Privacy Policy

1. Summary in plain language

Sovereign Intelligence is our product thesis — and our privacy default. We design systems so that institutional knowledge, personal documents, and mission corpora remain under your control whenever the architecture allows it.

• Website & contact: We receive what you send us (for example, email to support@mjolnirphotonics.com) and standard technical logs needed to operate the site.
• Enterprise stack (L3M, HaloCore Generation 10, EHC, Edge Datacenter): Customer content and knowledge corpora are processed under customer control — including air-gapped and on-premises deployments. We do not train public foundation models on your institutional knowledge.
• HaloVault (AI Lockbox): Documents and the lockbox index are designed to stay on your device. Sensitive details can be masked before any message is sent to a third-party model; you approve what leaves. Third-party model providers process only what you authorize to send.
• Security products (Oneshot, Continuity) and tooling (EH Dev Kits, Finsight): We process account, license, configuration, and operational data needed to deliver and support the service — not your private knowledge corpus as a training set.

This summary is for orientation only. The sections below control.

2. Scope

This Privacy Policy applies to personal information processed by Mjolnir Photonics Labs Corporation (“Mjolnir,” “we,” “us,” or “our”) in connection with:

• Our websites and properties at www.mjolnirphotonics.com and related subdomains;
• Products and services we offer, including without limitation: L3M (Light LLM), HaloCore Generation 10 (HaloCore 10), EHC (Entangled Halo Compute), HaloVault (AI Lockbox), Oneshot, Continuity, EH Dev Kits, Edge Datacenter, Finsight, and related documentation, APIs, licenses, dashboards, and support channels; and
• Sales, demos, events, partner programs, and customer support.

This Policy does not cover third-party websites, apps, or model providers (for example OpenAI, Anthropic, Google, xAI) that you choose to use with or alongside our products. Those providers process data under their own terms and privacy notices.

Where we provide software or appliances that you deploy in your own environment, you (or your organization) are typically the controller of customer content. Our processing of that content is limited to what is necessary to provide the contracted service, or does not occur at all in fully local / air-gapped deployments.

3. Information we collect

Depending on how you interact with us, we may process the following categories:

3.1 Information you provide

• Identity & contact data — name, email address, phone number, company, title, and similar business contact details.
• Account & license data — usernames, authentication credentials or tokens, license keys, seat assignments, organization identifiers, and billing contacts.
• Communications — messages you send to us (email, forms, support tickets, demos, sales conversations) and related attachments.
• Payment & commercial data — invoice details, purchase orders, payment method metadata processed via our payment processors (we do not store full payment card numbers on our systems when a processor is used).
• Product configuration — preferences, redaction rules, deployment mode, feature flags, and similar settings you choose.

3.2 Information collected automatically

• Device & log data — IP address, browser type, operating system, referrer, pages viewed, timestamps, and error or diagnostic logs.
• Usage & telemetry (where enabled for a product or deployment) — feature usage counts, performance metrics, crash reports, API call metadata (endpoint, latency, status), and license health signals. We design telemetry to minimize content exposure; product-specific limits are described in Section 4.
• Cookies and local storage — theme preference, session continuity, and similar functional storage. See Section 10.

3.3 Information from others

• Business partners, resellers, or your employer (for enterprise provisioning);
• Public professional sources (for example company websites or professional profiles) when relevant to B2B outreach;
• Security and fraud tools that help us protect accounts and infrastructure.

3.4 Sensitive data

We do not seek sensitive personal data through our marketing site. Some products (especially HaloVault and enterprise knowledge systems) may process documents that contain sensitive information because you chose to add them. In those cases, product design aims to keep raw content under your control and to reduce unnecessary egress (see Section 4).

4. Product-specific data handling

Our products intentionally differ in where data lives. The following describes the intended architecture; your order form, MSA, DPA, or product documentation controls if there is any conflict.

4.1 Website (mjolnirphotonics.com)

When you browse our site, we process technical logs and any information you voluntarily submit (for example via email). Lab / whitepaper areas may require access credentials. We do not sell website visitor lists.

