Open Studio

Privacy Policy

Last updated: 2026-06-10

Operator: AI SmartTalk Contact: contact@aismarttalk.tech

1. Introduction

AI SmartTalk ("we", "us", "our") operates Mermaid Studio (the "Service"), available at mermaid.aismarttalk.tech. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

Mermaid Studio uses the open source library Mermaid.js but is not affiliated with or endorsed by the Mermaid.js project or Mermaid Chart.

2. Information We Collect

2.1 Information You Provide

  • Account data — when you sign in through your AI SmartTalk account (OAuth 2.0), we receive a pseudonymous user identifier and your plan information. We never receive or store your AI SmartTalk password.
  • Diagram content — the diagrams, titles, tags and collections you create or import, when you choose to save them to the cloud.
  • AI prompts — the text descriptions and documents you submit for AI generation.

2.2 Automatically Collected Information

  • Usage data — features used, diagram generation requests, plan token consumption.
  • Technical data — IP address, browser type, operating system.
  • Log data — access times, requested endpoints, errors. Logs are used for security and reliability only.

We do not use advertising trackers or third-party analytics scripts.

2.3 AI Processing

  • Diagram generation requests are processed by Mistral AI models operated on infrastructure located in France, through the AI SmartTalk platform.
  • No data is transmitted to AI providers outside the European Union.
  • Your prompts and diagrams are never used to train AI models.

3. How We Use Your Information

  • To provide and maintain the Service (editing, cloud storage, rendering, publishing)
  • To authenticate you via AI SmartTalk OAuth
  • To meter AI usage against your AI SmartTalk plan and apply rate limits
  • To secure the Service (abuse prevention, debugging)
  • To comply with legal obligations

We do not sell your personal data, and we do not use it for advertising.

4. Data Retention

  • Cloud diagrams and version history — retained until you delete them. Deleting a diagram permanently removes it and its version history.
  • Published diagrams — public until you unpublish or delete them.
  • Local data — diagrams edited without an account are stored only in your browser (localStorage) and never reach our servers.
  • Server logs — retained for a maximum of 12 months.
  • Account deletion — when your AI SmartTalk account is deleted, the associated Mermaid Studio data is deleted within 30 days.

5. Data Sharing

We do not sell your personal data. We share data only with:

  • AI provider — Mistral models hosted in France for diagram generation; no transfer outside the EU.
  • Hosting provider — our infrastructure is located in France (European Union).
  • Legal authorities — if required by applicable law.

Diagrams you explicitly publish become accessible to anyone with the link and may be indexed by search engines. Publishing is always an explicit action and can be reversed at any time.

6. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion ("right to be forgotten")
  • Object to or restrict processing
  • Data portability (your diagrams are exportable at any time in Mermaid text, SVG and PNG formats)
  • Withdraw consent
  • Lodge a complaint with your supervisory authority (in France: the CNIL, cnil.fr)

To exercise these rights, contact: contact@aismarttalk.tech. We respond within 30 days.

7. Cookies

Mermaid Studio uses strictly necessary cookies only:

  • aist_token (httpOnly) — keeps your session active after signing in with AI SmartTalk.
  • aist_chat_model_id — remembers which AI model your plan uses.
  • aist_pkce (httpOnly, 10 minutes) — secures the OAuth sign-in flow.

We use no advertising, profiling or third-party analytics cookies. Language and editor preferences are stored locally in your browser (localStorage) and never transmitted.

8. Security

We implement technical and organizational measures appropriate to the risk, including: OAuth 2.0 with PKCE, httpOnly cookies, TLS encryption in transit, rate limiting, strict input validation and security headers. However, no transmission over the Internet is 100% secure.

See our Security & sovereignty page for details.

9. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect data from children under 16.

10. Changes to This Policy

We may update this Privacy Policy. We will notify you of material changes by updating the "Last updated" date above and, for significant changes, through the Service interface.

11. Contact

For privacy questions: Email: contact@aismarttalk.tech Operator: AI SmartTalk — France