---
title: "Data Protection Impact Assessment (DPIA) | Minds"
canonical_url: "https://getminds.ai/legal/dsfa"
last_updated: 2026-11-07
meta:
  description: "Last Updated: November 7, 2026"
  "og:description": "Last Updated: November 7, 2026"
  "og:title": "Data Protection Impact Assessment (DPIA) | Minds"
  "twitter:description": "Last Updated: November 7, 2026"
  "twitter:title": "Data Protection Impact Assessment (DPIA) | Minds"
---

Minds

November 7, 2026·Minds Team # **Data Protection Impact Assessment (DPIA)** Last Updated: November 7, 2026**Last Updated: November 7, 2026****Application of this revision.** This revision applies to new agreements accepted on or after November 7, 2026. For an existing agreement, it applies only through its agreed change, notice, renewal and consent process. Publication does not replace an expressly incorporated earlier version, a signed order or a shorter notification period agreed there. Mandatory rights and duties remain unaffected.**Minds entities.** The Minds services are provided by Minds AI Labs, Inc., 1111B S Governors Ave #54653, Dover, DE 19904, USA, and by Art of X UG (haftungsbeschränkt), Köpenicker Straße 145, 10997 Berlin, Germany. Which entity is your contracting entity follows Section 1 of the Terms of Service (billing address in the United States: Minds AI Labs, Inc.; all other cases: Art of X UG). This document applies equally to both entities; references to "Minds", "we" and "us" mean your contracting entity. This DPIA pursuant to Art. 35 GDPR evaluates data protection risks of the Minds platform by Minds AI Labs, Inc. and Art of X UG (haftungsbeschränkt) (together "Minds"). ## 1. Processing Description Minds enables customers to create and use synthetic AI personas ("Minds") for simulated panels, research, creative workflows, voice and messaging interactions, API/MCP workflows, and optional integrations. | Category | Details |
| --- | --- | | **Data subjects** | Controller employees, invited end users, individuals whose data is entered, and individuals referenced in submitted content, messages, calls, or public sources | | **Data types** | Contact data, credentials, usage data, content (text/images/audio/files/URLs), prompts and outputs, embeddings, API/OAuth tokens, voice metadata, technical data, payment data (Stripe) | | **Locations** | EU primary (DE, SE), USA and other third countries for selected APIs under DPF/SCCs | | **Retention** | Contract duration; deletion from active systems within 30 days and from protected backups within up to 30 further days, unless shorter feature-specific deletion, consent revocation, legal retention, or audit/security retention applies | | **Purpose** | AI platform services, customer-directed simulations, integrations, source collection, messaging/voice, security, and support. No training, fine-tuning, or improvement of general-purpose, foundation, generalized, shared, or third-party models or generalized datasets. | | **Technology** | LLM APIs (OpenAI, Anthropic, Google), voice services (Deepgram), source/search providers (Exa, Firecrawl, Apify), infra (DigitalOcean Frankfurt, Supabase Stockholm), security (Cloudflare, TLS 1.2+, AES-256). | ## 2. Necessity and Proportionality - **Legal basis**: Art. 6(1)(b) GDPR (contract), Art. 28 GDPR (processor), Art. 6(1)(a) (consent for analytics) - **Purpose limitation**: Processing only per DPA. No model training, marketing, or unauthorized sharing. - **Data minimization**: UUIDs over names, aggregated analytics, automatic deletion - **Storage limitation**: deletion from active systems within 30 days after contract end; residual protected backups deleted or overwritten within up to 30 further days ## 3. Risk Assessment | Risk | Likelihood | Severity | Residual | Mitigation |
| --- | --- | --- | --- | --- | | Unauthorized access | Low | High | Low | MFA, RBAC, AES-256, Row-Level Security, scoped and revocable tokens | | Data breach | Low | High | Low | TLS 1.2+, encrypted backups, Cloudflare, incident process, breach notification without undue delay under the DPA | | AI training on customer data contrary to the contract | Very Low | High | Very Low | Contractual prohibition on generalized/shared training for every plan and subprocessor; a private customer-specific model requires deliberate documented instruction and remains isolated to that customer | | Cross-tenant leakage | Very Low | Critical | Very Low | Row-Level Security, tenant checks, automated tests | | Material AI incident, including systemic provenance failure or unauthorized AI/integration action | Low | High | Low | Incident investigation, containment, customer notification, audit logs, human oversight, suspension and remediation controls | | Government access (FISA/CLOUD Act) | Low | Medium | Low | EU-primary infra, DPF/SCCs, transfer review, transparency clause | | Voice, likeness, or cloned-voice misuse | Low | High | Medium | Consent requirements, acceptable-use restrictions, logging, takedown and suspension rights | | Public source extraction of unlawful or sensitive data | Medium | Medium | Medium | User warranties, prohibited-use rules, source logging, minimization, deletion rights, provider controls | | Machine-readable AI marking and detection transition | Medium | Medium | Medium | Persistent interaction notice and UI labels now, generation metadata, implementation deadline 2 December 2026 for pre-existing systems | | Availability loss | Low | Medium | Low | Protected backups, recovery procedures, monitoring, and Order Form-specific recovery commitments where agreed | ## 4. Measures - **Technical**: TLS 1.2+, AES-256, MFA, RBAC, Row-Level Security, EU infrastructure, in-house AI observability (EU), scoped API/OAuth tokens, integration audit logs - **Organizational**: External DPO (Prof. Dr. Norman Uhlmann), NDAs, training, documented incident response and DPA breach notification - **Contractual**: Required processor terms and transfer safeguards, no-generalized-training controls, 14-day subprocessor change notice, and government-request transparency where legally permitted ## 5. Consultation**DPO**: Prof. Dr. Norman Uhlmann, h3ko Innovations GmbH, Pappelallee 64, 16359 Biesenthal, Germany. [privacy@getminds.ai](https://getminds.ai/mailto:privacy@getminds.ai)**Art. 36**: Prior consultation not required (residual risk not "high").**Review**: Annually, on significant changes, or on supervisory authority request. ---**Art of X UG (haftungsbeschränkt)** | Köpenicker Straße 145, 10997 Berlin | [privacy@getminds.ai](https://getminds.ai/mailto:privacy@getminds.ai)**Minds AI Labs, Inc.** | 1111B S Governors Ave #54653, Dover, DE 19904, USA | [privacy@getminds.ai](https://getminds.ai/mailto:privacy@getminds.ai) ## **Continue your procurement review**Use the buyer-facing checklist and evidence pages alongside these legal terms.