--- title: "Privacy Policy for Minds | Minds" canonical_url: "https://getminds.ai/legal/dataprivacy" last_updated: 2026-08-25 meta: description: "Effective Date: August 25, 2026" "og:description": "Effective Date: August 25, 2026" "og:title": "Privacy Policy for Minds | Minds" "twitter:description": "Effective Date: August 25, 2026" "twitter:title": "Privacy Policy for Minds | Minds" --- Minds August 25, 2026·Minds Team # **Privacy Policy for Minds** Effective Date: August 25, 2026 **Effective Date: August 25, 2026** This privacy policy provides information about the nature, scope, and purpose of the processing of personal data within the platform operated by **Art of X UG (haftungsbeschränkt)** (hereinafter "we" or "us"). ## 1. Data Controller The controller within the meaning of the GDPR and other national data protection laws is: **Art of X UG (haftungsbeschränkt)** Köpenicker Straße 145 10997 Berlin Germany Email: [privacy@getminds.ai](https://getminds.ai/mailto:privacy@getminds.ai) ## 2. Data Protection Officer The external Data Protection Officer can be reached as follows: Prof. Dr. Norman Uhlmann h3ko Innovations GmbH Pappelallee 64 16359 Biesenthal Germany Email: [privacy@getminds.ai](https://getminds.ai/mailto:privacy@getminds.ai) ## 3. General Information on Data Processing The subject of data protection is personal data. This refers to all information relating to an identified or identifiable natural person (the "data subject"). Personal data of users is generally only processed to the extent necessary to provide a functional platform and its content and services. ### Obligation to Provide Data The provision of personal data is neither legally nor contractually required. However, without providing the necessary data (such as email address and name for registration), we cannot offer you access to our services. Data marked as mandatory during registration or use is required for contract fulfillment. Failure to provide this data means the relevant services cannot be used. The provision of optional data is voluntary and does not affect your ability to use core services. ## 4. What Data is Processed and For What Purpose ### a. Provision of the Website and Creation of Logfiles (Hosting) Each time the website is accessed, the system automatically collects data and information from the computer system of the accessing computer. This data is stored in the server's logfiles. The following data is collected: - IP address of the requesting computer - Date and time of access - Name and URL of the retrieved file - Website from which access is made (referrer URL) - Browser used and, if applicable, the computer's operating system This data is processed to ensure smooth connection establishment and comfortable use of the website, as well as to evaluate system security and stability. The legal basis for data processing is Art. 6 Para. 1 S. 1 lit. f GDPR. The legitimate interest follows from the purposes for data collection listed above. The services of **DigitalOcean, LLC**, 101 6th Ave, New York, NY 10013, USA, are used for website hosting. Our infrastructure is hosted in the Frankfurt (Germany) region within the EU. A data processing agreement (DPA) has been concluded with DigitalOcean. Through this agreement, DigitalOcean ensures that data is processed in accordance with the GDPR and that the rights of data subjects are guaranteed. Further information can be found in DigitalOcean's privacy policy: https://www.digitalocean.com/legal/privacy-policy. #### Cloudflare (CDN, DNS & Security) **Cloudflare, Inc.**, 101 Townsend St, San Francisco, CA 94107, USA, is used for content delivery (CDN), DNS management, DDoS protection, and web application security. When you access our website, your requests are routed through Cloudflare's network. In this process, Cloudflare may process your IP address, request headers, and other connection metadata to deliver content, protect against attacks, and optimize performance. The legal basis for this processing is Art. 6 Para. 1 lit. f GDPR (legitimate interest). Our legitimate interest lies in ensuring the security, availability, and performance of our website. A data processing agreement (DPA) has been concluded with Cloudflare. Data transfer to the USA is covered by Cloudflare's participation in the EU-US Data Privacy Framework and supplemented by Standard Contractual Clauses (SCCs). Further information: https://www.cloudflare.com/privacypolicy/. ### b. Registration and Use of an Account (Authentication & Database) To use the platform, creating a user account is required. The following data is collected: - Name - Email address - Password (stored in encrypted form) This data is necessary to manage the account and enable access to the services. The legal basis for this processing is Art. 6 Para. 1 lit. b GDPR (contract fulfillment). For authentication and user database management, the services of **Supabase Inc.