No analytics. No trackers. No forms.

Who we are and what this covers

Mekai Labs is the controller of the personal data described here. This policy applies to the product site at kivy.mekailabs.com, to the Live Lab at open.mekailabs.com, and to the direct contact that follows from either.

It does not cover data processed inside a paid engagement. Where we run a pilot or a deployment, the data protection terms in that signed agreement govern it and take precedence over this page.

It also does not cover the sites we link to. GitHub, Cal.com and any other third party you reach from here run their own policies.

The short version

• We set no cookies, run no analytics, and use no advertising or behavioural trackers.
• There is no form on this site. Everything we hold about you, you sent us on purpose.
• We do not sell personal data, share it with ad networks, or use it to train models.
• Software you run yourself does not report back to us.
• Ask us to delete what we hold and we will, within 30 days.

What we collect, and where it comes from

We group it by how it reaches us, because that is what decides how long we keep it and who else sees it.

• Visiting the site: our hosting provider records standard server logs — IP address, timestamp, requested URL, response status, user agent and referrer. They exist to serve the page and to absorb abuse. We do not use them to build a profile of you.
• Emailing us: your address, your name if you give it, your message, and anything you attach.
• Booking a call: your name, email and the slot you choose, passed to us by Cal.com. Anything you type into their booking form reaches us with it.
• Using the Live Lab: the file you upload and what we compute from it, held for the length of that session so the page can show you a result.
• Sending sample or project data: the files and context you send so we can run an analysis, plus the correspondence around it.
• Contributing to the open-source repositories: whatever GitHub publishes with your contribution, under GitHub's own terms.

Cookies and similar technologies

We set no cookies. There is no analytics script, no tag manager, no pixel, no session recorder and no fingerprinting on this site, which is why you are not being asked to dismiss a consent banner.

Our hosting provider may set a strictly necessary cookie to route traffic or to mitigate an attack. That is required to deliver the site and carries no marketing purpose. If you block it, the site still works.

We honour Do Not Track and Global Privacy Control signals by default, because there is nothing here for them to switch off.

Why we process it, and on what legal basis

• To answer you and run the conversation you started — performance of a contract, or steps taken at your request before entering one, and otherwise legitimate interest in responding to enquiries.
• To keep the site available, correct and secure — legitimate interest in protecting our own systems.
• To run an analysis on data you sent us — performance of a contract, or your consent where no contract exists yet.
• To meet tax, accounting, statutory or regulatory obligations — legal obligation.
• To establish, exercise or defend a legal claim — legitimate interest.
• Where consent is the correct basis we ask for it plainly, and you can withdraw it at any time without affecting what we did before you withdrew it.

Who else processes it

We keep the list short and name it honestly, so you can check each one yourself.

• Cloudflare — hosting, content delivery and denial-of-service protection. Processes server logs and traffic metadata.
• Titan — business email. Processes the contents of correspondence with us.
• Cal.com — scheduling. Processes the name, email and time you enter when booking.
• GitHub — public code repositories and issue tracking. Processes whatever you publish there yourself.
• Professional advisers, such as accountants or lawyers, where we are obliged or entitled to instruct them.

Transfers outside your country

We operate under the laws of India, and the providers above operate internationally, so your data may be processed outside the country you are in.

Where a transfer out of the EEA or the UK needs a safeguard, we rely on the mechanism the provider has in place — usually the European Commission's standard contractual clauses together with the UK addendum, or an adequacy decision where one applies. Write to us and we will tell you which one covers a given provider.

How long we keep it

• Server logs: for the hosting provider's standard security retention window, then discarded.
• Email threads and booking records: for as long as the relationship is active, and afterwards for as long as tax, accounting or limitation periods require.
• Live Lab uploads: for the session, then removed.
• Sample and project data: until the analysis is complete, then deleted or returned. Earlier if you ask.
• Anything covered by a legal hold: until the hold is lifted.

Your rights

Whichever law applies to you, these are the things you can ask us to do. We do not charge for a reasonable request and we do not treat you differently for making one.

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have it deleted, where we have no overriding obligation to keep it.
• Restriction — have us pause processing while a dispute is resolved.
• Objection — object to processing we base on legitimate interest.
• Portability — receive data you gave us in a structured, machine-readable form.
• Withdraw consent — at any time, where consent was the basis.
• Nominate — under India's Digital Personal Data Protection Act, nominate someone to exercise these rights if you die or become incapacitated.

How to exercise them, and how to complain

Write to [email protected]. Tell us what you want and enough detail to find your records. We reply within 30 days, and if a request is complex we will tell you before that deadline rather than after it.

Kaustubh Krishna is our grievance officer for the purposes of India's Digital Personal Data Protection Act and can be reached at the same address.

If you are not satisfied with our answer: in India you may escalate to the Data Protection Board of India; in the EEA or the UK you may complain to your supervisory authority. We would rather you came to us first, but you are not required to.

Automated decisions and profiling

We do not make decisions about you by automated means, we do not profile you, and we do not score you. Nothing on this site adapts itself based on who you are.

Software you run yourself

Mekai Open runs on your own infrastructure. It does not phone home. Installing it, running it, or pointing it at your machine, robot, PLC or site data does not send any of that to us.

If you choose to send us a result, a capture file or a log, it becomes direct contact data under the sections above and is handled the same way. Do not upload data to the Live Lab that you are not permitted to share.

Security and breach notification

Access to email, bookings and any shared project data is limited to the people who need it to do the work. We use provider-managed encryption in transit and at rest, multi-factor authentication on the accounts that support it, and we keep the number of systems holding personal data deliberately small.

No system is perfect. If a breach is likely to affect you we will tell you and the relevant authority within the timeframe the applicable law sets, describe what happened, and say what we are doing about it.

Children

This is a business website. It is not directed at children, we do not knowingly collect data from anyone under 18, and if we learn that we have, we delete it.

Changes to this policy

We revise this page when what we do changes. The version and date at the top tell you which one you are reading; this is version 1.0, dated 3 August 2026.

If a change materially affects how we handle data you already sent us, we will say so directly rather than relying on you re-reading the page.