Privacy Policy

(1) Account Information — your email address and password (stored in hashed form), plus any optional profile details (e.g., display name, avatar).

(2) Content Data — text, documents, audio/video files, or URLs you submit for mind map generation, and the mind maps generated from them.

(3) Payment Information — payments are processed by Stripe. Your card number and other payment credentials are submitted directly to Stripe; we never receive or store them. We keep only Stripe's customer identifier, your subscription status, and billing period records.

(4) Log and Device Data — IP address, browser type, operating system, access timestamps, and clickstream records.

(5) Cookies and Similar Technologies — we use cookies to maintain your session, remember preferences, and analyze usage patterns; Microsoft Clarity also sets cookies to record anonymized session replays and heatmaps (clicks, scrolls, and navigation) that help us find where the product is confusing, with text you type or paste, your mind map content, and payment fields masked before they leave your browser.

(6) Third-Party Login Data — if you sign in via Google or another OAuth provider, we receive the publicly shared information authorized by that provider (typically email and avatar).

(1) To deliver the core Service: processing your input through AI models to generate mind maps and summaries.

(2) To improve the Service: analyzing aggregated usage data to refine algorithm accuracy, optimize the interface, and enhance system reliability.

(3) To protect security: detecting and preventing fraud, abuse, and unauthorized access.

(4) To communicate with you: sending essential service notifications, support responses, and product updates you have opted into.

We do not sell your personal information. To provide the Service, your data is processed on our behalf by the following categories of providers, each bound by contractual confidentiality obligations:

(1) Payments — Stripe (subscriptions and payment processing);

(2) AI models — Google (Gemini, for mind map generation and content moderation) and third-party models accessed via OpenRouter (including Meta Llama Guard, for content safety review). Content you submit is sent to these providers as processing requests; we do not permit them to use your content to train their models.

(3) Hosting and database — Vercel (application hosting), Supabase (database and authentication), Upstash (rate-limiting cache);

(4) Email — Resend (service notifications);

(5) Analytics — Google Analytics and Plausible Analytics (anonymized usage statistics; Plausible sets no cookies and performs no cross-site tracking), and Microsoft Clarity (session replay and heatmaps, with sensitive input and mind map content masked). We may also disclose data when required by law, legal process, or a binding government order; when necessary to protect the rights, property, or safety of MindLM, our users, or the public; or in connection with a merger, acquisition, or asset transfer (with prior notice to you).

We employ industry-standard security measures — including TLS encryption in transit, AES-256 encryption at rest, and role-based access controls — to protect your data. We retain your personal data for as long as your account is active or as needed to provide the Service. After account deletion, we will delete or anonymize your data within thirty

(30) days, except where longer retention is required by law.

(1) Access and Correction — you may view and update your profile information at any time through account settings.

(2) Data Portability — you may export your saved mind maps and content at any time.

(3) Deletion — you may request account deletion and erasure of associated data. Upon deletion, we will cease providing the Service and remove or anonymize your information in accordance with applicable law.