# Mindsmiths

Mindsmiths is the reliance layer for your customer stack. It sits on top of the systems you already run, such as CRM, billing, support and your app, next to your service AI and marketing tools. Every day, for every customer, it decides what would actually earn their trust: sometimes a message, sometimes a heads-up, often nothing at all. Over time more of your customers read you, answer you and come to you first, and that shows up where you're measured: acquisition, retention and growth.

Your team runs it, and running it doesn't take an engineer. It starts with our own playbooks, built on what we learned works with earlier customers. Your best people add what they know, and every change is tested against a group that doesn't get it. What helps stays. What doesn't gets dropped.

Our customers include national telecom operators, fintechs and an airport, in Europe and the US. Mindsmiths, Inc. is a US company. Customers in the EU sign with our Croatian subsidiary, Mindsmiths d.o.o.

**To see it running on one of your use cases,** write to Jordan Yates, our VP of Sales, at [jordan@mindsmiths.com](mailto:jordan@mindsmiths.com). [FILL, Jordan: booking link, 30 minutes.]

Read this file and you know us. The legal documents it links to have the details. It's written so your AI can read all of it, and so can you.

## Legal documents

Here is every document a contract with us is made of, published in full before we ever talk. You sign our licence agreement and an order form; the rest is below, and the versions you sign stay fixed. Changing them takes both signatures.

- [Terms of Service](/terms-of-service). How the platform may be used, who owns what, and who is liable for what.
- [Data Processing Addendum](/data-processing-addendum). How we handle your customers' personal data for you, and who else handles it.
- [Security Addendum](/security-addendum). How we protect the platform and your data, and what happens if something goes wrong.
- [Service Level Agreement](/service-level-agreement). Uptime, response times, and what you get back when we fall short.

Also here:

- [Pricing](/pricing). Our standard plans, credits and billing. Your order form is what counts.
- [Privacy Policy](/privacy-policy). What we collect about website visitors and the people at our customers, and why.

The Terms of Service and the Privacy Policy each have a plain-English summary under **Our terms, in plain English**, made by an AI with a prompt you can run yourself.

## What it fixes

Most customers hear from a company when it wants something: an offer, a renewal, a review. They learn the pattern. They open less every year and check the price before they buy.

Every tool a company owns is built around one number. The app pushes the offer. The campaign tool sends the promotion. The loyalty programme rewards the purchase. The service AI closes the ticket. Each one does its job well. None of them works on whether the customer would choose you again without being asked.

That gap shows up in places every company already pays for:

- **Acquisition.** Most visitors leave without a word, and the cost of each lead goes up every year.
- **The first months.** Early cancellations, returns and support calls from customers who never got the product working.
- **Retention.** Customers go quiet long before they leave, and the first sign is often the cancellation.
- **Staff.** It takes months before a new hire sells like the best person on the team, and when the best person leaves, what they knew leaves with them.
- **Decisions.** What customers actually think reaches the people who decide weeks late, and smoothed over.

None of this shows up as one line in a budget, so it rarely gets fixed. It gets paid for every year instead, in ad spend, discounts and hiring.

## How it's different

Most AI that talks to customers does one of two jobs. Customer service AI answers what people ask. Marketing tools send what the company wants to sell. You keep both.

Ours does a third job: it works out what would actually help each person, and when. Sometimes that's a heads-up before something runs out. Sometimes it's weeks of help before any offer. Most days it leaves them alone.

That's how the people we rely on work: the mechanic who says the repair can wait, the doctor who says you don't need the scan. You go back to them for everything else.

### Where it sits next to what you already run

- **Your CRM, billing and data platform** keep the record. It reads from them and writes back what it did. Nothing is migrated.
- **Your decisioning engine** picks the best offer from your catalogue for the people most likely to take it. Ours decides something earlier: whether to reach this person at all, with what, and when. Often that isn't an offer. When it is, the offer is still yours.
- **Your campaign tool** sends what you plan to send. Contact rules, such as how often someone may hear from you, when, and who is left out, are hard rules in the system, not instructions to the AI. When your systems tell it who already heard from you this week, it holds back.
- **Your service AI** answers when customers ask. Ours is the one that notices before they ask.

It adds a job to your stack, not a system to replace. If you stop, nothing else has to change.

### Why not build it on a general model?

You can, and the messages will read well. The hard part is knowing which message, to whom, and when, and that comes from your best people and from testing on real customers, not from the model. That's the part we bring.

### How to judge anyone selling you this

Whoever you talk to, including us, these questions separate a project that proves something from one that only looks busy:

1. **Is the success number fixed before launch, on a number you already track, against a group that doesn't get it?** If results are reported only after the fact, they will always look good.
2. **Who approves what it says, and how fast can you switch it off?** The answer should be your team, and immediately.
3. **What does it do when someone is upset, overwhelmed or in crisis?** A system that only knows how to sell will keep selling.
4. **Does it run alongside the tools you already have?** You shouldn't have to replace anything to find out whether it works.

## What it does

Which plan fits. What to say to an upset customer. What changed this week, and why. Our AI helps with these small decisions, and checks afterwards whether it actually helped. The same layer works for your customers, your staff and your managers, each with its own voice. Each use case below is measured on a number you already track, and each is a place to start. One contract and one meter cover all of them: credits are pooled across your projects, so each business unit can run its own use case against its own number.