**, 970 Toa Payoh North #07-04, Singapore 318992, are used. Supabase provides the backend infrastructure for the platform. Data storage, including the database, authentication, storage, and AI-related embeddings, takes place in the Northern EU region (Stockholm, `eu-north-1`). A data processing agreement (DPA) has been concluded with Supabase. Further information on data protection at Supabase can be found here: https://supabase.com/privacy. ### c. AI-Powered Features For the provision of AI-powered features, the following services are used: #### OpenAI (Text Generation, Embeddings, Image Analysis) **OpenAI OpCo, LLC**, 3180 18th St, San Francisco, CA 94110, USA, is used for text generation, creation of embeddings from user content, voice transcription (Whisper), and image analysis. When these features are used, the relevant data (e.g., text inputs or content to be analyzed) is sent to OpenAI's servers for processing. We do not transmit any personal data to OpenAI beyond what is necessary for the function, and we store the results generated by OpenAI in our system hosted on Supabase (see above). The legal basis for this processing is Art. 6 Para. 1 lit. b GDPR (contract fulfillment), as these features are a core component of the services offered. A data processing agreement has been concluded with OpenAI. Data transfer to the USA is based on the EU Commission's standard contractual clauses. Further information on data protection at OpenAI can be found here: https://openai.com/policies/privacy-policy. #### Anthropic (Text Generation with Claude Models) **Anthropic PBC**, 548 Market St, PMB 87430, San Francisco, CA 94104, USA, is used for advanced text generation using Claude AI models. When these features are used, your text inputs and prompts are transmitted to Anthropic's servers for processing. The legal basis for this processing is Art. 6 Para. 1 lit. b GDPR (contract fulfillment), as these features are a core component of the services offered. A data processing agreement has been concluded with Anthropic. Data transfer to the USA is based on the EU Commission's standard contractual clauses. Further information on data protection at Anthropic can be found here: https://www.anthropic.com/legal/privacy. #### Google AI (Text Generation with Gemini Models) **Google LLC**, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, is used for text generation and AI-powered features using Gemini models. When these features are used, your text inputs and prompts are transmitted to Google's servers for processing. The legal basis for this processing is Art. 6 Para. 1 lit. b GDPR (contract fulfillment), as these features are a core component of the services offered. A data processing agreement has been concluded with Google. Data transfer to the USA is based on the EU Commission's standard contractual clauses. Further information on data protection at Google can be found here: https://policies.google.com/privacy. #### ElevenLabs (Voice Processing) **ElevenLabs Inc.**, 20-22 Wenlock Road, London, N1 7GU, United Kingdom, is used for voice synthesis (text-to-speech) and voice transcription (Scribe v1). When you use voice features, audio data is transmitted to ElevenLabs for processing. The legal basis for this processing is Art. 6 Para. 1 lit. b GDPR (contract fulfillment). A data processing agreement has been concluded with ElevenLabs. Data transfer to the United Kingdom is covered by the EU Commission's adequacy decision for the UK (Decision 2021/1772), ensuring an adequate level of data protection. Further information: https://elevenlabs.io/privacy. #### Langfuse (AI Observability & Prompt Management) **Langfuse GmbH**, Residenzstraße 27A, 80333 München, Germany, is used for managing AI prompts, tracking AI interactions, and system observability. This helps us improve service quality and debug issues. Technical metadata about AI interactions is processed. The legal basis for this processing is Art. 6 Para. 1 lit. f GDPR (legitimate interest). Our legitimate interest lies in ensuring service quality, debugging issues, and improving our AI features. As Langfuse is based in Germany, data remains within the EU. A data processing agreement has been concluded with Langfuse. Further information: https://langfuse.com/docs/data-security-privacy. #### Deepgram (Speech-to-Text) **Deepgram, Inc.**, 548 Market St, Suite 25104, San Francisco, CA 94104, USA, is used for real-time voice transcription (speech-to-text) using the Nova-3 model. When you use voice features, your audio data is streamed to Deepgram's servers for transcription. Deepgram processes audio in real time and does not retain audio recordings after transcription is complete. The legal basis for this processing is Art. 6 Para. 1 lit. b GDPR (contract fulfillment), as voice transcription is a core component of the voice features offered. A data processing agreement has been concluded with Deepgram. Data transfer to the USA is based on the EU Commission's standard contractual clauses. Further information: https://deepgram.com/privacy. ### d. Content in Studies and Private Model Features (User Content) The heart of the platform is the processing of content created by users in "Studies" (saved research workspaces) and shared with "Minds" (AI assistants). This can include voice recordings, texts, images, or other creative works ("User Content"). This data is processed to provide the requested service, including inference, generation, embeddings, retrieval, storage, security, and support. **Minds does not use, and does not permit its subprocessors to use, User Content to train, fine-tune, or improve generalized, shared, foundation, or third-party models or generalized datasets. This applies to Individual, Team, and Enterprise/custom plans, including free and trial accounts.