4.2 L3M, HaloCore Generation 10 (HaloCore 10), and EHC

These form our Sovereign Intelligence stack: interface (L3M), cognitive substrate (HaloCore 10), and holographic compute engine (EHC).

• Customer content & knowledge corpora (documents, triples, media, corrections, provenance records) are intended to remain in the customer’s chosen environment — cloud under customer tenancy, enterprise, edge, or air-gapped.
• Human-in-the-loop governance (teach / correct / delete / reinforce) is customer-controlled. We do not claim ownership of your institutional knowledge.
• We do not use customer knowledge corpora to train public third-party foundation models.
• Where Mjolnir hosts or co-manages infrastructure under contract, we process operational data (accounts, logs, license state, support diagnostics) as a processor / service provider under that contract.

4.3 HaloVault — AI Lockbox

HaloVault is designed so that your documents and lockbox context remain local on your machine (or enterprise-managed endpoint), while you optionally use frontier models you already use (for example ChatGPT, Claude, Gemini, Grok).

• Stays local by design: source files, local indices / context lake, retrieval decisions, and redaction configuration.
• User-approved egress: messages or protected context you choose to send to a third-party model provider are sent only after you approve (where the product enforces review-before-send).
• Masking / redaction: the product is designed to detect and mask categories of sensitive detail (for example names, government IDs, payment numbers, emails, phones, client identifiers) before a message leaves your browser or device, subject to configuration and detection limits. No automated system is perfect; you remain responsible for reviewing outbound content.
• Third-party models: when you send content to a provider, that provider processes it under their privacy policy and your agreement with them. Mjolnir is not those providers.
• Narrow cloud encode (where applicable): certain HaloVault / EH-augmented configurations may call a Mjolnir encode service so text can be transformed into sparse vectors. In that mode, payloads are intended to be processed ephemerally (in memory for the request) and not retained as a conversation archive. Exact endpoints and guarantees are described in product disclosure screens and technical docs for that build.
• Your controls: inspect context, configure redaction, delete by range or wipe the lockbox, and disable or uninstall the product.

4.4 Oneshot

Oneshot provides post-quantum–oriented secure communications capabilities (holographic noise signatures and opaque transmission modes as described in product docs). We process account, API key / access, configuration, and service health data. Message content handling depends on deployment mode (customer-hosted vs. contracted hosted path) and is described in Oneshot documentation and your agreement.

4.5 Continuity

Continuity provides holographic graph views over wallet / ledger history and related audit tooling. We may process wallet addresses, transaction graph metadata you connect, account data, and operational logs. Blockchain data is often public by nature; linking it to an identified person is treated as personal information where applicable law requires.

4.6 EH Dev Kits, Edge Datacenter, and Finsight

• EH Dev Kits: local development environments and SDKs; customer project data remains on systems you control unless you intentionally use a hosted API.
• Edge Datacenter: sovereign / air-gapped holographic compute deployments; content residency is defined by the deployment you operate.
• Finsight: fraud / anomaly signal processing for financial routing use cases under enterprise agreements; content scope is contractual.

4.7 Licensing, sales, and support systems

We operate license, sales, and support systems (including dashboards and API gateways on Mjolnir-operated hosts) that process organization accounts, seats, invoices, partner metadata, and support diagnostics. Money and identity data for commerce stay in the control plane; they are not mixed into knowledge corpora used for Sovereign Intelligence workloads.

5. How we use information

We use personal information to:

• Provide, operate, secure, and improve our websites, products, and services;
• Authenticate users, enforce licenses, and prevent abuse, fraud, and security incidents;
• Respond to inquiries, demos, support requests, and partnership discussions;
• Send service, security, and administrative messages;
• Send product or event information where permitted (you may opt out of non-essential marketing);
• Comply with law, enforce agreements, and protect rights, safety, and property;
• Create aggregated or de-identified statistics that do not reasonably identify you.

We do not sell personal information as “sale” is commonly understood (exchanging personal information for money). If a jurisdiction defines “sale” or “share” more broadly (for example certain advertising disclosures), we will honor required opt-outs as described in Section 9.