### For your customers

- **Finding you (acquisition).** Visitors get a real answer, with the reasons, before anyone asks for their number. *Moves:* leads from the same traffic, cost per lead. *Usually owned by:* marketing or growth. *Setup:* one line of code on your website; live within weeks.
- **Choosing well (conversion).** It recommends what fits and says why, including what they can skip. *Moves:* conversion, returns, early cancellations. *Usually owned by:* sales or e-commerce. *Setup:* [FILL, Juraj: typical time and systems needed.]
- **Getting started (onboarding).** One step at a time, when they need it, until the product works for them. *Moves:* early churn, support calls. *Usually owned by:* customer experience. *Setup:* connects to the systems where your customer data lives, so it takes longer. [FILL, Juraj: typical range.]
- **Staying (retention).** A heads-up before something goes wrong, and quiet the rest of the time, so they still read you when it counts. *Moves:* churn, response rate, usage. *Usually owned by:* customer experience or retention. *Setup:* connects to your customer systems, so it takes longer. [FILL, Juraj: typical range.]
- **Coming back (win-back).** For people who went quiet: weeks of something useful first, the offer last. *Moves:* accepted offers, cost per reactivation. *Usually owned by:* marketing or CRM. *Setup:* [FILL, Juraj.]

### For your staff

- **Daily coaching.** A few minutes a day of practice on the conversations people avoid, not the easy ones. *Moves:* conversion per person, time to ramp, attrition. *Usually owned by:* sales leadership or HR. *Setup:* quick; live within weeks.
- **Field sales.** Every morning: where to go, and which accounts are slipping before the quarter shows it. *Moves:* target attainment, accounts lost. *Usually owned by:* sales leadership. *Setup:* [FILL, Juraj.]

### For your managers

- **The weekly picture.** What customers said this week in their own words, including what nobody wants to hear, and an AI to ask the next question. *Moves:* days from a customer signal to a decision. *Usually owned by:* leadership. *Setup:* [FILL, Juraj.]

### How it works

1. **Notices.** It reads what is happening for each person from the systems a company already runs, such as billing, support and usage.
2. **Decides.** It works out whether anything would help right now. Often the answer is to do nothing.
3. **Helps.** It explains, reminds or answers on the channel the person already uses. When a person would be better placed to help, it hands over.
4. **Checks.** It looks at what happened next. What helped is kept, and what didn't is dropped.

## Proof

### Results so far

Measured in FMCG, telecom and financial services:

- **39% over yearly plan.** An FMCG field sales force, coached daily for two years, on one product line.
- **$4.62 in, $68.83 out, per user.** Financial services: about $15 back for every dollar. This compares engaged with never-engaged users; it was not a randomized test.
- **4.5x more accepted offers.** Same offer, same customers. Ours came after six weeks of useful notes.

### Talk to a customer

Our customers take reference calls, in the US and in Europe. Jordan arranges them once we know which use case you're considering. Case studies naming them, with what changed and how it was measured, will appear here as each customer approves.

### Who's behind us

Our seed round was led by Feels Good Capital, a venture firm that invests only in companies with a positive social impact. They made impact one of our main KPIs. The protocols under **When it gets hard** are how we hold to it.

## Working with us

### How you start

- It starts with one audience and one group of people, measured against a control group that doesn't get it.
- Your team approves every playbook before it goes live.
- We agree the success number before launch, on a number you already track.
- How long setup takes depends on what it touches. Helping visitors on your website takes one line of code, and short daily lessons for staff are just as quick: both can be live in about two weeks. Keeping customers longer means connecting to the systems where your customer data lives, so those projects take longer.
- It then runs against the control group until the result is clear. For how long, and on what terms, ask our assistant on this page or write to [hello@mindsmiths.com](mailto:hello@mindsmiths.com).

### What you need on your side

Someone who owns the number, someone who knows your end users well enough to approve what the AI says, and access to the systems the use case touches. Some customers run it with one person, others with whole teams; it depends on the use case and what it connects to. On committed plans, we support your team through the first 30 days. Custom integrations beyond our standard connectors, and moving data over, aren't part of any plan.

### What it costs

One meter. You pay in credits, a unit like the tokens AI models charge in, for what the AI actually does. Every use case and every channel draws from the same pool, and there are no platform, maintenance or infrastructure fees on top.

| Plan | Price per credit | Term | Annual minimum |
|---|---|---|---|
| On-Demand | $0.002570 | none | none, pay for what you use |
| Annual Commit (30% off) | $0.001799 | 12 months | $21,588 |
| Strategic Commit (50% off) | $0.001285 | 36 months | $15,420 |

- **What a credit buys.** From about 1.5 credits for a proactive message (under $0.01) to about 510 for a four-turn conversation with the AI (about $1.31). Your dashboard always has the current figures.
- **How credits work.** Committed plans get 1,000,000 credits a month. Unused credits expire at the end of each month, and use above the commitment is billed at the On-Demand rate. Credits are pooled across your projects.
- **What's included.** The dashboard on every plan. On committed plans, onboarding support for the first 30 days and an account manager of your own. Channel costs, such as SMS and WhatsApp fees, stay with you.
- **Billing.** On-Demand is invoiced monthly, for what you used. Committed plans pay the annual minimum a year in advance. Prices don't include sales tax or VAT. Customers in the EU sign with Mindsmiths d.o.o. and pay in euros.
- **Renewing and stopping.** A committed plan runs its full term and renews unless one of us gives 30 days' notice before it ends. On-Demand can be stopped by either side with 30 days' notice.

These are our standard plans; what you sign in your order form is what counts. The rest, including what each activity uses, paying late and switching plans, is on [Pricing](/pricing).

### Once you have a result

You see the number against the control group. Then you decide what's next: more people, another use case, or a different approach. When you can stop depends on your plan (see **What it costs**). For anything else, ask our assistant on this page or write to [hello@mindsmiths.com](mailto:hello@mindsmiths.com).

