Privacy policy

1. Who we are

The controller of your personal data is CORERA AI, UAB (company code 307643258, VAT number LT100020580416), address: Rodūnios kel. 5, LT-02189 Vilnius, Lithuania. Mist Studio is a trade mark of this company.

You can write to us about personal data at hello@miststudio.io.

This policy covers the miststudio.io website, the free website checks, call booking and the client portal at portal.miststudio.io. Where we process personal data on a client’s behalf under a contract (for example, visitors to the client’s own website), the client is the controller and we are the processor. A separate data processing addendum under Article 28 GDPR then applies and forms an integral part of the contract.

2. What data we process and why

Below we describe each case: what data we receive, why we need it and what we rely on to process it. Legal bases refer to Article 6(1) GDPR.

2.1. Visiting the website

When you open any of our pages, your browser sends our server a request that includes your IP (internet protocol) address, browser type and the address of the page. Railway hosts the website and the portal, so this hosting service also processes that data technically.

In addition, your browser itself contacts the servers of several providers, so they receive your IP address and browser details:

• Sanity – on the homepage, the site content is loaded from Sanity’s servers;
• Cal.com – on the homepage, on the /agents page and on some portal pages, the call booking module is loaded even if you never click it;
• WordPress (mShots), thum.io and Simple Icons – only on the unindexed /senas page (the previous version of the homepage): website screenshots and icons.

We do not use visitor analytics or advertising trackers on the website. On /agents we only keep anonymous view counters (day and language), with no IP address and nothing else that could identify a visitor.

Legal basis: legitimate interest (Art. 6(1)(f)) – to serve you the page and keep the website working and secure.

2.2. Cookies and browser storage

We use few cookies and little browser storage, only so that the website and the portal work and remember your choices. We do not use advertising or analytics cookies.

On the website

• NEXT_LOCALE (set by us) – a language tag for the page, for example “en” or “lt”. It contains no personal identifier. Lasts 365 days.
• __cf_bm (set by Cal.com when its booking module loads; stored on Cal.com’s domain) – a Cloudflare bot-management cookie. Lasts 30 minutes.
• mist-lang (browser storage, not a cookie) – the website language you picked. It is written only when you pick a language, stays on your device and is not sent to us.
• ma-view (browser session storage, not a cookie) – a flag that we have already counted this view of the /agents page in this browser session. It disappears when the session ends.

In the portal

• Sign-in session cookies (set by the Supabase authentication library) – so that you stay signed in. Last up to 400 days or until you sign out.
• NEXT_LOCALE_PORTAL and MIST_PORTAL_THEME (set by us) – the portal language and colour theme you picked. The language is set when you change it or when you sign in (from the language saved in your account), the theme when you change it. Last 365 days.
• mist_agents_beta (set by us) – a flag that you entered the password of the closed agents beta. Lasts 30 days.
• gsc_oauth_nonce and gmail_oauth_nonce (set by us) – a one-time security token while you connect a Google account. Lasts 10 minutes.
• Unfinished estimates and questionnaire drafts (browser storage) – so that you do not lose what you typed. Estimates are kept for up to 30 days, questionnaire drafts until you save the questionnaire or clear your browser data.
• mist-intentional-signout (browser session storage, not a cookie) – a flag that you signed out yourself. It disappears when the session ends.

You can delete or block cookies and browser storage in your browser settings; some features, such as signing in, will then stop working.

Legal basis: legitimate interest (Art. 6(1)(f)) – to keep the website and the portal working; for sign-in cookies also performance of a contract (Art. 6(1)(b)). These cookies are needed for the site to work and stay secure, so we do not ask for consent for them.

2.3. The free website check on the homepage

You enter a website address and our server fetches that website’s homepage, its robots.txt file and its sitemap, then calculates three scores. We use the address only for this check. So that the same address does not have to be measured again, we use the result from the server’s memory (not from a database) for no more than one hour. After that the entry is no longer used, but it may stay in memory until newer entries push it out or the server restarts.

We turn your IP address into a hash calculated with a salt (SHA-256) – a digital fingerprint rather than the real address – and use it only to limit repeated requests and stop abuse. The hash is held only in the server’s memory, is not written to the database and disappears when the server restarts. It is pseudonymised data, so we treat it as personal data.

The server log may keep a record of the address checked, the status of the check and how long it took. We do not use cookies for the check. If you sign up for the portal after the check, the result is saved in your portal (see 2.7).

Legal basis: legitimate interest (Art. 6(1)(f)) – to run the check you asked for and to protect against abuse.

2.4. The check and email form on /agents

The /agents page has a separate free check. The website address you enter there goes into our job queue, an AI agent checks it, and the result is shown on the page. We also record the link you came from and any advertising campaign tags (UTM) in the address. The result gets its own link that you can forward to a colleague: anyone who has it can open it, but search engines do not list it. To limit repeated requests we write a hash of your IP address to the database for a short time: entries older than two hours are deleted when the next check runs.

If you leave your email address after the check so that we send you the full audit, we save the email address, the website address checked, the findings and the IP hash, and get in touch with you about the audit. The free check on the /agents page works the same way as the homepage check.