** If you deliberately invoke a feature whose stated purpose is to create or adapt a private Customer-specific model, such as "My Mind" or an authorized private voice clone, the selected User Content may be used only to create that requested private model for your authorized workspace. It is not used for another customer or for a generalized, shared, or third-party model. Ordinary uploads, embeddings, retrieval, or generation do not constitute consent to model training. The legal basis for service processing, including a private model feature explicitly requested by you, is Art. 6 Para. 1 lit. b GDPR (contract performance). Aggregated operational telemetry that contains no User Content and does not identify you, your organization, clients, respondents, projects, or research results may be processed under Art. 6 Para. 1 lit. f GDPR for security, reliability, capacity planning, and service administration. ### d2. Audience Grounding and Public Distribution Data For the **Audience Grounding** feature and related Audience-level functionality (synthetic panels, Audience covers, audience simulation, Marketplace Audiences), the platform ingests and processes publicly available statistical and distribution data to ground synthetic Audiences of Minds in plausible real-world distributions. The categories of data processed include: - **Aggregate demographic and population statistics** (e.g. age, gender, occupation, education, geography distributions) sourced from public statistical offices, census-style datasets, and comparable open data sources. - **Industry, market, and labour-market benchmarks** sourced from publicly available reports, market-research summaries, and trade publications. - **Public web content** retrieved through our web-search provider (Exa, see Section 4.g) when you explicitly request grounding from a public source (e.g. a public profile page, company website, or news article that you submit as input). - **Technical metadata** about the grounding request itself (your account identifier, the requested distribution parameters, the timestamp, and the resulting Audience configuration) so that the configuration is reproducible and auditable. This processing serves the purpose of generating realistic, statistically grounded synthetic Audiences for research, simulation, and creative work. **No personal data of identifiable natural persons is generated, profiled, targeted, or stored** as part of the distribution data itself; the data is processed in aggregate, statistical form. Where you submit inputs that may contain personal data of third parties (e.g. a link to a public profile), you are responsible for the lawfulness of that submission and warrant that you have all necessary rights and consents (see Section 4 of our Terms of Service). The legal bases for this processing are: - **Art. 6 Para. 1 lit. b GDPR (contract fulfillment)** for processing your account identifier, the grounding configuration, and the search inputs you submit, as these are necessary to deliver the Audience Grounding feature you have requested. - **Art. 6 Para. 1 lit. f GDPR (legitimate interest)** for the ingestion and caching of publicly available aggregate statistics. Our legitimate interest lies in providing a robust, reproducible, and statistically meaningful grounding feature; the source data is already public and aggregate, and our interest is not overridden by the rights of data subjects, since no identifiable natural persons are processed. - In addition, processing of aggregate statistics for synthetic-research purposes is supported by **§ 27 BDSG** (processing for scientific or statistical purposes), to the extent applicable. **Retention:** Aggregate distribution datasets are cached for the duration of their usefulness as ground-truth references and are refreshed when source data updates; Audience configurations are retained for the duration of the user's account plus 30 days after deletion (see Section 5). Inputs submitted to the web-search provider are retained according to that provider's terms (see Section 4.g). **Sub-processors involved in Audience Grounding** include the AI providers listed in Section 4.c (for generating grounded outputs), Exa (Section 4.g, for public web search when used), and our hosting and database providers (Section 4.a–b). ### e. Payment Processing If paid services are used, payment data is processed for the purpose of contract fulfillment. Processing is based on Art. 6 Para. 1 lit. b GDPR. Payment processing is carried out through the payment service provider **Stripe Payments Europe, Ltd.**, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. No credit card data is stored; it is directly forwarded to Stripe. Stripe is a certified partner and is subject to strict data protection and security standards. A data processing agreement has been concluded with Stripe. Further information on data protection at Stripe can be found at: https://stripe.com/privacy. ### f. Mobile App Services (iOS/Android) When you use Minds through our mobile applications (iOS/Android), the following additional services and device features are used: #### Firebase Cloud Messaging (Push Notifications) **Google LLC** (Firebase), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, is used to deliver push notifications to your device. When you enable push notifications, a device token (a unique identifier for your device) is generated and stored on our servers to route notifications. No message content beyond the notification payload is shared with Firebase. The legal basis for this processing is Art. 6 Para. 1 lit. a GDPR (consent), as push notifications are only sent after you explicitly grant permission. You can revoke this consent at any time by disabling notifications in your device settings. A data processing agreement has been concluded with Google. Data transfer to the USA is based on the EU Commission's standard contractual clauses. Further information: https://firebase.google.com/support/privacy. #### RevenueCat (In-App Purchases) **RevenueCat, Inc.**, 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA, is used to manage in-app purchases and subscriptions on mobile devices. RevenueCat processes an anonymized user identifier, purchase receipts, and subscription status. No personal data such as name or email is shared with RevenueCat. The legal basis for this processing is Art. 6 Para. 1 lit. b GDPR (contract fulfillment), as in-app purchase management is required to provide paid services. A data processing agreement has been concluded with RevenueCat. Data transfer to the USA is based on the EU Commission's standard contractual clauses. Further information: https://www.revenuecat.com/privacy. #### Federated Authentication (Apple, Google, and Microsoft Entra) When you use Apple Sign-In, Google Sign-In, or Microsoft Entra single sign-on, the selected identity provider issues a token that is exchanged with our authentication service (Supabase) to create or link your account. We receive only the information and organizational claims you authorize, typically your name, email address, and tenant or group information where an administrator enables it. Minds does not receive or store your identity-provider password; authentication is handled through secure token exchange. The identity provider independently processes login data under its own terms and privacy notice. The legal basis for this processing is Art. 6 Para. 1 lit. b GDPR (contract fulfillment). #### Device Permissions The mobile app may request access to the following device capabilities: - **Microphone:** Required for voice mode (real-time conversations). Audio is streamed to Deepgram for transcription and is not stored on our servers. - **Camera:** Used for capturing images to upload as content for AI analysis. Images are processed only when you explicitly initiate a capture. - **Photo Library:** Used to select existing images or files for upload. Only files you explicitly select are accessed and uploaded. Each permission is requested only when you first use the relevant feature. You can revoke any permission at any time through your device settings. The legal basis for this processing is Art. 6 Para. 1 lit. a GDPR (consent). ### g. Additional Data Processing Services The platform uses additional specialized services to enhance functionality. These services process only the inputs needed for the feature you request. #### Exa (Web Search) **Exa**, services via api.exa.ai, is used to provide web search and public-page content retrieval within the platform. When you use these features, search queries, submitted URLs, and public page content may be transmitted to Exa for processing. The legal basis for this processing is Art. 6 Para. 1 lit. b GDPR (contract fulfillment), as web search is a feature of the services offered. Data transfer to the USA is based on the EU Commission's standard contractual clauses. Further information: https://exa.ai/privacy. #### Firecrawl (Web Extraction and Screenshots) **Firecrawl**, operated by SideGuide Technologies, Inc., is used to retrieve, extract, and in some cases visually analyze public web pages or screenshots when you submit links or request web/source analysis. Processed data may include submitted URLs, page content, screenshots, and technical metadata. The legal basis is Art. 6 Para. 1 lit. b GDPR for requested source analysis and Art. 6 Para. 1 lit. f GDPR for source quality, security, and debugging. Data transfer to the USA is based on standard contractual clauses. Further information: https://www.firecrawl.dev/privacy-policy. #### Apify (Social and Video Source Extraction) **Apify Technologies s.r.o.**, Czech Republic, is used for public social-media, web, and video transcript/content extraction when you provide a URL or request source collection for a Mind. Processed data may include submitted URLs, public profile/post/video metadata, transcripts, and extraction logs. The legal basis is Art. 6 Para. 1 lit. b GDPR (contract fulfillment). The legal basis is Art. 6 Para. 1 lit. b GDPR. Data transfer to third countries is based on standard contractual clauses where required. #### Public API, MCP, Browser Extension, and External Clients When you use our public API, MCP server, browser extension, widgets, or third-party clients that connect to Minds (for example ChatGPT, Claude, OpenRouter, Open WebUI, or LibreChat), we process API keys, OAuth authorization codes/access tokens, scopes, request metadata, tool