BLUEPRINT · PRIVACY ONE-PAGER
Privacy, on one page.
Written for the person doing the security review. If you need the formal document instead, the Privacy Policy is the binding one; this page is the summary that answers the questions you were about to ask.
mAiSight adds no cookies and collects no personal data, so it adds nothing to your consent banner.
That sentence is deliberately narrow. It is a statement about our software, not a blanket compliance claim about your deployment — you know your own data map and we do not.
What the script loads
- One JavaScript bundle and one stylesheet, both versioned and served from our domain.
- The glossary payload for the page it is mounted on: terms, definitions, and their origins.
- Nothing else. No third-party tag, no analytics SDK, no font or image fetched from an unrelated host, no advertising or tracking network of any kind.
What it sends
Reading events — a term was hovered, a definition was opened, a reader left a section. Each event carries the document, the term, and a coarse duration. That is the whole payload.
What is never collected
| Not collected | What that means for you |
|---|---|
| Cookies | Nothing is written to or read from the reader's device, so there is no storage-and-access for a consent banner to cover. |
| IP addresses | Not retained in any event record. |
| Raw User-Agent | Not stored. No device fingerprint is derived from it. |
| Referer | Not stored, so no cross-site browsing trail exists to leak. |
| Persistent identifiers | No visitor ID, no cross-session or cross-site linkage. We cannot follow one reader from one visit to the next, by design. |
| Reader account data | The widget has no login and never sees one. It does not read form fields, credentials, or any authenticated content of your page beyond the prose it marks up. |
Two of these are enforced rather than promised: automated tests assert that no personal data reaches an analytics event and that the dashboard cannot read raw events at all — only aggregates. Those tests run on every change and a regression fails the build.
What is stored, and where
- Your documents and glossaries, so the reading page can be served. Hosted in the EU (Falkenstein, Germany).
- Aggregate reading counts per document and term. Stored alongside the documents, in the EU.
- Your account and billing details, if you are a paying customer.
Where document text goes during extraction
Building a glossary means sending document text to a language model. By default that is a hosted model under a zero-retention API arrangement. You can also point mAiSight at any OpenAI-compatible endpoint, including a model you run inside your own network — in which case your document text never leaves it and no third-party model provider is involved at all.
The full third-party list, with what each one processes and the region it runs in, is on the subprocessors page.
Deletion
Deleting a document removes it and its aggregates. Closing your account removes everything associated with it. Because we hold no personal data about your readers, there is no reader-level erasure request for us to service — there is nothing keyed to a person to erase.
Paperwork
- Data Processing Addendum — offered up front.
- Privacy Policy — the formal document.
- Subprocessors — dated and public.
- Security — threat model and credential handling.
Anything unanswered goes to codeblackwell@gmail.com and gets a real answer, including "we do not have that."