Legal basis: for the check – legitimate interest (Art. 6(1)(f)); for the email address – your consent (Art. 6(1)(a)), which you can withdraw at any time.

2.5. Booking a call

You book a call in Cal.com: there you pick a time and enter your name, your email address and what the meeting is about, and optionally a phone number, notes and the email addresses of extra guests. The call takes place in Cal Video, Cal.com’s video call service. We use this data to arrange the meeting and to hold the conversation.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b)).

2.6. Business contacts and correspondence

When you write to hello@miststudio.io or we talk about working together, we receive your email address, your name and the content of your message, and sometimes your company name, job title and phone number. We keep this data in our contact management system (CRM) together with notes about our conversations, so that we can reply and continue the conversation. We get contact details from you (enquiries, bookings, sign-up) or from public company sources (company websites and registers). If we did not get a contact from you, we say so in our first email. Hostinger hosts the mailbox.

Legal basis: legitimate interest (Art. 6(1)(f)) – to answer enquiries and keep business relationships; when you ask about our services – steps taken at your request before entering into a contract (Art. 6(1)(b)).

2.7. Portal account

When you register in the portal you tell us whether you are registering as a company or as a private person, and give your first and last name, your company name (companies only), your email address and a password. If you came from the free website check, we also save the website address checked and the result, which appears in your portal as your first audit. Without your name, email address and password we cannot create an account.

The password is handled by the Supabase authentication service and we do not store it in plain text. Password reset emails are sent by the same service. From your registration details we create a client record (named after your company or after you), so that you can see your data in the portal. You can change your name, password, portal language and colour theme, and optionally add a phone number.

In the activity log we record who did what in the portal and when (for example registered, ordered, confirmed, signed, wrote a message), together with your email address. In a registration entry our team sees the name, email, company and the address checked. We also use the log to see where clients get stuck in the portal. The sign-in service may technically record sign-ins. For sign-in security, Supabase keeps sign-in logs (IP address and browser details) under its own rules.

Legal basis: performance of a contract (Art. 6(1)(b)) – to give you access to the portal; the activity log – legitimate interest (Art. 6(1)(f)) in security, accountability, resolving disputes and analysing portal use, so that we can help clients and improve the portal.

2.8. Orders, contracts and invoices

When you order services in the portal you give your own or your company’s details (name, company code, VAT number, address) and answer questions about your business and website. When you sign a contract annex you enter your first and last name and, if you sign for a company, your job title. We record the time of signing, the version of the terms, your confirmation of the limitation of liability and a copy of the annex as you saw it when signing. We do not store your IP address or browser details when you sign. When you sign a contract annex we record your full name, position, the time of signing and the terms version; we do not record your IP address.

We issue invoices for your orders; an invoice shows the buyer’s details (name, code, VAT number, address). In the portal you see the list of invoices and their payment status. You pay invoices by bank transfer to our account at Revolut Bank UAB. From the bank we receive account transaction data (names of payers and payees, account numbers, amounts and references) and match incoming payments to invoices.

Legal basis: performance of a contract (Art. 6(1)(b)); invoices and other accounting documents – legal obligation (Art. 6(1)(c)); signature records – legitimate interest (Art. 6(1)(f)), because we must be able to prove who signed what and when.

2.9. Messages, files and comments

In the portal you can write messages to our team (up to 2,000 characters), attach a file (up to 25 MB), comment on audit findings and ask for documents, for example a data processing addendum. We process the text of messages and comments, files together with their name, size, note and upload time, and your account email. The text of a message is visible to the other users of the same client account and to our team; we are notified of it in the portal and by email. The beginning of the message (up to 120 characters) and your email address are also written to the activity log. Files are stored in Supabase file storage and are visible to the same people.

Legal basis: performance of a contract (Art. 6(1)(b)).

2.10. Emails from the portal

The portal sends you emails about events in your account, for example a new audit or a comment. We use your email address and portal language. You can switch these emails off in the portal settings. The weekly summary of the work (when it is switched on) goes to the client’s contact email address. Resend sends the emails.

Legal basis: performance of a contract (Art. 6(1)(b)).

2.11. AI agents and Google connections

The portal runs AI agents (for now a closed beta). When you order a job, we send its data – your website address and public content, the client name (for a private person, their first and last name), findings of an earlier audit, your note on the order and, if you connected it, Search Console statistics – to an Anthropic AI model. The agents prepare reports, drafts and plans, and you approve or reject the drafts. When preparing outreach drafts to potential customers, the agent uses publicly available business information about companies, such as the content of their websites. It never sends the emails itself: a person sends them, and only after you approve. We make no solely automated decisions about you as a person that have legal effects.

If you ordered an SEO (search engine optimisation) service or take part in the closed beta, you can connect Google Search Console (Google’s search statistics service). We then get read-only access to search statistics (clicks, impressions, positions), and the access token is kept in a table that only our administrators can see. You can revoke access at any time in your Google account. Beta participants are also offered a Gmail connection, for reading email and creating reply drafts. In that case we send an Anthropic model the sender, subject, date and first 300 characters of up to 15 emails received in the last 7 days, and we save the drafts in your Gmail and in the portal. Our system does not send email, but the Google permission it uses (gmail.compose) technically allows sending as well. We do not offer a Gmail connection at the moment. If we switch it on, we will update this policy.