calls, prompts, content, widget/session identifiers, and audit logs required to authenticate, route, secure, and deliver the integration. The legal basis is Art. 6 Para. 1 lit. b GDPR and Art. 6 Para. 1 lit. f GDPR for security and audit logging. Third-party clients chosen by you may independently process your data under their own terms. #### Google Calendar Integration If you connect Google Calendar, we use the Google Calendar API to sync calendar events and related metadata. We request the calendar.events scope, store access/refresh tokens, create webhook channels, read future event metadata and attendees, create related Minds, and may update event descriptions with Mind links when enabled. Data includes calendar IDs, event IDs, titles/descriptions/times, attendee names/emails, webhook identifiers, token scopes/expiry, and sync status. The legal basis is Art. 6 Para. 1 lit. a GDPR (consent) and Art. 6 Para. 1 lit. b GDPR (contract fulfillment). You may disconnect the integration in settings; tokens, webhook channels, and synced events are deleted subject to backup retention. #### Meta Ads Integration If you connect Meta Ads, Meta provides an OAuth access token and the read-only permission you approve. Minds uses that authorization to list ad accounts and ads you can access and import user-selected ad copy, identifiers, images and videos into a Study. The integration cannot create, edit, publish, pause, or delete Meta ads. We store the encrypted token, granted scopes, connection metadata, and import audit data required for security and support. The legal basis is Art. 6 Para. 1 lit. a GDPR (consent) and Art. 6 Para. 1 lit. b GDPR (contract fulfillment). You may disconnect Meta Ads in settings; Minds then attempts to revoke the Meta grant and deletes its local token. Imported Study files and import audit records remain under the ordinary Study and security-retention rules. Meta independently processes data under its own terms and privacy notice. #### Twilio (SMS, WhatsApp, and Voice Calls) Optional messaging and phone features use **Twilio Inc.** for SMS, WhatsApp sender management, phone number provisioning, and voice call media streams. Data may include assigned phone numbers, caller/sender numbers, message metadata/content, call metadata, and call audio streams. Voice calls may also be processed by Deepgram as described above. The legal basis is Art. 6 Para. 1 lit. b GDPR; where consent is required for call recording, voice cloning, or similar features, Art. 6 Para. 1 lit. a GDPR applies. ### h. Communication via Email For sending platform-related emails (e.g., registration confirmations, password resets), the service **Resend** is used, offered by Resend Inc., 548 Market St PMB 95453, San Francisco, CA 94104-5401, USA. Resend processes the email address on our behalf. The legal basis for this processing is Art. 6 Para. 1 lit. b GDPR (contract fulfillment) for transactional emails. A data processing agreement (DPA) has been concluded with Resend. Data transfer to the USA is based on the EU Commission's standard contractual clauses. Further information can be found in Resend's privacy policy: https://resend.com/legal/privacy-policy. Beyond these transactional emails, business users who register for Minds or request a demonstration may receive a small number of individual follow-up emails about the product. These are sent by a named member of our team from their own business mailbox using **Google Workspace (Gmail)**, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — not through a bulk mailing tool. The content is drafted with AI assistance based on the details you provided when registering (such as your name, your company, and any request you submitted). The legal basis for this processing is Art. 6 Para. 1 lit. f GDPR (legitimate interest in contacting business users about the product they registered for). Under Art. 21 GDPR you can object to this processing at any time with effect for the future. Every such email contains a one-click unsubscribe link, and simply replying to the sender also stops it; no further email is sent once you reply or book an appointment. Unsubscribing ends all marketing and outreach email from us, while service and account emails (for example sign-in, security, and billing notices) continue unaffected. So that objections are honored reliably, a record of the objection (email address and category) is retained for as long as we operate the service. These emails contain no tracking pixels and no open or click tracking. ### i. Cookies Cookies, local storage, and similar technologies are used on the website and in the app. Necessary storage is used for login, security, language, consent, session, and core app functions. Non-essential analytics or marketing cookies and comparable device storage are used only with consent. For users in Germany, access to or storage of information on the end device is based on § 25 TDDDG where applicable. The related personal-data processing is based on Art. 6 Para. 1 lit. a GDPR for consent-based analytics and marketing, and on Art. 6 Para. 1 lit. f GDPR for strictly necessary security, fraud-prevention, and service functions. You can change or revoke consent at any time through our cookie settings. The browser can also be configured to reject or delete cookies, although some core functions may then be unavailable. ### j. Web Analytics with Google Analytics This website uses functions of the web analytics service Google Analytics. