# Privacy Policy

Version: October 14, 2026

## 1. Who we are and what this policy covers

Mindsmiths, Inc., a Delaware corporation with an address at 1000 N West Street, Suite 1200, Wilmington, DE 19801, United States of America (“Mindsmiths”, “we”, “us”), operates the website www.mindsmiths.com (the “Website”) and the Mindsmiths Platform, a cloud-based platform as a service on which companies build and operate real-time user engagement experiences (the “Platform”). Customers based in the European Union contract with our wholly-owned subsidiary (Mindsmiths d.o.o., Zavrtnica 17, 10000 Zagreb, Croatia) and sign the corresponding Data Processing Addendum with it.

This policy explains how we handle personal data in two capacities. As a controller, we decide how the personal data of Website visitors, prospects and the personnel of our Customers is used (sections 2 and 3). As a processor, we handle the personal data of the people who use our Customers’ services only on our Customers’ instructions, under a Data Processing Addendum; such requests should be addressed to the Customer concerned. Capitalised terms not defined here have the meanings given in our Terms of Service (www.mindsmiths.com/terms-of-service).

## 2. Website visitors and prospects

**What we collect.** When you visit the Website, we collect the technical data your browser sends: IP address, browser and device type, pages visited, referring page and time of visit. When you write to us, request a call or a demo, or ask for information, we collect what you give us: name, work email address, phone number, company, role and the content of your message. If you talk to our assistant on the Website, we collect the content of that conversation. The assistant runs on our own Platform, so the conversation is processed by Mindsmiths and not by a third-party chat tool. To generate its answers, the assistant uses large language models from the AI model providers listed in section 5. Your conversation is not used to train their models or ours.

**Why, and on what basis.** We use this data to run and secure the Website, to answer you and arrange calls and demos, to understand which pages are read, and to keep in touch with you about our products. We rely on our legitimate interest in running our business and in marketing to business contacts, or on the steps you ask us to take before a contract. Where the law requires consent, for example for non-essential cookies in the European Union, we ask for it.

**Analytics and cookies.** The Website uses only the cookies described in our Cookies Policy (www.mindsmiths.com/cookies-policy). We do not use Google Analytics, and we do not use advertising cookies or pixels. We measure how the Website is used with our own analytics tool, which runs on our own Platform; no third-party analytics service receives your data.

**Marketing.** We may send business contacts information about our products and events. Every such email has an unsubscribe link, and you can opt out at any time by writing to privacy@mindsmiths.com. We do not share our contact lists with third parties.

## 3. Customers and their personnel

**What we collect.** When a Customer uses the Platform under a Platform License Agreement, we hold the names, work email addresses and roles of the Customer’s Builder Team and administrators, their login credentials (passwords are stored only in hashed form) and access logs, IP addresses and the actions they take on the Platform, their interactions with our AI assistant Smith, the Customer’s billing and contact details, and the records of our sales and support communications with the Customer.

**Why, and on what basis.** We use this data to provide, secure and support the Platform, to authenticate users and keep audit trails, to invoice, to communicate about the service and to meet our legal obligations. We rely on the performance of our contract with the Customer, on our legal obligations, and on our legitimate interest in the security and improvement of the Platform. Builder Team interactions with Smith may inform anonymised, non-attributable improvements to the Platform; the Customer’s administrator can switch Smith off at any time.

## 4. Messaging and consent

We build and run assistants for the companies we work with, including over SMS and messaging apps. The same rules apply whether a message comes from us or from a company on our platform.

**Opt in first.** We only message people who have agreed to be contacted on that channel. No bought lists.

**Clear sender.** Every conversation says which company it comes from, right at the start.

**Easy to stop.** To stop receiving messages at any time, reply STOP to the message or write to hello@mindsmiths.com and we’ll opt you out.

**Only what’s useful.** Service updates, account and billing information, onboarding, support, and educational content you’ve opted into. How often you hear from us depends on your account activity.

