social networks, public profiles or other external sources.

4. Why we use personal data and our legal bases

Under the EU General Data Protection Regulation (GDPR), we must have a lawful basis for each processing purpose.

• Provide the service: create and manage accounts, maintain the Professional Continuum, process Opportunities, generate requested outputs and provide features you request. Legal basis: performance of a contract or steps taken at your request before entering into a contract, where applicable.
• Manage subscriptions and payments: process purchases, renewals, cancellations, invoices, fraud prevention and accounting. Legal bases may include performance of a contract and compliance with legal obligations.
• Respond to enquiries and provide support: communicate with you, troubleshoot issues and manage service requests. Legal basis may be performance of a contract or our legitimate interests in responding to enquiries and operating the service.
• Protect and maintain the platform: authenticate users, prevent abuse, investigate security incidents, diagnose errors and maintain reliability. Legal basis may be our legitimate interests, balanced against your rights and freedoms, and compliance with legal obligations where applicable.
• Improve MimirOne: evaluate performance, reliability and usability, and develop features. We do not use identifiable Professional Continuum content to train general-purpose AI models unless a separate, transparent and lawful basis for that use has been established.
• Marketing: send product updates or promotional communications where permitted. Where consent is required, we will request it; where another legal basis is available, we will provide the required information and an effective opt-out. You may unsubscribe from marketing messages at any time.
• Meet legal obligations and establish or defend legal claims: process records where required by law or necessary for legal claims.

5. Professional Continuum content and AI processing

MimirOne helps users structure and use professional experience, knowledge, reasoning, skills, judgments and supporting evidence. Content submitted to the platform may therefore be highly personal or professionally confidential. Users should submit only information they are entitled to provide and should avoid unnecessary sensitive personal data or confidential information belonging to employers, clients or other people.

To provide AI-enabled features, parts of your Content may be processed by third-party AI model providers or other service providers acting on our behalf (see Section 8).

MimirOne does not promise that AI outputs will be accurate or complete. This notice describes data processing, not the quality or limitations of outputs; those are also addressed in the Subscription Agreement and Terms of Service.

We will not use identifiable Professional Continuum content to train general-purpose models for unrelated purposes unless that processing is separately disclosed, lawful, and implemented with the required legal basis and safeguards. If our approach changes, we will update this notice and obtain consent where legally required.

6. Cookies and similar technologies

MimirOne uses only strictly necessary technologies: a sign-in session cookie and a security (anti-forgery) cookie that keep you logged in and protect forms, and browser local storage to remember interface preferences such as whether the navigation panel is collapsed. We do not use analytics, advertising or tracking cookies.

If we introduce non-essential cookies or similar technologies in the future, we will update this notice and, where required, publish a separate Cookie Notice and provide a consent mechanism before using them.

7. Website logs, analytics and security

Web servers and security systems may record technical events necessary to deliver, protect and troubleshoot the website and platform.

If analytics or product measurement tools are introduced, we will identify their purpose, the data involved, the provider and the relevant legal basis. Where consent is legally required for analytics or related technologies, we will obtain it before activation.

8. Who may receive personal data

We may disclose personal data only as necessary for the purposes described in this notice, under appropriate legal safeguards, or where required by law. Recipients may include:

• Recruiters and other opportunity providers, limited to the information you approve for sharing with them.
• Hosting, cloud infrastructure, database, storage, backup and security providers.
• AI model providers used to deliver features requested by the user.
• Payment processors and invoicing/accounting providers.
• Authentication, email delivery, customer-support and communications providers.
• Professional advisers, auditors, insurers and legal counsel where reasonably necessary.
• Competent public authorities, courts or law-enforcement bodies where disclosure is legally required or permitted.
• A successor or transaction counterparty in connection with a corporate restructuring, merger or transfer of business, subject to applicable law and appropriate safeguards.

Our current service providers include:

• Anthropic (Claude models) and Google (Gemini models) — AI processing of Content to generate requested Outputs.
• Creem — payment processing, merchant of record, invoicing and sales tax.
• Hetzner Online GmbH — hosting and database infrastructure (Nuremberg, Germany — EU).
• Namecheap, Inc. — email hosting and delivery of account and invitation emails.