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies that enable analysis of your use of the website. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. The storage of Google Analytics cookies and the use of this analytics tool is based on your consent according to Art. 6 Para. 1 lit. a GDPR. You can change or revoke this consent at any time through our cookie settings. We have activated IP anonymization on this website. As a result, your IP address is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before being transmitted to the USA. We have concluded a data processing agreement with Google. Data transfer to the USA is based on the EU Commission's standard contractual clauses. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/. More information on Google Analytics' handling of user data can be found in Google's privacy policy: https://support.google.com/analytics/answer/6004245. ### k. Product Analytics with PostHog We use the product analytics service **PostHog**, provided by PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. PostHog helps us understand how users interact with our platform and may include session replay. Persistent analytics cookies, localStorage persistence, analytics user identification, and session replay are used only with analytics consent. Without analytics consent, PostHog is configured without persistent analytics cookies; limited cookieless or in-memory events may be processed for product reliability, abuse prevention, and aggregated service improvement where lawful. The legal basis for consent-based analytics is Art. 6 Para. 1 lit. a GDPR. For limited security, reliability, and abuse-prevention processing that is strictly necessary for the service, the legal basis is Art. 6 Para. 1 lit. f GDPR. You can change or revoke consent in cookie settings. We have concluded a data processing agreement with PostHog. Data is processed in the EU region. Further information can be found in PostHog's privacy policy: https://posthog.com/privacy. ### l. Conversion Tracking with TikTok Pixel We use the **TikTok Pixel**, a conversion tracking tool provided by TikTok Information Technologies UK Limited and TikTok Technology Limited ("TikTok"). The TikTok Pixel allows us to track user actions and measure the effectiveness of our advertising campaigns on TikTok. The TikTok Pixel collects data about your interactions with our website (e.g., page views, registrations) and transmits it to TikTok. The TikTok Pixel is **only activated with your explicit consent** for marketing cookies (Art. 6 Para. 1 lit. a GDPR). You can revoke your consent at any time. Data transfer to third countries is secured by the EU Commission's standard contractual clauses. More information on TikTok's data processing: https://www.tiktok.com/legal/page/eea/privacy-policy/en. ### m. Conversion Tracking with X Pixel We use the **X Pixel** (formerly Twitter Pixel), a conversion tracking tool provided by X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA ("X"). This tool helps us measure the success of our advertising on X. The X Pixel tracks actions on our website and transmits them to X. The X Pixel is **only activated with your explicit consent** for marketing cookies (Art. 6 Para. 1 lit. a GDPR). You can revoke your consent at any time. Data transfer to the USA is secured by the EU Commission's standard contractual clauses. More information on X's data processing: https://twitter.com/en/privacy. ## 5. Storage Duration and Data Deletion Personal data is stored for the following periods: | Data Category | Retention Period | Reason | | --- | --- | --- | | Account data (name, email) | Duration of account + 30 days after deletion | Contract fulfillment and account recovery | | User Content (Studies, Minds) | Duration of account + 30 days after deletion | Contract fulfillment | | Audience Grounding configurations and inputs | Duration of account + 30 days after deletion | Contract fulfillment | | Aggregate distribution datasets (no personal data) | Refreshed periodically; cached as long as required for the feature | Legitimate interest / statistical purpose | | Server logfiles | 90 days | Security and debugging | | Payment records | 10 years after transaction | German tax law (§ 147 AO) | | Consent records | 3 years after withdrawal | Proof of consent (Art. 7 GDPR) | | Content moderation, illegal-content notices, appeals, and decision records | Up to 3 years; longer where required for legal claims | Legal compliance, abuse prevention, rights enforcement | | Analytics data | 14 months | Service improvement | | AI interaction logs | 90 days | Quality assurance and debugging | | API keys, OAuth/MCP tokens, and integration audit logs | Duration of account or until revoked; audit/security logs up to 3 years | Contract fulfillment, security, abuse prevention | | Google Calendar tokens, webhook channels, and synced event metadata | Until disconnect or account deletion + 30 days | Consent / contract fulfillment | | Meta Ads encrypted OAuth token and connection metadata | Until disconnect, token expiry, or account deletion + 30 days | Consent / contract