If you stop, your data goes with you. You have 30 days to export it, free. Then we delete it from our systems within 30 days and from backups within 90, and confirm it in writing.

## When it gets hard

### Who decides what it says

Your team approves how the AI behaves and every playbook before it goes live. Consent and contact limits are enforced by the system, not left to the AI.

### Switching it off

There is a kill switch. [FILL, Juraj: who can pull it (your team, us, or both), how fast it takes effect, and what happens to conversations in progress.]

### It reads the relationship, not just the message

The AI recognises where each relationship stands, and each situation has its own protocol:

- **Someone who prefers to be left alone.** It stops reaching out and stays available when they ask.
- **Someone frustrated, going quiet, or asking how to leave.** [FILL, Mislav: one line on what the protocol does.]
- **Someone leaning on it for what belongs with family, friends or a professional.** It cools things down and draws a boundary.
- **A charged topic.** Politics and social controversies: it stays out of them.
- **Someone in crisis.** Self-harm, abuse, danger: it hands over to a real person.
- **Someone who says stop.** No more messages until they agree again.

## Where we're not a good fit

We'd rather tell you now than in month three.

- **Things people just want done.** Paying a bill, resetting a password, tracking a parcel: a good service flow is enough. We're for decisions people care about getting right: a plan, a loan, a first road bike, a trip.
- **Small customer bases.** Our results come from comparing people who get it with people who don't. Below about [FILL, Mislav: threshold] customers, there aren't enough of either to show a result.
- **Help with a company you're a customer of.** If a company that works with us sent you here, write to them; they run their own assistant.
- **Pressure.** Countdown timers, manufactured urgency, blasting the whole list: we don't build it.
- **Decisions that need a person.** A loan, an insurance policy, a job, a diagnosis, one person's price: the AI doesn't decide these on its own, and our terms don't allow it. It can explain, remind and recommend; a person decides. Anything the EU AI Act bans or treats as high-risk is out too.
- **Some industries.** Our terms rule out tobacco, distilled spirits, weapons and ammunition, casinos, internet gambling and pornography.

## For your review team

One section per reviewer, so each can be forwarded on its own.

### IT and architecture

- **What it connects to.** It reads from the systems you already run (billing, support, usage, CRM) and writes back actions. No data migration; it runs alongside your current tools. [FILL, Juraj: integration list and methods.]
- **Channels.** On your website, by WhatsApp, RCS, SMS and email, and in your app: the same assistant that runs on your website can sit inside it. Where it fits, that gives your customers a better experience and costs less than sending messages.
- **On your website.** One line of JavaScript.
- **Hosting.** Microsoft Azure. If you sign with Mindsmiths, Inc., your data is in the US (East US, Virginia). Customers in the EU sign with Mindsmiths d.o.o., and their data stays in the EU (Germany West Central, Frankfurt). Backups stay in the same region. Our team in Zagreb runs and supports the platform.
- **Uptime.** 99.0% a month, measured by how many real requests fail. Planned maintenance doesn't count, and neither do outages at cloud, AI model and channel providers that are outside our control. If we miss it, credits go to your account without you asking: 10% of that month's credits below 99.0%, 25% below 98.0%, 50% below 95.0%. They're credits, not cash, and they last 12 months. Below 95.0% in any month, or below 99.0% in three months out of six, you can leave and get your prepaid fees back.
- **Scheduled messages.** Every month, 99% start no more than 15 minutes after they're due. If not, you get 10% of that month's credits back.
- **Incidents.** If your customers are affected, we respond within 2 hours, aim to fix it within 3, and update you every 2 hours until it's fixed. If only your team is affected, 4 hours to respond and 8 to fix.
- **Backups.** At least daily. We aim to lose no more than an hour of data, and to recover from a major incident within 3 hours. Planned downtime is announced a week ahead; urgent security fixes can't always wait.
- The details are in the [Service Level Agreement](/service-level-agreement).
- [FILL, Juraj: single sign-on.]

### Security

- ISO 27001 certified. Our SOC 2 Type II audit is under way and on schedule.
- Data encrypted at rest (AES-256) and in transit (TLS 1.2 or higher).
- Each customer gets its own environment and its own databases, never shared with another customer. That includes what the AI reads and remembers.
- Everyone on our side who can reach production signs in with multi-factor authentication. Access is need-to-know, reviewed every year, and removed within 48 hours when someone leaves or changes role. Access is logged, and the logs are kept for 12 months.
- An independent penetration test every year, AI included. You can see the summary and what we did about each finding. Critical and high vulnerabilities are fixed within 30 days of a patch, medium ones within 90.
- Defences against prompt injection and jailbreaks, tested every year. Your data never goes into development or testing.
- If your customers' personal data is breached, you hear from us within 72 hours.
- Insurance: $1M per claim and $2M in total for technology errors and omissions, $2M per claim and $3M in total for cyber. Certificates on request.
- The details are in the [Security Addendum](/security-addendum).

