Privacy Policy

This Privacy Notice explains how MindsDB, Inc. (“we,” “us,” or “our”), the company behind MindsHub, collects, uses, discloses, and protects personal information when you visit our websites, interact with our marketing, register for events, contact us, create an account and use the MindsHub platform and the MindsHub Cowork app (on the web or as a desktop app), or use our open-source software. It also describes your privacy rights and how to exercise them.

Who we are. MindsDB, Inc., legal address: 3277 S White Rd PMB 10166, San Jose, CA 95148, USA. Data Protection Officer (DPO). Adam Carrigan – hello@mindsdb.com.

If you use our products under a separate agreement (such as our Master Customer Agreement or Terms of Service), or you are an employee/candidate, this notice may be supplemented by product- or HR-specific notices.

1) Scope and audience

This notice covers personal information we handle as a controller — that is, where we determine why and how it is processed. It applies to:

• Business Contacts — visitors, prospective customers and partners, vendors, and other contacts who interact with our public websites and marketing.
• Account and product users — people who create an account and use the MindsHub platform or the Cowork app (web or desktop), including the account, billing, and usage information described below.
• Open-source software users — people who use software we publish, to the extent that software sends information back to us or you interact with our public repositories (see Open-source software below).

It does not cover the content and data you submit into the product for processing on your behalf (for example, the data you connect, your prompts, and the files an agent works with). We process that as a processor/service provider on your instructions, governed by your agreement with us and our Data Processing Addendum — not this notice. Diagnostic traces and session replays of your product activity (see Product usage & device data below) may include that content; where they do, the content is handled under the Data Processing Addendum, while the usage metadata around it — identifiers, volumes, and timing — is information we handle as a controller and is covered by this notice. How we handle that content as part of providing the product is summarized in our Terms of Service and AI Policy.

2) Information we collect

We collect personal information in the categories below (examples are illustrative):

• Identifiers & contact details – name, employer, job title/role, business email, phone, country/region, online and account identifiers (such as user and organization IDs), and any information you provide in forms or communications.
• Account information – the credentials and profile details you provide when you register for and sign in to the MindsHub platform or Cowork.
• Billing & transaction information – the billing details, payment transactions, and prepaid-balance and usage-billing records associated with paid use. Payments are handled by our payment processor; we do not store full payment card numbers.
• Product usage & device data – logs, feature usage, configuration, diagnostics, and, for the desktop app, app version, operating system, and crash/diagnostic reports. We also use Sentry for product error and performance monitoring and session replay to investigate problems with the product. We do not record sessions on our marketing website. We use these to operate, secure, and improve the product. This category also includes traces of your use of the product: the requests and agent turns routed through the MindsHub model router, with the model used, token counts, timing, and your user and organization IDs, together with the inputs, outputs, and tool calls of those requests (content we handle under the Data Processing Addendum, as described in Scope and audience). We keep traces for diagnostics, troubleshooting, and reliability and quality monitoring of the product, to derive usage metrics such as token and request counts, and to show you your own traces, which you can view through Unified Inference, the MindsHub inference API. Calls you make with your own provider keys go directly to the provider and are not traced by us.
• Professional information – company, team, interests, purchase intent, and CRM notes.
• Internet / device & usage data (websites) – IP address, device and browser type, operating system, pages viewed, interactions with pages and features, referring URLs, time spent, language, and approximate geolocation (derived from IP).
• Cookies & similar technologies – cookies and browser technologies used to operate the website, understand usage and (where enabled) measure advertising performance. See our Cookie Policy for the full list.
• Event & webinar data – registration information, attendance, and feedback.
• Support interactions – content of messages, call/chat metadata.
• Sensitive personal information – we do not intentionally collect sensitive personal information through our websites or marketing. If you provide it in a free-text field, we process it only as needed to handle your request.

Sources of information. We collect information directly from you (forms, emails, support, and when you set up and use an account), automatically via your device and the product (cookies, logs, telemetry), and from third parties (co-marketing partners, event organizers, lead-generation providers, our payment processor, and publicly available sources such as LinkedIn, when allowed by law).