fulfillment | | Meta Ads import audit records and source object IDs | Account lifetime + 30 days; security records up to 3 years | Contract fulfillment / security and audit | | SMS/WhatsApp/voice metadata and assigned phone numbers | Duration of feature use/account + 30 days; provider records per provider/legal retention | Contract fulfillment, abuse prevention | | Submitted URLs, web extraction results, screenshots, and source-search metadata | Duration of related Mind/Study/Audience + 30 days unless cached as non-personal aggregate source data | Contract fulfillment and reproducibility | | Backup data | Deleted or overwritten through the protected backup cycle within up to 30 further days after deletion from active systems | Disaster recovery | **Right to Deletion:** The deletion of the account and all associated data can be requested at any time. This can be done directly in the settings under [/settings/preferences](https://getminds.ai/settings/preferences). After such a request, personal data and user content are permanently removed from active systems within 30 days. Residual copies in protected backups are isolated from ordinary use and deleted or overwritten through the backup cycle within up to 30 further days. Because User Content is not used for generalized or shared model training, no generalized-model "unlearning" is required. Any private Customer-specific model or voice clone requested by the user will be deleted or disabled with its retained source data under the same deletion and backup schedule, subject to legal retention duties. ## 6. Automated Decision-Making and Profiling Our platform uses AI-powered features that may involve automated processing of your data: ### AI-Assisted Features When you use our AI features (Studies, Minds, Audience Grounding), your inputs are processed by AI models to generate outputs. This processing: - **Does not constitute automated decision-making** with legal or similarly significant effects under Art. 22 GDPR - Is used solely to provide the creative and conversational services you request - Does not result in decisions that produce legal effects or significantly affect you - Remains under your control—you decide how to use any AI-generated outputs ### Personalization If you create a personal AI model ("My Mind"), the system analyzes your uploaded content to create a personalized AI assistant. This is based on your explicit request and consent (Art. 6 Para. 1 lit. a and b GDPR). You can delete your personal model at any time. ### Content Moderation, Notices, and Appeals We may use automated systems and human review to detect content that violates our Terms of Service or applicable law, including harmful, illegal, infringing, abusive, or security-risk content. Flagged content may be reviewed by our team. When users or third parties submit illegal-content notices, rights complaints, moderation appeals, or objections, we process the information needed to assess and document the request. This can include reporter contact details, account identifiers, URLs/content IDs, submitted reasons and evidence, moderation decision records, timestamps, and follow-up communications. The legal basis is Art. 6 Para. 1 lit. c GDPR where processing is required by law, Art. 6 Para. 1 lit. f GDPR for service integrity, abuse prevention, legal defense, and rights enforcement, and Art. 6 Para. 1 lit. b GDPR where moderation is necessary to perform or enforce the user agreement. Moderation and notice records are generally retained for up to 3 years unless a longer period is required to establish, exercise, or defend legal claims. ### Your Rights Regarding Automated Processing You have the right to: - Obtain human intervention in decisions that significantly affect you - Express your point of view and contest decisions - Request information about the logic involved in automated processing - Opt out of non-essential automated processing To exercise these rights, contact us at [privacy@getminds.ai](https://getminds.ai/mailto:privacy@getminds.ai). ## 7. EU AI Act Transparency and AI-Generated Content ### 7.1 AI System Disclosure The Minds platform is an AI-powered platform within the scope of Regulation (EU) 2024/1689 (the "EU AI Act"). Article 50 transparency obligations apply from 2 August 2026. For generative AI systems placed on the market before that date, the obligations in Article 50(2) apply from 2 December 2026. ### 7.2 Notification of AI Interaction Before or at the time of your first interaction with any Mind or AI assistant, we inform you that you are interacting with an AI system, not a natural person. A persistent notice is displayed beside the central interaction input. We do not create a separate acknowledgement record for this notice. ### 7.3 Labelling and Machine-Readable Marking Minds labels AI-generated outputs in the product interface and stores generation metadata such as content type, creation timestamp, model/provider identifier where technically available, and output context. For systems placed on the market before 2 August 2026, we are implementing machine-readable marking and detection for in-scope text, image, audio, and video outputs during the transition to 2 December 2026, taking account of technical feasibility and the state of the art. We do not use this metadata for