Who we are
Mellix Limited is a company registered in England and Wales with company number 17551068. Its registered office is at 1 Parkside Court, Greenhough Road, Lichfield WS13 7FE. Mellix Limited decides how the personal data described here is used, which makes it the controller under UK data protection law. You can reach us through our contact form.
This notice covers this website, including the playground and the contact form, and the console and the Decision API that we run at console.mellix.com and api.mellix.com.
What we collect
The playground. The text you type into the playground, which is the situation, the question and any options, is sent to the Decision API. The API decides the answer in memory. The text is not stored, by us or by the API. Our logs of playground use hold counts only, such as how many requests were answered or refused, and never the text.
Limits and bot checks. To stop abuse, the playground and the contact form each keep a short-lived counter of how often they have been used from your IP address. The counters are held in Upstash, a Redis service. The playground's lasts for up to one day and the contact form's for about two hours. Vercel BotID checks playground requests and contact form messages for automated traffic, using technical details about your browser and the request.
The contact form. If you send us a message, we receive your name, email address, organisation if you give one, the topic you choose and your message. It arrives as an email in our inbox, sent through Resend. Our logs of the form hold counts only, never what you wrote.
Model access requests. You request access to our CPU models in the console. We receive the details you enter on the request form, such as your company, role and what you want to use the model for, together with your console account, and use them to decide on the request.
The console. If you open an account at console.mellix.com, we collect your name and email address, and the profile details Google or GitHub share if you sign in with them. We also keep the organisations you belong to and your role in each, invitations you send, your API keys, usage per key, workspace and model, your credit balance and top-up settings, and an activity log of every change made in the account. We also keep a security log of sign-ins, account changes and refused actions, with the IP address, approximate country and browser each came from; the account's owners and admins see the IP addresses in its activity log. Card details are entered with Stripe and held by Stripe, never by us.
The Decision API. The API does not store the states, questions or answers of live requests. For each key it records the time, status, number of requests and number of input tokens, so that we can apply limits, show you your usage and bill your credit. Its access log records the method, path, status, time taken and request id of each request, with no content. Batches are the exception: see who processes it, below.
Cookies and storage
We do not use advertising or analytics cookies or scripts, and nothing we store is used to track you. Everything below is needed for something you asked for or to keep a service secure, so we do not ask for consent, but we want you to know what it is.
The console (console.mellix.com) sets three first-party cookies: sb-…-auth-token keeps you signed in (up to 400 days, renewed while you use it); sb-…-auth-token-code-verifier protects a Google or GitHub sign-in while it completes (a few minutes); and org remembers which organisation you have selected (1 year). The sign-in page uses Cloudflare Turnstile, which reads technical details about your browser and receives your IP address to check that you are a person.
This website. Our own code sets no cookies and uses no browser storage. The playground's bot check is the one part that may use either: Vercel BotID runs when you use the playground, and it may set a small first-party cookie or use browser storage to tell a person from automated traffic. It is used only for that check.
You can remove all of it by signing out of the console or clearing this site's data in your browser settings. The site's fonts are served from our own domain, so loading a page sends nothing to a font provider.
How we use it, and why
Playground: to answer the question you put to it, and to keep it working and free from abuse through the limits and the bot check. We rely on our legitimate interest in letting people try our service and in preventing misuse.
Contact form: only to read and reply to your message, and to keep the form free from abuse through the limit and the bot check. We rely on our legitimate interest in answering people who get in touch and in preventing misuse.
Model access requests: to decide whether to grant access, to administer the evaluation licence and to contact you about it. We rely on our legitimate interest in knowing who uses our models and on the licence agreement you accept.
Console: to run your account, keep your keys working, bill you for what you use, send the emails the account needs (invitations, and alerts such as a key about to expire) and keep the account secure. We rely on the contract between us for the service. Keeping the account secure (the bot check at sign-in, the activity and security logs, and revoking keys found in public code) relies on our legitimate interest, and yours, in preventing fraud and misuse. When someone invites you to an organisation, we hold your email address before you have an account on the legitimate interest of the organisation that invited you. We keep payment and invoice records because UK tax law requires it.
We do not sell your data or share it for anyone else's marketing.
Who processes it
This site is hosted by Vercel, and its server code runs in London. Vercel BotID, a Vercel service, checks playground requests and contact form messages for automated traffic. Upstash holds the short-lived counters for the playground and the contact form. Resend delivers our emails, including messages from the contact form.
The Decision API, which answers playground requests, is run by us and answers from servers in Canada. The text you type into the playground is sent there and is not stored.
For the console: Supabase runs its database and sign-in, hosted in London, UK, and holds your account, keys, usage and activity log. Stripe takes payments and issues invoices and receipts, and gets your billing details and card. Resend sends the console's emails, such as invitations and alerts, so it gets your email address and the message; receipts come from Stripe. Vercel hosts the console, so it handles your requests to it. For the Decision API's Batch API, the files of a batch (the lines you send and their results) are stored, encrypted, on servers in Canada run by Hyperstack, and deleted 7 days after the results are first collected or 14 days after the batch finished, whichever comes first; live requests are not stored. Cloudflare Turnstile checks that a sign-in comes from a person, and gets your IP address and browser details. If you sign in with Google or GitHub, that provider confirms who you are and learns that you signed in to us. Some of these providers process data outside the UK, including in the United States; we use them under their data processing terms, which provide the safeguards UK law requires for these transfers.
How long we keep it
Playground: the text you type is not stored. The counter for your IP address lasts for up to one day.
Contact messages: for as long as we need to deal with your enquiry and any follow-up, and no longer than 24 months.
Model access requests: for as long as you have access to the model, and for 24 months after that, so we have a record of who held a licence.
Console: account data is deleted when the account is deleted. The activity log and the security log are kept for 12 months; after 90 days only the network part of an IP address is kept. We may keep records longer where they are needed for an investigation or a legal claim. Invoices and payment records are kept for six years, as UK tax law requires; Stripe holds them for us. An invitation that is not accepted stops working after 7 days.
Your rights
You can ask to see, correct or delete your data, to restrict or object to how we use it, to receive a copy in a format you can take elsewhere, or withdraw your consent, at any time, through our contact form. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.