### Data and privacy

- **Your customers' data stays put.** Conversations, behaviour and personal details stay in your own isolated environment. They are never pooled across companies and never train any model, ours or our AI providers'; our contracts with the providers rule it out.
- **Your playbooks stay yours.** The playbooks, rules and results your team builds are yours. They are never shown to or reused for another customer, including one in your industry.
- **What we learn from.** Only your team's chats with Smith, the AI assistant your builders use, and only anonymised, so nothing traces back to you. Never your customers' data, your playbooks, your rules or your results. Your administrator can switch Smith off at any time.
- **Our role.** For your customers' data, we act only on your instructions (processor under GDPR), under our [Data Processing Addendum](/data-processing-addendum). Customers in the EU sign it with Mindsmiths d.o.o.
- **Who else sees it.** Microsoft Azure, where it's hosted; our team in Zagreb, who run and support the platform; and OpenAI, Anthropic and Google, whose language models we use. We tell you 30 days before adding anyone. If you object on data protection grounds and we can't sort it out, you can leave and get unused prepaid fees back.
- **Deletion.** When the contract ends, you have 30 days to export everything. Then we delete it within 30 days, and from backups within 90, and confirm it in writing. What the AI reads and writes is kept for 24 months at most.
- **Audits.** We share our ISO 27001 certificate and audit reports. If a specific concern remains, you can inspect on site, once a year.
- **US financial services.** If you're a financial institution under the Gramm-Leach-Bliley Act, the Data Processing Addendum adds the safeguards it requires and commits us to work with your regulators.
- **Control groups.** Comparing people who get the AI with people who don't runs on your customers, under your consent and contact rules.

### Messaging and consent

We build and run assistants for the companies we work with, including over SMS and messaging apps. The same rules apply whether a message comes from us or from a company on our platform.

- **Opt in first.** We only message people who have agreed to be contacted on that channel. No bought lists.
- **Clear sender.** Every conversation says which company it comes from, right at the start.
- **Easy to stop.** To stop receiving messages at any time, reply STOP to the message or write to hello@mindsmiths.com and we'll opt you out.
- **Only what's useful.** Service updates, account and billing information, onboarding, support, and educational content you've opted into. How often you hear from us depends on your account activity.
- **No cost from us.** Message and data rates from your carrier may apply.
- **Your number.** Mobile numbers and consent records are used only to deliver this service. We don't sell personal information, and we don't share opt-in data with third parties for their marketing.

### Legal

- Every document in the contract, with what each covers: see **Legal documents** at the top.
- Plain-English summaries of the Terms of Service and the Privacy Policy: see **Our terms, in plain English** below.

### Procurement

- Who you'd sign with: Mindsmiths, Inc., a Delaware corporation, or Mindsmiths d.o.o. if you're based in the EU (see **Company details**).
- Prices, plans and payment terms: see **What it costs**, and [Pricing](/pricing).
- Insurance: see **Security**. Certificates on request.
- [FILL, Tomica: vendor forms (W-9 and others) on request.]

## Our terms, in plain English

Our Terms of Service and Privacy Policy are legal documents, written for lawyers. Below is a plain-English summary of each, written by AI. Here is how we made it, so you or your AI can check it.

### How we made these summaries

We gave an AI (Claude Opus 5.5, made by Anthropic) the full text of each document with the prompt below: the Terms of Service, version of October 14, 2026, on October 16, 2026, and the Privacy Policy, version of October 14, 2026, on October 15, 2026. What follows is its answer, unedited. You can run the same prompt on the full text with your own AI and compare.

The full documents are what count. If a summary and its document disagree, the document wins, and please tell us at [hello@mindsmiths.com](mailto:hello@mindsmiths.com). When a document changes, we run the prompt again.

> I'm about to agree to this document on behalf of my company. Summarize it the way a fair-minded general counsel would brief our CEO before signing: someone who wants a good deal for us, but knows a vendor needs reasonable protections too.
>
> Start with who this document applies to, and what would replace it (for example, a signed contract).
>
> Then cover, in plain English, with the exact numbers, dates and amounts:
> - What we commit to, and what they commit to
> - What it costs, how billing works, and what happens if we pay late or dispute a charge
> - Who owns what: our data, our content, their software
> - What happens to our data and our customers' data: what's collected, why, where it's stored, who sees it, how long it's kept, and how to get it deleted
> - Who is liable for what, and up to how much
> - How either side can change it or end it, and what continues afterwards
> - Which law applies, and how disputes are handled
>
> For each point, say whether it's standard for business software, better for us, or better for them. Don't treat standard protections as red flags, and don't skip anything unusual. Don't add anything the document doesn't say. Leave out points the document doesn't address.
>
> End with the three things our CEO should know before signing, and anything important the document doesn't cover.

### Terms of Service: summary

**Who it applies to.** These Terms (version dated October 14, 2026) cover two groups: anyone using www.mindsmiths.com (Part B), and any company that has signed a Platform License Agreement with Mindsmiths (Part C). You can't get the platform through the website; you need a signed Platform License Agreement. Our counterparty is Mindsmiths, Inc., a Delaware corporation. EU-based customers contract with its Croatian subsidiary, Mindsmiths d.o.o. in Zagreb. Our customers' end users are not party to these Terms. Their relationship is with us, and any request about their personal data comes to us. *Standard.*

**What replaces it or takes priority.** The signed Platform License Agreement incorporates these Terms together with the Order Form, the Data Processing Addendum, the Security Addendum and the Service Level Agreement. Together these make up "the Agreement." If the Platform License Agreement and these Terms conflict, the Platform License Agreement wins, so anything we negotiate into the signed contract overrides these Terms. Pricing information on the website is only general and is also overridden by the Platform License Agreement. The "entire agreement" clause means that earlier promises, written or verbal, don't count unless they're in the signed documents. *Standard, and helpful to us because negotiated terms take priority.*

**Which version binds us.** The version of these Terms in force on our Effective Date is locked into our Agreement. Any change after that needs a written amendment signed by both sides. Mindsmiths may publish new versions, but only for future agreements and for website use. *Better for us. Many vendors keep the right to change their terms on their own.*

**What we commit to: acceptable use.** We and our Builder Team (the people we authorise to build on the platform) must not:
- reverse engineer the platform
- break the law or infringe anyone's rights
- try to gain unauthorised access to the platform or to other customers' data
- introduce malware
- send spam or unlawful content
- resell or sublicense the platform, beyond serving our own end users
- threaten the platform's security or stability

