Privacy
Privacy policy.
What Mito collects, why, where it is kept and for how long, and the choices you have. Last updated 15 November 2026.
Who we are
Mito is a service of Virtual Petals IT Solutions & Consultancy - Sole Proprietorship L.L.C., Abu Dhabi, United Arab Emirates (Abu Dhabi Economic Licence CN-4495176), "Virtual Petals", "we" or "us". For anything about privacy, email mito@virtualpetals.com.
This policy covers Mito: this website (mito.virtualpetals.com), the customer portal (mito-app.virtualpetals.com), the documentation (mito-docs.virtualpetals.com), the public demo and the Mito MCP server for AI assistants (mito-mcp.virtualpetals.com). The Virtual Petals company website, www.virtualpetals.com, has its own privacy policy.
Your Microsoft 365 assessment data
To assess your tenant, you create a read-only app in your own Microsoft 365 tenant and give us its credentials. Each day Mito reads your security configuration with it: policies, roles, domains, device and app settings, and the directory, sign-in and audit records that some checks summarise. These records include people's names, sign-in addresses and sign-in details, for example an administrator who has no multi-factor authentication.
The app has no permission to read the content of email, files, chats or meetings, and it cannot change anything in your tenant. We use the results only to show your assessments to you and to run and support the service. Your organisation decides who in it can see them.
The app's credentials are kept only in your organisation's isolated environment in our cluster and are used only to run your assessments.
Signing in to the portal
You sign in with your Microsoft work account; we never see your password. We receive your name, email address, and your Microsoft account and tenant identifiers, and keep your sign-in in an encrypted session cookie for up to 8 hours. The portal does not use analytics or advertising cookies.
AI assistants (optional)
AI access lets people in your organisation connect an AI assistant such as Claude or ChatGPT to Mito. For organisations that sign up to Mito themselves it is on from the start, and the organisation's owner in Mito can turn it off, or on again, at any time in the portal (Profile and AI access). For organisations we set up, it is off until they ask us to turn it on. Nothing is sent to an assistant until a person creates their own access key in the portal and connects it.
When you ask a connected assistant about your results, Mito sends the requested results to that assistant. From then on they are handled by the assistant's provider (for example Anthropic or OpenAI) under its terms and your agreement with it, and may be processed outside the UAE. Choose an assistant your organisation allows.
Mito stores access keys only as a fingerprint, never the key itself. For each request it records which assistant asked, which tool was used, a short summary of the request, the size of the answer and the time; never the answers. Your organisation can see this log. You can disconnect an assistant or revoke a key at any time, with immediate effect.
Contact form, email and demo bookings
When you use the contact form we receive your name, work email, company and phone (both optional), number of Microsoft 365 users, topic and message, and the page you sent it from. It is stored in Mito's database in Azure UAE North and may be emailed to our team through Microsoft 365. To limit abuse we keep a one-way fingerprint of your IP address, not the address itself, and the form uses Cloudflare Turnstile, which processes technical details of your browser and connection to check that a person is sending it. Demo bookings are made on Calendly, under Calendly's privacy policy. We use these details only to reply to you and to follow up on your enquiry.
Free trial sign-up, subscriptions and payments
When you start a free trial you sign up with your Microsoft work account in the portal. We receive your name, email address and Microsoft account and tenant identifiers (as for signing in), and keep them with the company name, plan, referral code and the page you came from, as your organisation's account; you become its owner. To stop the same organisation starting another trial, we remember that your tenant has used Mito.
When you add a payment method, payment is handled by Stripe, our payment provider. We receive from Stripe the name, email address and billing details (such as billing address and, where given, tax number) entered at checkout, with your plan and subscription status, and keep them with your organisation's account to manage your subscription and invoices. Card details are entered on Stripe's checkout page and handled by Stripe; they never reach Mito. Stripe processes payment data under its own privacy policy.
The pricing page remembers the currency and billing period you chose, and any referral code in the link you followed, in your browser's local storage. They are sent to us only when you start sign-up, so we can set up the right plan.
Website analytics
On mito.virtualpetals.com and mito-docs.virtualpetals.com we use Google Analytics 4 (shared with www.virtualpetals.com) to understand how the sites are used: pages viewed, scrolling, links followed, and events such as booking a demo, opening the live demo or sending the contact form (with its topic only, never your details). Google Analytics sets cookies. The portal, the demo and the development sites send no analytics.
Where your data is kept
Assessments, results, portal data and AI access records are stored in Microsoft Azure in the UAE North region. Web traffic passes through Cloudflare, which protects and delivers our sites. Stripe (payments), Google Analytics, Calendly and, if you connect one, your AI assistant's provider may process data outside the UAE.
Who we share it with
We do not sell personal data or use it for advertising. We share it only with the service providers that run Mito for us (Microsoft Azure and Microsoft 365, Cloudflare, Stripe for payments and subscriptions, Google Analytics and Calendly), with the AI assistant you choose to connect, or when the law requires it.
How long we keep it
Assessment results are kept while your organisation uses Mito. When it stops, we delete its app credentials and isolated environment straight away, and its assessments and results 30 days later. Access keys end when they expire or are revoked. Billing and subscription records are kept as long as tax and accounting law requires. Contact form entries are kept as long as needed to deal with your enquiry; ask us and we will delete them.
Security
Mito uses read-only access, keeps each customer in an isolated environment, encrypts data in transit and at rest, and keeps secrets out of logs. See Security and data residency for details.
Your choices and rights
You can ask us for a copy of your personal data, to correct or delete it, or to stop using it, by emailing mito@virtualpetals.com. Your organisation can remove Mito's access at any time by deleting the app in its tenant. We handle requests in line with UAE data protection law.
Changes to this policy
If we change this policy we will update it here and change the date at the top. For significant changes we will tell customers before they take effect.