**No cost from us.** Message and data rates from your carrier may apply.

**Your number.** Mobile numbers and consent records are used only to deliver this service. We don’t sell personal information, and we don’t share opt-in data with third parties for their marketing.

## 5. Who we share data with

**Service providers.** The Website is hosted on Microsoft Azure (East US region), our email runs on Google Workspace, and the assistant on the Website is powered by the AI model providers listed in our Data Processing Addendum. We do not use external support tools. These providers act on our instructions and are bound by contract to protect the data.

**Platform subprocessors.** The subprocessors that process data on the Platform, including our cloud infrastructure provider and the AI model providers, are listed in our Data Processing Addendum (www.mindsmiths.com/data-processing-addendum). Customers are notified before any change.

**Affiliates.** We share data within the Mindsmiths group, in particular with Mindsmiths d.o.o., which operates and supports the Platform on our behalf.

**Legal requirements.** We disclose personal data where the law requires it, to respond to a lawful request from a public authority, or to protect our rights, our Customers or the public. Where the law allows, we tell the affected Customer first. We may challenge requests we consider invalid.

**Business transfers.** If Mindsmiths is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction and will remain subject to this policy.

We do not sell personal data.

## 6. Where data is stored and international transfers

Platform data is hosted on Microsoft Azure in the United States (East US region). Customers based in the European Union contract with Mindsmiths d.o.o., under whose Data Processing Addendum their Platform data is hosted in the European Union. Our engineering and support teams in Croatia access Platform data for operations, maintenance and support under appropriate safeguards.

Where personal data of people in the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, including the United States, we rely on the European Commission’s standard contractual clauses and their UK and Swiss equivalents.

## 7. How long we keep data

**Website visitors and prospects.** For as long as we are in contact with you, and we delete the data after twenty-four (24) months without activity.

**Customers and their personnel.** For the term of the Customer’s Platform License Agreement and thirty (30) days after it ends, except invoices and contract records, which we keep for ten (10) years as the law requires.

**Consents and opt-outs.** Records of messaging consents and opt-outs are kept for as long as the law requires.

## 8. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format and to withdraw your consent. Write to privacy@mindsmiths.com. We may ask you to verify your identity, and we answer within one month and free of charge, unless the law allows otherwise. If you are in the European Economic Area, the United Kingdom or Switzerland, you may also complain to your data protection authority.

**US residents.** We do not sell personal data and do not share it for cross-context behavioural advertising. Disclosures to the service providers listed in section 5, including the AI model providers that power the assistant on the Website, are not sales or sharing, because those providers may use your data only to provide their service to us. If you live in California or another state with a privacy law, you may have the right to know what personal data we collect, to have it deleted or corrected, and to opt out of its sale or sharing, and we will not treat you differently for exercising these rights. Send requests to privacy@mindsmiths.com.

**Data-protection contact and EU representative.** We have not appointed a Data Protection Officer; our Information Security Manager is our data-protection contact at privacy@mindsmiths.com. Our representative in the European Union for data-protection matters is Mindsmiths d.o.o., Zavrtnica 17, 10000 Zagreb, Croatia, reachable at privacy@mindsmiths.com.

## 9. Security, changes and contact

**Security.** We hold ISO/IEC 27001 certification and are undergoing SOC 2 Type II attestation. Personal data is encrypted in transit and at rest, access is limited to the people who need it, and we notify affected Customers of a personal data breach without undue delay and in any event within seventy-two (72) hours of becoming aware of it. Where we are the controller, we notify the competent authority and, where the risk is high, the affected individuals, as the law requires. Our security measures for the Platform are described in the Security Addendum (www.mindsmiths.com/security-addendum).

**Changes.** We may update this policy. The version date at the top shows when it was last changed. We announce material changes on the Website and, to Customers, by email before they take effect.

**Contact.** Mindsmiths, Inc., 1000 N West Street, Suite 1200, Wilmington, DE 19801, U.S.A. Privacy questions and requests: privacy@mindsmiths.com. Anything else: hello@mindsmiths.com.

© 2026 Mindsmiths, Inc.