9. International transfers

The MimirOne platform and its database are hosted in the European Union (Nuremberg, Germany). Some service providers listed in Section 8 — Anthropic, Google and Namecheap — are based in the United States, so Content sent for AI processing and email delivery may be processed outside the EEA. Google LLC is certified under the EU–U.S. Data Privacy Framework; Anthropic and Namecheap rely on the European Commission’s Standard Contractual Clauses.

If personal data is transferred outside the European Economic Area, we will identify the relevant transfer mechanism and implement safeguards required by applicable law. Depending on the circumstances, these may include an adequacy decision, Standard Contractual Clauses and supplementary measures.

10. How long we retain personal data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including service delivery, security, dispute handling and legal obligations. Retention varies by data category.

• Account and Professional Continuum data: until account closure or deletion is requested, subject to product functionality, lawful retention and backup cycles.
• Opportunity content and outputs: according to the account’s retention and deletion settings and the user’s instructions, subject to technical limitations and legal requirements.
• Billing and accounting records: for the period required by applicable tax and accounting laws.
• Support and correspondence: for the period needed to resolve the request and maintain reasonable service records.
• Security and technical logs: for a defined, documented period proportionate to security and operational needs.
• Backup copies: until overwritten or deleted under the documented backup cycle, except where longer retention is legally required.

11. How we protect personal data

We use technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, disclosure or destruction. These may include access controls, authentication, least-privilege permissions, encryption where appropriate, backups, monitoring, secure development and contractual confidentiality obligations.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but this does not limit any obligations imposed on us by applicable data-protection law. We will handle personal-data breaches in accordance with our legal obligations.

12. Your rights

Depending on the circumstances and applicable law, you may have the right to request access to your personal data, rectification, erasure, restriction of processing, data portability, or to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time; withdrawal does not affect the lawfulness of processing before withdrawal.

You also have the right to lodge a complaint with the competent supervisory authority. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP). You may also have the right to complain to the authority in your habitual residence, place of work or place of the alleged infringement, as provided by law.

To exercise your rights, contact support@cmbrobotics.com with the subject “Privacy request”. We may ask for information reasonably necessary to verify your identity and will respond within the time limits set by applicable law. We will not discriminate against you for exercising your rights.

13. Children

MimirOne is a professional service intended for adults. It is not designed for children under 18. If you believe a child has provided personal data to MimirOne, contact us so we can assess and take appropriate action.

14. Automated processing and decisions

MimirOne uses AI to assist with organizing professional information and generating user-requested outputs. This includes features that help recruiters and hiring managers carry out opportunity-specific assessments of candidates. These features support human judgment and do not make hiring decisions; recruiters and organizations remain responsible for those decisions, as set out in our Acceptable Use Policy. We assess applicable data-protection and AI-law requirements for these features, including any transparency, lawful-basis, impact-assessment, human-review or other safeguards required by law.

Unless clearly disclosed in the relevant feature and permitted by law, MimirOne is not intended to make solely automated decisions that produce legal effects or similarly significant effects concerning an individual.

15. Links and third-party platforms

The website or platform may contain links to third-party websites or integrations. Their privacy practices are governed by their own notices and terms. We are not responsible for the privacy practices of third parties acting as independent controllers. If a MimirOne integration shares information with an external platform, the interface and applicable notice will explain what is shared and obtain any permissions required.

16. Changes to this notice

We may update this notice to reflect changes to the service, our processing activities or legal requirements. We will publish the revised version with an updated effective date and provide additional notice where required by law. Material changes will not be applied in a way that overrides mandatory legal rights.

17. Contact details

CMB ROBOTICS SRL — MimirOne
Registered office: Bacau, str. Bicaz nr. 136 A 5, Romania
Registration/CUI: RO 47236726
Privacy requests: support@cmbrobotics.com
Security reports: security@cmbrobotics.com
Effective date: 4 November 2026