Privacy Policy

This Privacy Notice explains how MindsDB, Inc. (“we,” “us,” or “our”), the company behind MindsHub, collects, uses, discloses, and protects personal information when you visit our websites, interact with our marketing, register for events, contact us, create an account and use the MindsHub platform and the MindsHub Cowork app (on the web or as a desktop app), or use our open-source software. It also describes your privacy rights and how to exercise them.

Who we are. MindsDB, Inc., legal address: 3277 S White Rd PMB 10166, San Jose, CA 95148, USA. Data Protection Officer (DPO). Adam Carrigan – [email protected].

If you use our products under a separate agreement (such as our Master Customer Agreement or Terms of Service), or you are an employee/candidate, this notice may be supplemented by product- or HR-specific notices.

1) Scope and audience

This notice covers personal information we handle as a controller — that is, where we determine why and how it is processed. It applies to:

• Business Contacts — visitors, prospective customers and partners, vendors, and other contacts who interact with our public websites and marketing.
• Account and product users — people who create an account and use the MindsHub platform or the Cowork app (web or desktop), including the account, billing, and usage information described below.
• Open-source software users — people who use software we publish, to the extent that software sends information back to us (see Open-source software below).

It does not cover the content and data you submit into the product for processing on your behalf (for example, the data you connect, your prompts, and the files an agent works with). We process that as a processor/service provider on your instructions, governed by your agreement with us and our Data Processing Addendum — not this notice. How we handle that content as part of providing the product is summarized in our Terms of Service and AI Policy.

2) Information we collect

We collect personal information in the categories below (examples are illustrative):

• Identifiers & contact details – name, employer, job title/role, business email, phone, country/region, online and account identifiers (such as user and organization IDs), and any information you provide in forms or communications.
• Account information – the credentials and profile details you provide when you register for and sign in to the MindsHub platform or Cowork.
• Billing & transaction information – the billing details and subscription records associated with a paid plan. Payments are handled by our payment processor; we do not store full payment card numbers.
• Product usage & device data – logs, feature usage, configuration, diagnostics, and, for the desktop app, app version, operating system, and crash/diagnostic reports. We use these to operate, secure, and improve the product.
• Professional information – company, team, interests, purchase intent, and CRM notes.
• Internet / device & usage data (websites) – IP address, device and browser type, operating system, pages viewed, links clicked, referring URLs, time spent, language, and approximate geolocation (derived from IP).
• Cookies & similar technologies – first-party identifiers we set for analytics and (where enabled) ad-conversion measurement. See our Cookie Policy for the full list.
• Event & webinar data – registration information, attendance, and feedback.
• Support interactions – content of messages, call/chat metadata.
• Sensitive personal information – we do not intentionally collect sensitive personal information through our websites or marketing. If you provide it in a free-text field, we process it only as needed to handle your request.

Sources of information. We collect information directly from you (forms, emails, support, and when you set up and use an account), automatically via your device and the product (cookies, logs, telemetry), and from third parties (co-marketing partners, event organizers, lead-generation providers, our payment processor, and publicly available sources such as LinkedIn, when allowed by law).

3) How we use personal information (purposes)

We use personal information to:

1. Provide, operate, secure, and improve our websites, the MindsHub platform, and the Cowork app.
2. Create and administer accounts and authenticate users.
3. Process payments and manage subscriptions, renewals, and billing.
4. Communicate with you, respond to inquiries, send administrative and service messages, and provide requested materials (e.g., whitepapers, demos).
5. Market and advertise our services, including measuring campaign effectiveness (see Cookies & tracking controls).
6. Plan and host events and manage registrations.
7. Maintain security and prevent fraud, abuse, or misuse.
8. Comply with legal obligations and enforce our agreements.

Where required by law, we obtain consent before using cookies for non-essential purposes or sending certain marketing communications.

4) Cookies & tracking controls

We use a small number of first-party cookies and similar technologies. No third-party tracking SDKs or ad pixels load in your browser — analytics and ad-conversion measurement happen server-to-server from our infrastructure.

• In regions requiring prior consent (for example, the EU/UK/EEA/Switzerland/Canada), we seek opt-in consent for non-essential cookies. These are not set until you accept.
• In the United States and other opt-out regions, you may opt out of analytics and ad-conversion measurement via the Your Privacy Choices link and by enabling recognized opt-out preference signals.
• You can change your preferences at any time via the cookie banner, the Cookie Preferences control in our footer, or your browser settings.

For the current, itemized list of cookies and the platforms that receive data on our behalf, see our Cookie Policy.

5) When and with whom we disclose information

We disclose personal information as described below (we do not disclose lists of individual names unless required by law):

• Service providers/contractors who process data for us under written contracts (e.g., hosting and cloud infrastructure, payment processing, analytics, email delivery, CRM, event management, customer support, security). They may access personal information only to perform services for us and must not use it for their own purposes. Our key service providers include PostHog (product and website analytics), HubSpot (marketing and sales CRM), Supabase (data storage, including for open-source analytics and marketing data), and our cloud hosting and payment processors.
• Model providers (when you use the product). If you route model calls through the MindsHub router, we send the necessary inputs to the third-party model providers that fulfill those calls. If you connect your own provider accounts, your inputs go to those providers under your agreement with them. See our AI Policy.
• Advertising and analytics platforms for audience measurement and ad-conversion measurement, sent server-to-server to each platform — see “Selling” / “sharing” below.
• Business partners in co-marketing or joint events when you register for those programs.
• Professional advisors (lawyers, accountants), authorities, and others when necessary for compliance, safety, and legal reasons.
• Corporate transactions – if we engage in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to confidentiality.