profiling or marketing. It is used to disclose AI origin, support auditability, preserve context for shared/exported outputs, and respond to user or regulatory transparency requests. ### 7.4 Synthetic Content Disclosure Where Minds simulate the communication style, voice, likeness, or behaviour of real or fictional persons, or where Audience-grounded panels generate aggregate-style outputs, the resulting output is synthetic. We disclose the artificial origin of such content through visible labels and, where technically feasible, metadata/provenance information. To support this disclosure, we process Mind configuration data, Audience-grounding configuration, generation logs, and output metadata. ### 7.5 Legal Basis Where processing is required to comply with Art. 50 EU AI Act, the legal basis is Art. 6 Para. 1 lit. c GDPR. Other transparency and provenance processing is based on Art. 6 Para. 1 lit. b GDPR where needed to provide the service and Art. 6 Para. 1 lit. f GDPR for accountability, security, and misuse prevention. ### 7.6 Data Processed for AI Transparency Purposes | Data Category | Purpose | Retention | | --- | --- | --- | | AI interaction notice display context | Delivery of the localized in-product notice | Not retained separately | | Generation metadata and available provenance data | AI-origin labelling, export context, and auditability | As long as the content exists on the platform, plus 1 year | | Mind persona/configuration data | Synthetic-content disclosure and misuse prevention | Duration of account plus 3 years | | Audience-grounding configuration (distribution parameters, sources used) | Synthetic-output disclosure for Audience-grounded outputs | Duration of account plus 3 years | | Content generation logs (model, timestamp, type) | Auditability, debugging, and regulatory accountability | 3 years from content creation | ### 7.7 Your Rights In addition to your GDPR rights (see Section 8), you may request confirmation of whether a specific output was generated by AI and what generation/provenance metadata is available. Where transparency processing relies on legitimate interests, you may object under Art. 21 GDPR. Processing that is legally required after the EU AI Act obligations apply cannot be opted out of. ## 8. Rights of the Data Subject Data subjects have the following rights regarding their personal data: - **Right to Access** (Art. 15 GDPR) - **Right to Rectification** (Art. 16 GDPR) - **Right to Erasure** ("Right to be Forgotten") (Art. 17 GDPR) - **Right to Restriction of Processing** (Art. 18 GDPR) - **Right to Data Portability** (Art. 20 GDPR) - **Right to Object** (Art. 21 GDPR) There is also the right to **withdraw** consent at any time with effect for the future (Art. 7 Para. 3 GDPR). The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. To exercise these rights, the contact address mentioned above can be contacted. ## 9. Right to Lodge a Complaint with a Supervisory Authority Without prejudice to any other administrative or judicial remedy, there is the right to lodge a complaint with a supervisory authority, in particular in the Member State of residence, place of work, or place of the alleged infringement, if it is believed that the processing of personal data violates the GDPR (Art. 77 GDPR). The supervisory authority responsible for us is: **Berliner Beauftragte für Datenschutz und Informationsfreiheit** Friedrichstr. 219 10969 Berlin Germany Phone: +49 30 13889-0 Email: [mailbox@datenschutz-berlin.de](https://getminds.ai/mailto:mailbox@datenschutz-berlin.de) Website: https://www.datenschutz-berlin.de ## 10. Data Security All necessary technical and organizational security measures are taken to protect personal data from loss and misuse. Data is stored in a secure operating environment that is not accessible to the public. Data transmission is encrypted using SSL technology. ## 11. Changes to This Privacy Policy We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to services in the privacy policy, e.g., when introducing new services. The new privacy policy will then apply to future visits. **Evaluate Minds** ## **Continue your procurement review** Use the buyer-facing checklist and evidence pages alongside these legal terms. [Minds](https://getminds.ai/)© 2026 Minds. Your target audience. AI-driven and grounded in transparent evidence. Build within minutes. [Minds on X (Twitter)](https://x.com/mindsai_co) [Minds on LinkedIn](https://www.linkedin.com/company/mindsaicompany/) [Minds on Instagram](https://www.instagram.com/getminds.ai/) Minds is part of [![ESOMAR Corporate 2026](https://getminds.ai/images/newsroom/logos/esomar-corporate-2026-v2.png)ESOMAR](https://esomar.org/) [![bayern design](https://getminds.ai/images/customer-logos/bayern-design.svg)bayern design](https://bayern-design.de/) [![CSSDA Best UX Design Award](https://getminds.ai/images/newsroom/logos/cssda-best-ux-award.png)CSSDA Best UX Design Award](https://www.cssdesignawards.com/) [![CSSDA Best Innovation Award](https://getminds.ai/images/newsroom/logos/cssda-best-innovation-award.png)CSSDA Best Innovation Award](https://www.cssdesignawards.com/) [![CSSDA Best UI Design Award](https://getminds.ai/images/newsroom/logos/cssda-best-ui-award.png)CSSDA Best UI Design Award](https://www.cssdesignawards.com/)