Privacy Policy

MindAI Labs (“MindAI”, “we”, “us”) operates the MindAI platform — the dashboard, terminal, agent chat, journal, and related services (the “Service”). This policy covers data processed when you visit our website or use the Service. It does not cover the practices of exchanges or other third parties you connect.

We collect three broad categories of data:

• Account data — name, email address, password hash, plan and billing status, and preferences such as local currency.
• Trading data you connect — balances, positions, orders, and fills read from the exchange API keys you add, plus the journal entries, notes, and tags you create in the product.
• Usage and device data — log data such as IP address, browser type, pages viewed, and feature usage, collected to keep the Service secure and to improve it.

We do not collect exchange withdrawal permissions, private keys, or custody of funds — ever.

• Operate the Service: render your dashboard, compute risk metrics, fire alerts, and answer agent questions about your account.
• Secure the Service: detect abuse, prevent unauthorized access, and audit changes to your account.
• Improve the product: aggregate, de-identified usage analysis to understand which features help traders.
• Communicate with you: service emails such as alerts you opt into, billing notices, and material changes to terms.

We do not sell your personal data, and we do not use your trading data to trade against you or share it with market counterparties.

When you use agent chat, your messages and the relevant slices of your connected data are processed by our AI infrastructure to generate responses. Conversations are stored so you can revisit threads and so the agent can keep context.

• Agent conversations are private to your account and are not shared between users.
• We do not use your identifiable conversations or trading data to train foundation models.
• You can delete individual threads at any time; deletion propagates to our stores within 30 days.

We share data only with:

• Service providers — hosting, payment processing, email delivery, and error monitoring vendors bound by data-processing agreements.
• Exchanges you connect — we call their APIs with your keys to read your account data.
• Legal authorities — where required by applicable law, subpoena, or to protect the rights and safety of users and the Service.
• A successor entity — in a merger or acquisition, subject to this policy or one at least as protective.

• Account data: kept while your account is active, deleted within 30 days of account deletion.
• Trading and journal data: kept while the related connection or entry exists; removed when you disconnect an exchange or delete entries.
• Usage logs: retained up to 12 months for security, then aggregated or deleted.
• Billing records: retained as long as tax and accounting law requires.

• Exchange API keys are encrypted at rest with per-tenant keys and never exposed to your browser after entry.
• All traffic is encrypted in transit with TLS 1.2+.
• Access to production data is limited to on-call engineers, logged, and reviewed.
• We run continuous monitoring and independent penetration tests.

No system is perfectly secure. If we learn of a breach affecting your data, we will notify you without undue delay and in accordance with applicable law.

Depending on where you live (including under GDPR and CCPA), you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing.

• Export or delete your data from Settings → User at any time.
• Disconnect an exchange from Settings → Exchanges to stop all related collection immediately.
• Email privacy@mindai.app to exercise any right you cannot action in-app; we respond within 30 days.

You may also lodge a complaint with your local data-protection authority.

We use strictly necessary cookies for authentication and session security, and a small set of first-party analytics events to understand product usage. We do not run third-party advertising trackers, and we honor Global Privacy Control signals where required.

We may process data in countries other than your own. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses.

The Service is not directed to anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us personal data, contact us and we will delete it.

We will post any changes to this policy here and, for material changes, notify you by email or in-app before they take effect.

Questions or requests: privacy@mindai.app.