Privacy policy

Last updated 3 November 2026

This policy explains what personal data Chimera collects, why, who helps us handle it, how long we keep it, and what you can ask us to do. It covers two places:

• the website chmr.app, including the waitlist;
• the Chimera app, the private web app we open to early-access users.

When we give you access to the app, we send you a link to this policy along with your sign-in details.

Who is responsible

Chimera is run by Ilia Mikheev, as an individual, from Cyprus. Chimera is not yet a registered company. Ilia decides how personal data is used here and is responsible for it. In data protection law, that makes him the controller.

Email for anything about your data: hello@chmr.app

We have not appointed a data protection officer. Please write to the address above.

If Chimera becomes a registered company, it will take over this data and this policy. We’ll tell you by email first, and you can leave the list or close your account.

In short

• On the website, if you join the waitlist and confirm your email, we keep your email, your name if you give it, and where you came from. Google Analytics counts visits only if you accept cookies.
• In the app, we keep your account, what you tell the agent about your product, the competitors you follow, and what the agent finds on public pages about them.
• We don’t sell your data. We don’t train AI models on it.
• You can ask to see, correct or delete your data at any time.

The website

Joining the waitlist

What we collect. Your email address and, if you give it, your name. We also note where you came from:

• the tags in the link you followed, if any (for example, utm_source=linkedin);
• the site that sent you here, such as linkedin.com, without the full link;
• the page where you joined;
• when you asked to join and when you confirmed.

How it works. When you send the form, we email you a link. You join the list only when you open it, so nobody can put your address on the list without you. Until then we keep nothing ourselves: your details travel inside the link, signed so they can’t be changed, and the link stops working after 7 days. Our email provider keeps its usual record of the email it sent.

When you open the link, you’re on the list. We get an email with your details, which we keep in our mailbox, and your email and name are added to the waitlist’s list of contacts at our email provider, so that we can write to everyone when we open seats.

Why. To put you on the waitlist, confirm your address, and write to you when we open seats. Your name lets us greet you. The source tells us which channels bring people to Chimera.

Legal basis. Your consent, for the waitlist and our emails about it (GDPR Art. 6(1)(a)). Our legitimate interest in knowing which channels work, for the source (Art. 6(1)(f)).

Do you have to give it? Your email is needed to join. Your name is optional. We ask for nothing else.

We don’t add you to a newsletter. You can leave the list at any time: reply to any of our emails or write to us.

The form keeps out bots with a hidden field and a check on how fast it was sent. Neither this check nor the source uses cookies or saves anything in your browser.

Google Analytics

We use Google Analytics only if you choose Accept in the cookie banner. Until then, the Analytics code doesn’t load: nothing goes to Google Analytics, and no cookies are set for it. If you choose Reject, the site works the same.

What it collects. The pages you view, how you got to the site, your type of device and browser, and your approximate location, such as country and city. It also counts four steps of the waitlist: opening its window, starting to type an email, sending it, and confirming it. For opening and sending, it also notes which of the site’s buttons opened the window. We never send your email address or name to Google Analytics.

Why. To see which pages and channels work, so we can improve the site.

Legal basis. Your consent (Art. 6(1)(a)).

Changing your mind. Use Cookie settings at the bottom of any page. If you choose Reject later, or your choice expires after 6 months, we delete the Analytics cookies. Withdrawing consent doesn’t affect what was collected before.

Google signals are off, and we don’t share Analytics data with other Google products.

Fonts and other files

The site’s fonts, pictures and scripts come from the site itself. Until you choose Accept, your browser asks no other server for anything.

Server logs

When you open a page, our hosting provider handles your IP address, browser details and the time of the request. It needs them to deliver the page and to protect the site from abuse.

Legal basis. Our legitimate interest in running a secure site (Art. 6(1)(f)).

The Chimera app

Your account

What we keep. Your email address and password. During early access, we create your account ourselves. We set your password and send it to you privately. You can’t change it in the app yet: ask us, and we’ll change it at any time. Our sign-in provider stores passwords only in a scrambled (hashed) form. It also keeps sign-in records, such as time, IP address and browser, for security.

We also keep the settings you choose, such as your interface language and whether the morning email is on. When you switch the interface language, we note the change, to see how the app is used. When you first sign in, the app reads the language your browser asks for: if the app speaks it, that becomes your interface language; if not, we note which language it was, to decide which languages to add next.

What you tell the agent

• Your product profile: name, website, description, who it is for and what matters to you.
• The competitors and pages you add, or accept from the agent’s suggestions.
• The questions you set for your cases.
• How you rate findings, and your decisions on the agent’s conclusions, such as confirming one as fact or dismissing it.