We must also hold the legally required consents before messaging anyone through a channel (Web, RCS, WhatsApp, SMS, email), and promptly honour every opt-out or do-not-contact request. *Standard.*

**What we commit to: restricted industries.** We can't use the platform in connection with tobacco, distilled alcoholic beverages, weapons or ammunition, casinos, or pornography and internet gambling. *Somewhat unusual. Industry exclusions like these are less common in general business software. They don't matter unless we, or our customers, operate in these sectors.*

**What we commit to: AI features.** If we use the platform's AI features:
- We may not use them to make fully automated decisions, with no human involvement, that affect people's rights or wellbeing or have a legal effect. Examples include finance, employment, healthcare, housing, insurance, social welfare and other essential services. Educational, informational and account-servicing content, scheduling and routing, and recommendations for human review are allowed, as long as they don't communicate or carry out a decision about someone's eligibility, pricing or access.
- If we use the platform to choose who receives offers of regulated products, we're responsible for that selection being lawful.
- We can't disable or get around safety filters.
- We can't present AI output as human-made or remove AI markings.
- We must stop using any output that becomes the subject of an IP claim.
- We must follow applicable "deepfake" rules.
- We can't use the features for anything banned or "high-risk" under the EU AI Act, or for any other dangerous use.
- We must first confirm a feature is effective and safe, and disclose known risks to our users.

We're responsible for the decisions we make with the features. *Mostly standard for AI products. The duties to determine "effective and safe" and to disclose risks to users are broad, and they're better for them.*

**What we commit to: our own data.** We warrant that we own, or are authorised to use, all data and material we put on the platform. *Standard.*

**What they commit to.** Mindsmiths promises that the technical information it gives us is accurate to the best of its knowledge, and that it will fix significant errors it later finds at no cost. Beyond that, the platform is provided "as is," with no warranty of fitness for purpose, non-infringement, or uninterrupted or error-free service. Both sides warrant that they have authority to sign. Mindsmiths may use its affiliates to deliver the service but stays fully responsible for them, and we can't claim directly against those affiliates. Security and service levels are covered only by reference to the separate Security Addendum and Service Level Agreement. *The disclaimer is standard. However, the line saying Mindsmiths has "no further liability" for the "manufacture, use, sale or other disposition" of the platform is unusually broad wording and better for them.*

**Suspension.** If we materially breach the acceptable-use rules, Mindsmiths can suspend all or part of our access after written notice that names the breach. It must restore access promptly once we've fixed the breach to its reasonable satisfaction. If the breach poses an imminent threat to platform security, Mindsmiths can suspend immediately and notify us afterwards. *Standard.*

**What it costs and how billing works.** These Terms don't state prices. Usage is measured in Credits, which our User Experiences (anything we build and deploy for our end users) consume. Our Plan, Term Commitment (the committed contract term), Price per Credit, Credit Allocation, billing and payment terms, and renewal choice are all recorded in the Order Form. Mindsmiths publishes a Credit Consumption Schedule in the dashboard and can update it, but during our Term Commitment it can't change its metering method in a way that materially increases the Credits used for the same operation. *The metering protection is better for us. The fact that Mindsmiths alone can update the schedule is better for them.*

**Late payment and disputed charges.** If any fees are 30 or more days overdue, Mindsmiths can send a written notice. If we don't pay within 15 days of receiving it, Mindsmiths can terminate immediately. Our payment obligations are not limited by the liability caps, and they aren't excused by force majeure. The Terms set out no late-payment interest and no process for disputing a charge. *Standard.*

**Who owns what.** Our data, including our configurations, workflows and the results we produce, stays ours, along with all intellectual property in it. The carve-out is Mindsmiths' own platform and any improvements Mindsmiths makes to it. We give Mindsmiths a non-exclusive, royalty-free right to process our data only as needed to provide the service, fix problems, or comply with law. Mindsmiths owns the platform and every improvement it makes, and we get no ownership interest in the platform. As long as we keep paying, we get those improvements at no extra cost. Our User Experiences, playbooks, knowledge-base content and business rules count as our Confidential Information. Mindsmiths can't disclose them to, or reuse them for, any other customer. Mindsmiths may freely use feedback we give about the platform, but only feedback about the platform itself. *Better for us. The explicit protection of our configurations is stronger than usual.*

**What data is processed and why.** Data from our end users, including conversations, behavioural signals, personal information and transaction data, is processed only to run our User Experiences and measure their outcomes, inside our isolated environment. It may not enter any platform learning pipeline, model training, or cross-customer aggregation. *Better for us.*

**The Smith AI assistant.** If our Builder Team uses Smith, Mindsmiths' AI assistant, their interactions with it may feed anonymised, non-attributable improvements to the platform. End-user data, our specific recipe configurations, business rules and performance benchmarks are excluded. Our admin can switch Smith off at any time, and then no builder data goes to any learning system. After termination we can ask for our builders' raw Smith interaction data to be deleted. *Better for us. It's clear, narrow and can be switched off.*

**Who sees our data.** Mindsmiths must contractually prohibit its foundation-model subprocessors from training on any of our data, including builder interactions. Those subprocessors are listed in the Data Processing Addendum. Confidential information may be shared only with employees and contractors of either side and its affiliates who need it and are bound by comparable confidentiality obligations. The rest of data protection, including deletion of personal data, is handed off to the Data Processing Addendum, with security handled in the Security Addendum. These Terms don't say where data is stored or how long it's kept. *Better for us on training. Everything else depends on the separate addenda.*