3) How we use personal information (purposes)

We use personal information to:

1. Provide, operate, secure, and improve our websites, the MindsHub platform, and the Cowork app.
2. Create and administer accounts and authenticate users.
3. Process payments and manage billing, including prepaid-balance top-ups, auto-recharge, and usage charges.
4. Communicate with you, respond to inquiries, send administrative and service messages, and provide requested materials (e.g., whitepapers, demos).
5. Market and advertise our services, including measuring campaign effectiveness (see Cookies & tracking controls).
6. Plan and host events and manage registrations.
7. Maintain security and prevent fraud, abuse, or misuse, including enforcing the Fair Use Policy and usage limits. To do this, we analyze account and usage data — such as request volumes, timing, and account age — across accounts, for example to detect one person opening many accounts.
8. Comply with legal obligations and enforce our agreements.

Where required by law, we obtain consent before using cookies for non-essential purposes or sending certain marketing communications.

4) Cookies & tracking controls

We use cookies and similar technologies, including browser-based analytics, to understand how visitors use our website and improve it. Analytics and marketing measurement follow your privacy choices and applicable regional requirements.

• Where prior consent is required, optional analytics and marketing technologies wait for your choice. Limited audience measurement may operate without consent only where permitted by law.
• In opt-out regions, you can turn off optional analytics and ad-conversion measurement through Your Privacy Choices or Privacy choices. We honor Global Privacy Control (GPC).
• Rejecting, opting out or sending GPC turns off analytics cookies, browser analytics and ad-conversion measurement; we continue to collect website usage information without analytics cookies.
• You can change your choices at any time using the website’s privacy controls. Accepting product terms does not replace a cookie choice where consent is required.

See our Cookie Policy for the technologies we use and how to control them.

5) When and with whom we disclose information

We disclose personal information as described below:

• Service providers and contractors who help us operate our business under appropriate contracts. These include AWS and Cloudflare (hosting, infrastructure, security and related processing), PostHog (website and product analytics), Sentry (product diagnostics and session replay), HubSpot (marketing email, sales CRM and support), Slack, Linear and Google Workspace (communications, issue tracking and support), Metronome (customer identifiers and usage metering for billing), Stripe (payments), and Supabase (demo and open-source community datasets). Google also provides reCAPTCHA for website bot detection. Customer content handled on your behalf is subject to our Data Processing Addendum. Some providers, such as payment providers, also process information for their own legal and operational purposes under their privacy notices.
• Model providers (when you use the product). If you route model calls through the MindsHub router, we send the necessary inputs to the third-party model providers that fulfill those calls. If you connect your own provider accounts, your inputs go to those providers under your agreement with them. See our AI Policy.
• Advertising and analytics platforms for audience measurement and ad-conversion measurement — see “Selling” / “sharing” below.
• Business partners in co-marketing or joint events when you register for those programs.
• Professional advisors (lawyers, accountants), authorities, and others when necessary for compliance, safety, and legal reasons.
• Corporate transactions – if we engage in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to confidentiality.

We do not knowingly allow our service providers to use personal information except to provide the services we request or as permitted by law and contract.

6) “Selling” or “sharing” personal information / targeted advertising

We do not “sell” personal information for money, and we do not build cross-site advertising profiles, run behavioral retargeting or fingerprint your device for advertising. Our advertising activity is limited to conversion measurement to understand which campaigns drove visits and sign-ups. Subject to your choices, we send advertising click identifiers, IP address, browser user agent, approximate location and conversion events to Google Ads, X Ads and LinkedIn Ads.

Under some U.S. state privacy laws, this conversion measurement may qualify as “sharing” or “cross-context behavioral advertising.” You may opt out at any time via the Your Privacy Choices link and by using recognized opt-out preference signals. We honor Global Privacy Control (GPC) and other recognized regional opt-out signals where required.

7) Google user data (Limited Use)

MindsHub Cowork can connect to your Google account (for example, Gmail, Google Calendar, and Google Drive) through Google Workspace APIs — only when you choose to connect it and only with the permissions you grant on Google’s consent screen. You can revoke access at any time from your Google Account permissions page or by disconnecting the integration in Cowork.

Limited Use compliance statement. The use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google Workspace APIs is used solely to provide and improve user-facing features within MindsHub Cowork. It is never sold, and it is never used to train generalized or non-personalized AI/machine learning models, including any third-party model providers integrated into the platform. These commitments apply to all Google user data we receive through these APIs, including data we handle as a processor on your behalf.