We do not knowingly allow our service providers to use personal information except to provide the services we request or as permitted by law and contract.

6) “Selling” or “sharing” personal information / targeted advertising

We do not “sell” personal information for money, and we do not build cross-site advertising profiles, run behavioral retargeting, fingerprint your device, or record your session. Our advertising activity is limited to conversion measurement — sending click identifiers (e.g., gclid) and an IP-derived approximate location server-to-server to ad platforms’ Conversions APIs to learn which campaigns drove a visit or sign-up.

Under some U.S. state privacy laws, this conversion measurement may qualify as “sharing” or “cross-context behavioral advertising.” You may opt out at any time via the Your Privacy Choices link and by using recognized opt-out preference signals. We honor Global Privacy Control (GPC) and other recognized regional opt-out signals where required.

7) Your rights & choices

Your rights depend on where you live. We will honor requests as required by applicable law and, where reasonable, in other regions as well.

California & other U.S. state privacy laws

If you live in CA, CO, CT, UT, VA, OR (and other states with comprehensive privacy laws), you may have the right to:

• Know/Access the categories and specific pieces of personal information we collected about you.
• Delete personal information we collected from you.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information and of targeted advertising.
• Limit the use and disclosure of sensitive personal information (if we collect it).
• Appeal our decision if we decline to act on your request (where applicable).

How to exercise your rights. Submit a request at [email protected] (subject line: Privacy Request). For opt-outs of targeted advertising, use the Your Privacy Choices link on our site or enable GPC in your browser. We will confirm receipt within 10 business days and respond within 45 days (or as allowed by law). We will take steps to verify your identity (and authority of any authorized agent).

We will not discriminate against you for exercising your rights.

Do Not Track. Our websites do respond to browser Do-Not-Track (DNT) signals by disabling non-essential tracking used for targeted advertising (and limiting analytics as configured). We also honor Global Privacy Control (GPC).

EU/EEA, UK, and Switzerland (GDPR/UK GDPR)

If you are in the EU/EEA, UK, or Switzerland, you have the rights to access, rectify, erase, restrict, object (including to direct marketing), and data portability, and the right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). You also have the right to lodge a complaint with your local supervisory authority.

Legal bases. Depending on the context, we rely on: contract (to provide an account, the product, and requested materials), legitimate interests (to operate and secure our sites and product, to conduct B2B marketing compatible with your expectations, to improve our services), consent (for non-essential cookies/marketing where required), and legal obligation.

DPO contact. Adam Carrigan – [email protected].

Brazil (LGPD), Canada (PIPEDA/Provincial), Japan (APPI), South Korea (PIPA), and other regions

Residents of these jurisdictions may have similar rights to access, correct, delete, or object/opt-out of certain processing, and to lodge complaints with local authorities. You can exercise rights by contacting [email protected].

8) Open-source software

We publish open-source software, including open-source agents and the MindsDB query engine. Your use of that software is governed by the license that accompanies it. Some open-source builds may send us limited, optional diagnostic or usage information; where they do, that collection is described in the software’s documentation, and you can disable it as described there. We do not collect the contents of the data you process with self-managed open-source software.

9) International data transfers

We are headquartered in the United States and may transfer your personal information to countries that may not provide the same level of protection as your home country. Where required, we use legally approved safeguards (for example, Standard Contractual Clauses (SCCs) or country-specific equivalents).

10) Data retention

We keep personal information for as long as necessary to achieve the purposes described above, including to comply with legal, accounting, or reporting obligations, resolve disputes, and enforce agreements. We also consider the amount, nature, and sensitivity of the data and the risk of harm from unauthorized use or disclosure.

Typical retention periods:

• Website analytics: 13–24 months (per cookie/tool settings).
• CRM & marketing records for Business Contacts: 3 years after last meaningful interaction.
• Account & billing records: for the life of the account and as required for tax, accounting, and legal purposes after it closes.
• Product usage logs & diagnostics: typically up to 24 months, then deleted or aggregated.
• Event registration: 3 years after the event.
• Support communications: 5 years after resolution.

11) Security

We use administrative, technical, and physical measures designed to protect personal information, including encryption in transit and at rest for account and product data and scoped access controls for stored credentials. No method of transmission or storage is 100% secure; if we learn of a security incident that affects your information, we will notify you as required by law.

12) Children’s privacy

Our websites and products are intended for adults and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided personal information to us, contact [email protected] and we will take appropriate steps.

13) Changes to this notice

We may update this notice from time to time. When we do, we will change the “Last updated” date at the top and, when required, provide additional notice.

14) How to contact us

MindsDB, Inc. Legal address: 3277 S White Rd PMB 10166, San Jose, CA 95148, USA Data Protection Officer: Adam Carrigan – [email protected] For privacy requests, email [email protected] and include Privacy Request in the subject line.