**Confidentiality.** Both sides must protect each other's confidential information with at least reasonable care, use it only for the Agreement, and give advance notice before any legally compelled disclosure where the law allows. Either side can seek an injunction. The obligation continues after termination with no end date. The definition is very broad and leaves out the usual exceptions, such as information that is already public, already known, or independently developed. *The core is standard. The missing exceptions and the open-ended duration are unusual, but they apply to both sides equally.*

**Indemnities.** Mindsmiths will defend us against third-party claims that our proper use of the platform infringes someone's IP, and pay any damages or settlements. This doesn't apply where the claim comes from our modifications, from combining the platform with materials Mindsmiths didn't provide or approve, or from continuing to use an old version after a non-infringing one was offered. Mindsmiths can fix the problem by getting a licence, changing the platform, or, as a last resort, ending the affected licence and refunding prepaid unused fees. We must defend Mindsmiths against third-party claims arising from:
- our data and content
- the User Experiences we build
- our breach of the AI rules, the acceptable-use rules, or the law, including communications, consumer-protection, data-protection and financial-services laws

The usual procedure applies: prompt notice, control of the defence goes to the indemnifying side, and no settlement that binds the other side without its consent. These indemnities are the only remedy for the third-party claims they cover. *The Mindsmiths IP indemnity is standard. Our indemnity is broader than typical, because it covers any claim "arising from" our User Experiences, even when the platform's behaviour contributed, and that's better for them.*

**Liability caps.**
- **Standard cap:** each side's total liability is limited to the fees paid or payable in the 12 months before the event that caused the claim.
- **Super-cap (3 times the standard cap):** applies to breach of confidentiality, Mindsmiths' IP indemnity, and our indemnity for our data, content and User Experiences.
- **No cap:** applies to our fees, either side's gross negligence, wilful misconduct or fraud, and our indemnity for breaching the AI rules, the acceptable-use rules or the law.
- **Excluded for both sides:** indirect and consequential losses, lost profits, revenue and goodwill, and loss of data, except in the uncapped cases.

Website-only users who pay nothing have their claims capped at USD 100. *The 12-month cap and the exclusion of indirect losses are standard, and a super-cap is a fair compromise. The uncapped indemnity runs only from us to them, and data breaches don't get their own higher cap while lost data is excluded. Both are better for them.*

**Changing it.** Changes need a written amendment signed by both sides. The only thing Mindsmiths can change on its own is the Credit Consumption Schedule, within the metering limit described above. *Better for us.*

**Ending it.** After the Term Commitment ends, either side can terminate for any reason on 30 days' written notice. Neither side can exit for convenience during the Term Commitment. Mindsmiths can terminate if we breach the licence terms or are 30 or more days late on fees, after notice and a 15-day cure period. If the breach can't be fixed, there's no cure period. These Terms give us no matching right to terminate if Mindsmiths breaches, and no refund on termination outside the IP-indemnity case. *Termination for convenience after the commitment is standard. The one-sided termination-for-breach right is better for them.*

**What continues after it ends.** Rights and payment obligations already accrued stay in place. These sections continue after termination: Customer Data, the platform-learning and data limits, intellectual property, confidentiality, indemnities, liability limits, the general terms, and any addendum provisions written to apply after termination. *Standard, and helpful to us because the data-use limits continue.*

**Assignment.** Neither side can transfer the Agreement without the other's consent, which can't be unreasonably withheld. Either side can transfer it without consent, on notice, to an affiliate or a successor in a merger, acquisition or sale of substantially all its assets, as long as the new party takes on every obligation. *Standard, and mutual.*

**Notices and execution.** Notices can be sent by email or by courier. An email counts as given on the day it's sent unless we get a bounce. Notices to Mindsmiths go to hello@mindsmiths.com. Electronic signatures are binding. *Standard, though we should send notices to a monitored legal address, not a general inbox.*

**Force majeure.** Neither side is liable for delays or failures caused by events beyond its reasonable control, such as natural disasters, utility failures, pandemics, government action, terrorism or war. Payment obligations are excluded from this. *Standard.*

**Governing law and disputes.** Delaware law applies, excluding the UN sales convention. Disputes go exclusively to state or federal courts in Delaware, and both sides waive objections to that venue. Either side can seek an injunction in any competent court to protect IP or confidential information. Both sides waive a jury trial. The winning side recovers its reasonable legal fees and costs. *Delaware courts and the jury waiver are vendor-friendly but common. Loser-pays is less usual. It cuts both ways, but it raises the stakes for whichever side has fewer resources. Customers in the EU sign a separate Platform License Agreement with Mindsmiths d.o.o., under Croatian law.*

**The three things our CEO should know before signing**

1. **Our liability exposure is larger than theirs.** Mindsmiths' liability is capped at 12 months of fees, or 3 times that for IP claims and confidentiality breaches. Lost data is excluded. Our liability has no cap if a claim arises from breaching the AI rules, the acceptable-use rules, or any law, including consent and opt-out rules for messaging. We also cover claims arising from anything we build on the platform. Our compliance on messaging consent and on AI decision-making in regulated areas needs to be solid.
2. **We're locked in for the Term Commitment.** These Terms give us no exit during the commitment and no right to terminate if Mindsmiths breaches, while Mindsmiths can terminate after 30 days of non-payment plus a 15-day cure period. The Term Commitment length, the Price per Credit and the renewal choice are all in the Order Form. Check those, along with the termination rights in the Platform License Agreement.
3. **The data protections are strong here, but most of the detail lives elsewhere.** End-user data can't be used for training or pooled across customers. Smith can be switched off. Our configurations are protected as confidential. However, where data is stored, how long it's kept, deletion, subprocessors, security and uptime are all handed off to the Data Processing Addendum, the Security Addendum and the Service Level Agreement. Those need review before signing.