6. When we share information

We may share personal information with:

• Service providers who process data on our behalf (hosting, email delivery, payment processing, security monitoring, analytics that we configure), under contractual confidentiality and use limits;
• Enterprise customers (your organization) when you use a product under an employer or institutional account — admins may see seat, license, and usage metadata;
• Professional advisors (legal, accounting, insurers) under confidentiality obligations;
• Business transfers in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate protections;
• Legal & safety when required by law, valid legal process, or to protect vital interests, security, or rights;
• Parties you direct — for example, a third-party model provider when you approve sending content from HaloVault, or a partner you introduce in a joint engagement.

We do not share customer knowledge corpora with other customers.

7. Retention

We retain personal information only as long as reasonably necessary for the purposes above, including:

• Account and license records — for the life of the account and a reasonable period afterward for audits, disputes, and legal retention;
• Support and sales correspondence — for operational continuity and legal requirements;
• Security and server logs — for shorter operational windows unless needed for investigations;
• Local lockbox / device data (HaloVault and similar) — retained on your device until you delete it or uninstall; Mjolnir does not hold a cloud copy of your lockbox corpus by design.

When retention ends, we delete or de-identify information, subject to backup and legal hold constraints.

8. Security

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the data and the nature of our services — including access controls, encryption in transit for network services we operate, least-privilege operational practices, and product designs that minimize cloud retention of customer content.

No method of transmission or storage is perfectly secure. You are responsible for safeguarding credentials, endpoint security, and review of outbound content where the product puts that control in your hands (especially HaloVault).

9. Your rights and choices

Depending on your location and relationship with us, you may have rights to:

• Access, correct, or delete personal information we hold about you;
• Receive a portable copy of certain data;
• Object to or restrict certain processing;
• Withdraw consent where processing is consent-based;
• Opt out of marketing emails (via unsubscribe links or by contacting us);
• Appeal a denial of a privacy request where local law provides an appeal right.

Enterprise users: if your organization provides your account, we may redirect certain requests to your administrator, who controls institutional content and seats.

California / similar U.S. state laws: We do not sell personal information for money. To exercise consumer rights (know, delete, correct, opt-out of sale/share if applicable), contact us at the address below. We will not discriminate against you for exercising privacy rights.

EEA / UK / Switzerland: Where GDPR (or UK GDPR) applies, our legal bases may include contract performance, legitimate interests (for example securing services, B2B communications, product improvement with minimized telemetry), consent, and legal obligation. You may lodge a complaint with your local supervisory authority.

To exercise rights, email support@mjolnirphotonics.com with the subject line “Privacy Request.” We may need to verify your identity before acting.

10. Cookies and similar technologies

We use cookies and local storage primarily for:

• Essential / functional — session continuity, security, load balancing, remembering theme preference;
• Preference — UI choices you make on the site.

You can control cookies through your browser settings. Blocking essential cookies may affect site functionality. We do not operate invasive third-party advertising trackers on the marketing site as a core product requirement; if analytics tools are added, this Policy will be updated to describe them.

11. Children

Our products and website are directed to adults and organizations. We do not knowingly collect personal information from children under 16 (or under 13 where that is the applicable standard). If you believe a child has provided personal information to us, contact us and we will take appropriate steps to delete it.

12. International transfers

We are based in the United States. If you access our services from another country, your information may be processed in the United States and other locations where we or our service providers operate. Where required, we use appropriate transfer mechanisms (for example standard contractual clauses) for cross-border transfers of personal data.

Sovereign and air-gapped deployments are available so that regulated customers can keep content residency within environments they control.

13. Changes to this Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes will be posted on this page and, where appropriate, communicated through the product or by email. Continued use of the website or services after an update means you acknowledge the revised Policy, except where applicable law requires a different standard (for example explicit consent).

14. Contact us

For privacy questions, requests, or complaints:

This page is a product and website privacy notice. It is not legal advice. Enterprise customers should also review their MSA, DPA, and product-specific documentation.