The agent sends this to our AI model provider to do its work. Please don’t put other people’s personal data or sensitive information into these fields.

What the agent collects from public pages

To follow your competitors, the agent:

• opens public pages on their websites in a remote browser and keeps copies: text, page code and screenshots;
• reads archived copies of those pages from the Internet Archive (archive.org), up to 100 days back;
• for a competitor’s biggest moves, searches the web through our AI model provider’s search tool and saves screenshots of public pages it finds about that move, such as news coverage;
• fetches each competitor’s site icon through Google’s public icon service.

From these, it writes findings, conclusions and case summaries.

The agent follows companies, not people. Still, public pages can show people: a team page, a customer quote with a name and photo, or a well-known person in news coverage of a competitor’s campaign. The agent doesn’t look for people and doesn’t build profiles of them.

Legal basis. Our and our users’ legitimate interest in following public business information (Art. 6(1)(f)).

If you appear on a page we captured and want it removed, write to us. This includes screenshots of pages found by the agent’s web search.

The morning email

On days when there is something worth reading, the app emails you at 07:00 UTC. On other days, there is no email. You can turn it off in Settings, under Delivery.

Your own AI assistant

If you connect your own AI assistant to your workspace with a key from us, it can read your workspace, and its provider handles that data under your agreement with them. You can ask us to revoke the key at any time.

How we use app data

We use it to:

• run the app for you and help when you ask;
• check the agent’s work and fix its mistakes;
• understand how the app is used and improve the agent, including re-running its past work against new rules;
• see who uses the app: our admin view shows each account’s email and last sign-in;
• keep the service secure;
• record how much AI work each workspace uses, to keep within usage limits.

Ilia and the AI assistant we use to review the agent’s work look inside workspaces only for these reasons.

Legal basis. Providing the app you asked for (Art. 6(1)(b)). Checking and improving the agent’s work, understanding how the app is used, security and usage limits rest on our legitimate interests (Art. 6(1)(f)).

Do you have to give it? An email and password are needed for an account. The agent needs your product’s name or website to work. The rest of the profile is optional.

Automated decisions. The agent’s conclusions are about your competitors, not about you. We make no automated decisions that have legal or similarly significant effects on you.

When you write to us

If you email us, we keep your address and your message so we can answer and follow up.

Legal basis. Our legitimate interest in replying to you (Art. 6(1)(f)).

Cookies

On the website

The waitlist sets no cookies. You can delete cookies in your browser at any time.

In the app

The app sets no analytics cookies. It uses:

Who helps us handle data

These providers process personal data for us, only on our instructions and under their data processing terms.

Under its commercial terms, Anthropic does not use what we send it, from the agent or from our AI assistant, to train its models.

Steel opens the pages the agent reads, both competitor pages and public pages found by its web search, and returns their text and screenshots. It receives nothing about your account.

Our emails contain no tracking pixels or tracked links.

The agent also reads public sources that are not our processors: competitors’ own websites, other public pages its web search finds, the Internet Archive and Google’s site icon service. These requests come from our servers and our providers, not from your browser, and carry nothing about you.

We don’t sell personal data. We share it with others only if the law requires it.

Data outside your country

Our database is in the EU, in Frankfurt. Some providers above are in the United States or may access data from there. When data leaves the EU, the EEA or the UK, we rely on the safeguards in each provider’s terms: the EU-US Data Privacy Framework where the provider is certified, or the European Commission’s Standard Contractual Clauses, with the UK addendum for UK data. Write to us for a copy.

How long we keep data

Your rights

You can ask us to:

• give you a copy of your personal data;
• correct it;
• delete it;
• limit how we use it;
• give you the data you gave us in a common machine-readable format.

Your right to object. You can object at any time to our use of your data based on legitimate interests. We will stop unless we have compelling reasons that override yours.

Where we rely on your consent, you can withdraw it at any time. This doesn’t affect what we did before.

To use any of these rights, write to hello@chmr.app. We reply within one month, free of charge. We may ask you to confirm the request from the email address we have on file.

You can also complain to a data protection authority: the one in the EU country where you live or work, the Information Commissioner’s Office in the UK, or the authority where Chimera is run, the Commissioner for Personal Data Protection in Cyprus. We’d be glad of the chance to help first.

Children

Chimera is a business tool and is not meant for anyone under 18. We don’t knowingly collect children’s data.

Changes to this policy

We’ll post changes here and update the date at the top. If a change matters for app users, we’ll also tell them by email.

Contact

Ilia Mikheev, Cyprus
hello@chmr.app