Privacy Policy

01 Overview

We take your privacy seriously. Given the nature of MedullaOS -- a system that manages deeply personal aspects of your life -- privacy isn't just a legal requirement for us. It's foundational to everything we do.

This Privacy Policy explains what information we collect, why we collect it, how we store and protect it, and what rights you have over your data. We've written this to be clear and human-readable, not to bury important details in legal jargon.

MedullaOS is operated by Jillian Romero. When we say "we," "us," or "our," we mean MedullaOS.

02 Information We Collect

Account Information

When you become a MedullaOS client, we collect basic account information:

• Your name and email address
• Your timezone and location preferences
• Your communication preferences

Life Data You Provide

The core of MedullaOS is the personal data you choose to share with us during the build process and ongoing use. This may include:

• Schedules, tasks, and goals
• Family information (names, birthdays, schedules, preferences)
• Financial information (budgets, bills, account balances)
• Health information (medications, appointments, fitness goals, metrics)
• Contacts and relationship context
• Vehicle information, property details, travel preferences

You decide what goes into your system. We never require more information than is needed for the features you want.

Data from Connected Services

When you connect third-party services to your MedullaOS, we receive data from those services on your behalf. This may include:

• Calendar events and scheduling data (Google Calendar, Apple Calendar)
• Vehicle status and location (Tesla, etc.)
• Financial account balances and transactions (via Plaid)
• Music and media preferences (Spotify)
• Smart home device status and controls
• Email metadata for travel confirmations, receipts, etc.

Usage Data

We collect basic usage data about how you interact with your MedullaOS dashboard, including which modules you use most, page views, and feature engagement. This helps us improve your system over time.

03 How We Use Your Data

We use your data for the following purposes:

• To build and maintain your MedullaOS -- this is the primary reason we collect your data. It powers your dashboard, automations, and integrations.
• To improve your system over time -- usage patterns help us understand what's working and what could be better for you.
• To send you system notifications -- reminders, alerts, and updates that your system generates for you.
• To communicate with you about the service -- maintenance notices, feature updates, billing communications.

Let us be explicit about what we will never do with your data:

• We will never sell your data to anyone
• We will never share your data with advertisers
• We will never train AI models on your personal data
• We will never use your data to build profiles for marketing purposes
• We will never share your data with other MedullaOS clients

04 Data Storage & Security

We understand that you're trusting us with some of the most personal information in your life. We take that responsibility seriously. Here's how we protect your data:

Encryption

• All data is encrypted at rest in our database (Supabase)
• All data is encrypted in transit using TLS/SSL
• Third-party integration tokens and credentials are encrypted with AES-256 encryption

Access Controls

• Access to client data is restricted to authorized personnel only
• Currently, that means Jillian Romero (founder) and any future team members who are under strict NDA agreements
• We use role-based access controls and audit logging

Infrastructure

• Application hosting: Vercel (SOC 2 Type 2 compliant)
• Database: Supabase (SOC 2 Type 2 compliant, built on AWS infrastructure)
• Both providers maintain enterprise-grade security practices, including regular security audits and compliance certifications

05 Third-Party Services

MedullaOS connects to third-party services to power your system. We only share the minimum data necessary with each service. Here are the categories of services we work with:

• Cloud Hosting: Vercel -- hosts the MedullaOS application
• Database: Supabase -- stores your data securely
• Payment Processing: Stripe (future) -- processes payments; we never store your full credit card details
• Calendar Integrations: Google Calendar, Apple Calendar -- syncs your schedule
• Vehicle Integrations: Tesla and other supported vehicle APIs
• Music: Spotify -- for media-related modules
• Financial Data: Plaid -- secure, read-only access to bank account information
• Smart Home: Various providers as connected by you

Each of these services has their own privacy policy and terms of service. We encourage you to review them. Our responsibility covers how we handle data within the MedullaOS platform -- once data reaches a third-party service, their policies apply.

You can disconnect any third-party integration at any time through your MedullaOS dashboard or by contacting us.

06 Your Rights

Your data is yours. Here are your rights, and we make it easy to exercise them:

• Right to Access: You can request a complete copy of all data we hold about you at any time. We'll provide it within 14 days.
• Right to Correction: You can update or correct your information at any time through your dashboard or by contacting us.
• Right to Deletion: You can request that we delete all of your data. We'll complete the deletion within 30 days of your request.
• Right to Portability: You can request your data in a standard, machine-readable format (JSON or CSV). Your data should never be trapped in our system.
• Right to Revocation: You can disconnect any third-party integration at any time, immediately revoking our access to that service's data.

To exercise any of these rights, email us at hello@medullaos.com. No hoops, no friction, no waiting on hold.

07 Data Retention

We only keep your data as long as there's a reason to keep it:

• Active accounts: Your data is retained for as long as you are an active MedullaOS client.
• After termination: When the service ends, we export all of your data to you in a usable format. We then delete your data from our active systems within 30 days.
• Backups: Automated backups that may contain your data are purged within 90 days of deletion from active systems.
• Billing records: We may retain basic billing records (amounts, dates, invoice numbers) as required for accounting and tax purposes, but no personal life data.

08 Children's Privacy

MedullaOS is designed for adults. We do not knowingly collect personal information directly from children under the age of 13.

That said, we understand that family is a core part of many clients' lives. If you're a parent or guardian, your MedullaOS may include information about your children -- names, schedules, school details, activities, and so on. This information is entered and managed by you, the adult client, as part of your system.

If we learn that we have inadvertently collected information directly from a child under 13 without parental consent, we will delete that information promptly.

09 Cookies

We keep it simple:

• Session cookies: The MedullaOS application uses session cookies for authentication -- to keep you logged in securely. These are essential for the service to function.
• No advertising cookies. None. Zero.
• No third-party tracking cookies. We don't let advertisers or analytics companies track you through our platform.

The marketing site (medullaos.com) uses only Vercel's built-in analytics, which collects anonymous, aggregated data (page views, referrers) with no cookies and no personal identification.

10 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements.

When we make material changes, we'll notify you via email at least 14 days before the changes take effect. We'll also update the "Last updated" date at the top of this page.

For non-material changes (typo fixes, clarifications that don't change the meaning), we may update the policy without individual notice, but the date will always reflect the most recent revision.

11 Contact

If you have any questions about this Privacy Policy, your data, or how we handle your information, we want to hear from you.

Email: hello@medullaos.com

MedullaOS is operated by Jillian Romero. We respond to all privacy-related inquiries within 48 hours.