8) Your rights & choices

Your rights depend on where you live. We will honor requests as required by applicable law and, where reasonable, in other regions as well.

California & other U.S. state privacy laws

If you live in CA, CO, CT, UT, VA, OR (and other states with comprehensive privacy laws), you may have the right to:

• Know/Access the categories and specific pieces of personal information we collected about you.
• Delete personal information we collected from you.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information and of targeted advertising.
• Limit the use and disclosure of sensitive personal information (if we collect it).
• Appeal our decision if we decline to act on your request (where applicable).

How to exercise your rights. Submit a request at hello@mindsdb.com (subject line: Privacy Request). For opt-outs of targeted advertising, use the Your Privacy Choices link on our site or enable GPC in your browser. We will confirm receipt within 10 business days and respond within 45 days (or as allowed by law). We will take steps to verify your identity (and authority of any authorized agent).

We will not discriminate against you for exercising your rights.

Do Not Track. Our optional browser analytics respects browser Do-Not-Track (DNT) signals. We also honor Global Privacy Control (GPC) as described above.

EU/EEA, UK, and Switzerland (GDPR/UK GDPR)

If you are in the EU/EEA, UK, or Switzerland, you have the rights to access, rectify, erase, restrict, object (including to direct marketing), and data portability, and the right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). You also have the right to lodge a complaint with your local supervisory authority.

Legal bases. Depending on the context, we rely on: contract (to provide an account, the product, and requested materials), legitimate interests (to operate and secure our sites and product, to conduct B2B marketing compatible with your expectations, to improve our services), consent (for non-essential cookies/marketing where required), and legal obligation.

DPO contact. Adam Carrigan – hello@mindsdb.com.

Brazil (LGPD), Canada (PIPEDA/Provincial), Japan (APPI), South Korea (PIPA), and other regions

Residents of these jurisdictions may have similar rights to access, correct, delete, or object/opt-out of certain processing, and to lodge complaints with local authorities. You can exercise rights by contacting hello@mindsdb.com.

9) Open-source software

We publish open-source software, including open-source agents and the MindsDB query engine. Your use of that software is governed by the license that accompanies it. Some open-source builds may send us limited, optional diagnostic or usage information; where they do, that collection is described in the software’s documentation, and you can disable it as described there. We do not collect the contents of the data you process with self-managed open-source software.

Information you choose to post in public repositories or issue trackers may be visible to others. We may also use publicly available repository and contributor information to understand our open-source community. Please do not include confidential customer information in public submissions.

10) International data transfers

We are headquartered in the United States and may transfer your personal information to countries that may not provide the same level of protection as your home country. Where required, we use legally approved safeguards (for example, Standard Contractual Clauses (SCCs) or country-specific equivalents).

11) Data retention

We retain heatmap data for 90 days. Other website and product usage information is kept as needed to understand trends and improve our services; the 90-day limit does not apply to those event records. We keep account and billing records for the customer relationship and applicable legal or accounting periods; CRM, marketing and event records while relevant to our relationship, follow-up or your preferences; and support records while needed to resolve issues and maintain service history. These periods can extend for several years. We consider the information’s sensitivity and delete or de-identify it when no longer needed, subject to legal obligations and dispute resolution.

Customer content is retained and deleted according to the applicable agreement and Data Processing Addendum. Request and response payloads stored by the MindsHub Inference API are retained for 30 days; diagnostic traces are governed by the applicable agreement and DPA. To request access to or deletion of your personal information, contact hello@mindsdb.com.

12) Security

We use administrative, technical, and physical measures designed to protect personal information, including encryption in transit and at rest for account and product data and scoped access controls for stored credentials. No method of transmission or storage is 100% secure; if we learn of a security incident that affects your information, we will notify you as required by law.

13) Children’s privacy

Our websites and products are intended for adults and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided personal information to us, contact hello@mindsdb.com and we will take appropriate steps.

14) Changes to this notice

We may update this notice from time to time. When we do, we will change the “Last updated” date at the top and, when required, provide additional notice.

15) How to contact us

MindsDB, Inc. Legal address: 3277 S White Rd PMB 10166, San Jose, CA 95148, USA Data Protection Officer: Adam Carrigan – hello@mindsdb.com For privacy requests, email hello@mindsdb.com and include Privacy Request in the subject line.