Legal basis: performance of a contract (Art. 6(1)(b)). If the agents process third-party data on your instructions (for example, senders of emails you received), you are the controller and we are the processor (see section 1).

3. Who receives your data

We pass data only to service providers we could not provide the website and the portal without, and only as much as their task needs. We pass data to processors under Article 28 GDPR. We disclose data to public authorities only when the law requires it. Each processor’s standard data processing terms apply.

• Railway – hosting of the website, the portal and the agents’ job runner. Receives request data (IP address and so on) and everything our applications process.
• Supabase – database, sign-in and file storage. Receives account, order, contract, message and file data. The database runs in Frankfurt, Germany, in the European Union.
• Cal.com – call booking and video calls (Cal Video). Receives the data entered in the booking form and, when the module loads, your IP address.
• Hostinger – the hello@miststudio.io mailbox. Receives message content and addresses.
• Resend – sending portal emails. Receives the recipient’s email address and the text of the email.
• Anthropic – AI models for the agents. Receives job data (see 2.11) and, for the /agents check, the website address entered and that website’s content.
• Google – Search Console and Gmail data only if you connect them. Since 14 October 2026 we host our fonts ourselves, so Google Fonts no longer receives your IP address.
• Sanity – the website’s content management system. A browser opening the homepage fetches content from Sanity’s servers, so Sanity sees its IP address.
• Revolut Bank UAB – our bank. Passes account transaction data to us (payers, payees, amounts, references).
• WordPress (mShots), thum.io, Simple Icons – only on the /senas page. They receive your IP address and browser details.

4. Transfers outside the European Economic Area

Some of the providers listed above may process data outside the European Economic Area (EEA). Our database (Supabase) runs in Frankfurt, Germany. Some providers (Railway, Cal.com, Anthropic, Google, Sanity) are US companies. Data is transferred to them under the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. When we transfer data outside the EEA, we apply the safeguards set out in Chapter V GDPR.

5. How long we keep data

We keep data only as long as the purpose we collected it for requires, or as long as the law requires.

• Free check result – used for no more than one hour; the entry may stay in the server’s memory until newer entries push it out or the server restarts. IP hash – in the server’s memory while the server runs.
• IP hash of the /agents check (repeat-request limit) – entries older than two hours are deleted when the next check runs.
• Job records of the /agents check (website address, the link you came from, result): 24 months.
• Cookies – see 2.2.
• Server logs: Railway keeps them under its own rules; our application does not write IP addresses to its logs.
• Contact and correspondence data (emails, CRM, Cal.com bookings, /agents email addresses with the IP hash): 24 months from the last contact.
• Portal account, orders, messages and files – while you have an account. When a user account is deleted, we delete the sign-in data and remove that user’s name and email from the activity log and file descriptions; the name or email may remain in the order history, in notifications sent to colleagues and in signed annexes. We can delete the client (company) record on request if the client has no signed contract or issued invoices, but order (CRM) records, invoices, bank payment data and files in storage are not deleted with it automatically. Period after the contract ends and how these are removed: once you delete your account we remove its data within 30 days, except contracts and invoices.
• Signed contracts and signature records – kept as legal evidence, so we cannot delete a client who has a signed contract, and deleting an account does not remove the signature record. Kept for 10 years after the contract ends.
• Invoices and other accounting documents – for the period set by law. Kept for 10 years.
• Activity log (who did what in the portal): 24 months.

6. Your rights and how to use them

Under the GDPR you have the right to:

• find out whether we process your personal data and get a copy of it (Art. 15);
• have inaccurate data corrected and incomplete data completed (Art. 16);
• have your data erased (Art. 17) when there is no longer a basis to process it. We cannot erase data that we must keep, or have a legitimate interest in keeping, for example signed contracts and invoices;
• restrict how your data is processed (Art. 18);
• receive the data you provided in a structured, commonly used format and pass it to another controller (Art. 20), where we process it by automated means on the basis of consent or a contract;
• object to processing based on legitimate interest (Art. 21);
• withdraw consent at any time; withdrawal does not affect processing carried out before it (Art. 7(3)).

To use a right, write to hello@miststudio.io and say what you ask for. To make sure it is you writing, we may ask you to confirm your identity. We will answer within one month at the latest; for a complex request we may extend that by two further months and will tell you so. The answer is free of charge, unless requests are manifestly unfounded or keep repeating.

7. Complaints to the supervisory authority

If you believe your data is processed in breach of the GDPR, you have the right to lodge a complaint with the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI): vdai.lrv.lt. We would gladly sort the matter out with you first, but you can turn to the VDAI at any time.

8. Data security

The connection to the website and the portal is encrypted (HTTPS). In the portal each client sees only their own data; database access rules enforce this. Access tokens for Google accounts are kept in a separate table that clients cannot see. We do not store passwords in plain text.

9. Changes to this policy

We may update this policy, for example when we start using a new service provider or change how we process data. The current version is always published on this page, and its date is shown at the top.