**What the document leaves to the rest of the Agreement:** These Terms point to the other documents for:
- prices, invoicing, payment due dates, taxes, late-payment interest, renewal and the Term Commitment ([Pricing](/pricing) and the Order Form)
- uptime commitments, service credits, and refunds and termination when uptime falls short ([Service Level Agreement](/service-level-agreement))
- where data is stored, how long it's kept, returning it at the end, and the list of subprocessors ([Data Processing Addendum](/data-processing-addendum))
- breach notification, insurance and audit rights ([Security Addendum](/security-addendum))

Not covered in any of them: a process for disputing a charge, and our right to end the Agreement if Mindsmiths breaches it for reasons other than uptime. Both are worth raising before signing.

### Privacy Policy: summary

**Who it applies to.** Mindsmiths, Inc. (Delaware), for visitors to its website, prospects, and the people at its customers who use the platform. Customers based in the EU contract with its Croatian subsidiary, Mindsmiths d.o.o., and sign the Data Processing Addendum with it. For the people our company serves through the platform, Mindsmiths acts only on our instructions under a Data Processing Addendum, which governs that data instead of this policy; their requests go to us, not to Mindsmiths.

**Their role.** For website, prospect and customer-staff data, Mindsmiths decides how it's used (the "controller"). For our end users' data, it acts only on our instructions (the "processor"). *Standard.*

**What they collect about us.** From the website: IP address, browser and device, pages visited, referring page and time. From what we send them: name, work email, phone, company, role and our message. Conversations with the assistant on their website, which runs on their own platform and answers using large language models from outside AI model providers; those conversations are not used to train their models or the providers'. As a customer: names, work emails and roles of our builders and administrators, login credentials (passwords hashed), access logs, IP addresses and actions on the platform, our team's conversations with their assistant Smith, billing and contact details, and records of sales and support communication. *Standard; the no-training commitment for website conversations is better for us.*

**Why, and on what basis.** Website and prospect data: running and securing the site, answering requests and arranging calls and demos, understanding which pages are read, and marketing their products, on legitimate interest or steps we ask for before a contract; consent where the law requires it, such as non-essential cookies in the EU. Customer data: providing, securing and supporting the platform, authentication and audit trails, invoicing, service communication and legal obligations, on the contract, legal obligation and legitimate interest. Our team's conversations with Smith may inform anonymised, non-attributable improvements to the platform; our administrator can switch Smith off at any time. *Standard; the off switch is better for us.*

**Cookies, analytics and marketing.** Only the cookies in a separate Cookies Policy. No Google Analytics, no advertising cookies or pixels; usage is measured with their own analytics tool on their own platform, and no third-party analytics service gets the data. Marketing emails to business contacts, each with an unsubscribe link, and opting out by email at any time. Contact lists are not shared with third parties. *Better for us than most software vendors.*

**Messaging.** For SMS and messaging apps, whether the message comes from Mindsmiths or a company on its platform: only people who opted in on that channel, no bought lists; the sending company named at the start; stop by replying STOP or by email; carrier rates may apply. Mobile numbers and consent records are used only to deliver the service; they are not sold, and opt-in data isn't shared with third parties for their marketing. *Standard.*

**Who sees it.** Website hosting on Microsoft Azure (East US), email on Google Workspace, and the website assistant's AI model providers, listed in the Data Processing Addendum; no external support tools. Providers act on their instructions and are bound by contract. Platform subprocessors, including the cloud provider and AI model providers, are listed in the Data Processing Addendum, and customers are told before any change. Their group, in particular Mindsmiths d.o.o., which operates and supports the platform. Authorities, when the law requires; the affected customer is told first where the law allows, and they may challenge invalid requests. A buyer in a merger, acquisition or asset sale, with this policy still applying. No sale of personal data. *Standard; notice before subprocessor changes is better for us.*

**Where it's stored.** Platform data on Microsoft Azure in the US (East US). EU-based customers contract with Mindsmiths d.o.o., and their platform data is hosted in the EU. The engineering and support teams in Croatia access platform data for operations, maintenance and support. Transfers of EEA, UK or Swiss data to a country without an adequacy decision, including the US, rely on the EU standard contractual clauses and their UK and Swiss equivalents. *Standard; EU hosting for EU customers is better for EU buyers.*

**How long.** Website and prospect data: while we're in contact, deleted after 24 months without activity. Customer data: the term of the Platform License Agreement plus 30 days, except invoices and contract records, kept 10 years as the law requires. Consent and opt-out records: as long as the law requires. *Standard, and more specific than most.*

**Our rights.** Access, correction, deletion, restriction, objection, portability and withdrawal of consent, by writing to privacy@mindsmiths.com, after identity checks, answered within one month and free of charge unless the law allows otherwise. In the EEA, UK or Switzerland, a complaint to the data protection authority. For US residents: no sale and no sharing for cross-context behavioural advertising; disclosures to the listed service providers, including the AI model providers, are not sales or sharing; Californians and residents of other states with privacy laws can ask to know, delete and correct, and opt out of sale or sharing, without being treated differently. No Data Protection Officer: their Information Security Manager is the data-protection contact. Their EU representative is Mindsmiths d.o.o. in Zagreb. *Standard.*

**Security.** ISO/IEC 27001 certified; SOC 2 Type II attestation under way. Encryption in transit and at rest, access limited to those who need it. Customers are told of a personal data breach without undue delay and within 72 hours of Mindsmiths becoming aware of it; as controller, they notify the authority and, where the risk is high, the people affected. Platform security measures are in a separate Security Addendum. *Standard; a fixed 72-hour deadline to customers is better for us.*

**Changes.** They can update the policy; the version date shows the last change. Material changes are announced on the website and emailed to customers before they take effect. *Standard; notice in advance is better for us.*

**The three things our CEO should know before signing**

1. This policy covers our dealings with Mindsmiths, not our customers' data. That is governed by the Data Processing Addendum, which also lists the subprocessors and AI model providers. Read and sign it, with the right company: Mindsmiths d.o.o. if we're based in the EU.
2. Platform data is hosted in the US unless we contract through the EU subsidiary, and their team in Croatia accesses it either way, with standard contractual clauses covering transfers. If our data must stay in one region, make sure the contract says so.
3. AI is involved in two places: the website assistant sends conversations to outside AI model providers, which don't train on them, and our team's use of Smith may inform anonymised platform improvements. Our administrator can switch Smith off.

**What the document doesn't cover:** which AI model providers and subprocessors are used, and whether our customers' data is used to train AI models (both left to the Data Processing Addendum); how long our customers' data is kept; and the Cookies Policy, Data Processing Addendum and Security Addendum it relies on, which are separate documents.

### Full documents

All listed under **Legal documents** at the top.

## About

### Where we are

Mindsmiths, Inc. is a US company, incorporated in Delaware, with people in San Francisco and Miami. We work from home offices, so there's no street address to visit. Our engineering team works in Zagreb, Croatia, at our subsidiary, Mindsmiths d.o.o.

### Who leads what

- **Mislav Malenica,** founder and CEO. San Francisco.
- **Jordan Yates,** VP of Sales. Miami.
- **Tomica Pustišek,** COO: pricing, contracts and operations.
- **Juraj Malenica,** Head of Engineering. Zagreb.
- **Martina Silov,** new opportunities and media.

### How it started

In the spring of 2020, Croatia's healthcare hotlines were getting four times more calls than they could handle. Our founder, Mislav Malenica, had spent 20 years as an AI scientist, building medical diagnostic algorithms used on millions of people. So the team set out to build an AI assistant with the Croatian government to take some of the load.

The plan was a diagnostic AI, and it fell apart almost at once. There was no data to train on and no medical guidelines to follow yet. Even the country's best epidemiologists couldn't tell flu from COVID without a test. So the assistant, Andrija, couldn't diagnose anything. What it could do was show up every day: answer what it could, say plainly what it didn't know, and ask how you and your family were doing.

More than 50,000 people used it in the first 15 minutes. Within a week, the load on the call centers had dropped by more than 25%. When the team called people to ask why, they kept hearing the same thing: with Andrija, the situation felt serious but under control.

Soon after, companies in telecom, healthcare, fintech and higher education asked for the same thing for the people they serve.

## Join us

Our engineering team is in Zagreb, Croatia. What we build goes live with national telecom operators, fintechs and an airport, in Europe and the US, usually soon after it ships.

The hard part isn't getting a model to write a good message. It's deciding, for one person on one day, whether to send anything at all, and checking later whether that was the right call.

You own a problem and ship it, end to end. If you'd like a detailed plan handed to you each week, it won't suit you. If you'd like to see your work in front of real customers within weeks, it will. Kebab Monday, Squid Friday and karaoke.

### Open positions

- **Software Engineer.** Junior or experienced. Design, build, test and ship with a lot of freedom. We use Python, Java and Vue.js most. Write to [juraj@mindsmiths.com](mailto:juraj@mindsmiths.com).
- **Product.** Work close to customers and shape what gets built: UX, product ownership and project management. Write to [juraj@mindsmiths.com](mailto:juraj@mindsmiths.com).

### Before you write

- Engineering and product roles are on site in Zagreb, at Zavrtnica 17.
- We hire students and full-time employees. Both work full time.
- We don't have machine learning or data science roles.
- There's no form, and you don't need a CV.


## Contact

**To see it running on one of your use cases:** write to Jordan Yates, VP of Sales, at [jordan@mindsmiths.com](mailto:jordan@mindsmiths.com), or ask our assistant on this page. The first call takes 30 minutes. Bring the use case you'd start with and the number you'd want it to move. [FILL, Jordan: booking link.]

- **Pricing, contracts and reselling.** Tomica, COO. [tomica@mindsmiths.com](mailto:tomica@mindsmiths.com)
- **New opportunities and media.** Martina Silov. [martina@mindsmiths.com](mailto:martina@mindsmiths.com)
- **Technical questions and security reviews.** Juraj Malenica, Head of Engineering. [juraj@mindsmiths.com](mailto:juraj@mindsmiths.com)
- **Your data.** See, correct or delete the data we hold about you. [privacy@mindsmiths.com](mailto:privacy@mindsmiths.com)
- **Security, incidents and service levels.** [security@mindsmiths.com](mailto:security@mindsmiths.com)

For anything else, write to the person who handles it, or to [hello@mindsmiths.com](mailto:hello@mindsmiths.com) and we'll pass it on.

## Company details

- **Mindsmiths, Inc.** A Delaware corporation. 1000 N West Street, Suite 1200, Wilmington, DE 19801, U.S.A.
- **Mindsmiths d.o.o.** Our subsidiary. It builds, runs and supports the platform, and customers in the EU sign with it. Zavrtnica 17, HR-10000 Zagreb, Croatia. Company reg. no. 081287362, Commercial Court Zagreb. Director: Mislav Malenica.
- **Legal notices.** [hello@mindsmiths.com](mailto:hello@mindsmiths.com)

© 2026 Mindsmiths, Inc.