Privacy Policy

MindPolar is two different things to two different kinds of personal data, and the distinction below governs the rest of this policy. This is not a stylistic choice — data-protection laws impose materially different duties on a controller than on a processor.

Your own MindPolar account — your name, login email, profile photo, sessions, authentication records, and your own security-activity history — is data MindPolar controls: you are the data subject, and MindPolar decides why and how it is processed.

If you are added to MindPolar as an employee, contractor, or other person inside a customer organization's directory — your work email, employee number, department, job position, employment dates, or reporting line — the organization that added you is the controller of that data, and MindPolar processes it only on that organization's documented instructions, under a Data Processing Agreement. If you have a question about that data, your employer's own privacy notice governs it, and MindPolar will direct your request back to them.

This data is entered by a customer organization's own administrators. MindPolar does not collect it directly from the individual it describes, and does not decide what is collected, for how long, or for what purpose. If you are an employee whose data appears here and you are not a MindPolar account holder yourself, direct your data-protection questions to your employer.

MindPolar sends transactional email (verification, password reset, invitations and billing notices). It does not send marketing email or newsletters.

MindPolar uses service providers to operate the service. They process personal data on MindPolar's instructions. They are described below by category.

No analytics, advertising, error-tracking, or session-replay third party is integrated into the product.

A customer organization can ask for the current named list of sub-processors at any time by writing to hello@mindpolarai.com; we send it without undue delay and tell organizations in advance of any change.

Stripe and Razorpay are payment providers, not sub-processors. Each is an independent controller of the payment data a payer gives it and handles that data under its own terms and privacy policy.

MindPolar does not sell personal data and does not share it with data brokers. Personal data may be disclosed where required by law, a valid court order, or a lawful request from a competent authority — MindPolar will notify the affected person first, unless legally prohibited from doing so.

The content-delivery network in front of the web and API applications may route a request in transit through an edge location outside India as part of ordinary internet routing. Data is not stored there, and edge caching is not used for personal data responses.

Some providers listed above process data outside the country you are in. This policy does not itself provide a transfer mechanism; where the law that applies to you requires one for data your organization sends us, it is agreed in writing with that organization.

This applies only when a member uses Polaris. If no one in your organization asks Polaris anything, none of your organization's data is sent to an AI model service.

Polaris uses an AI model service hosted by Amazon Web Services (AWS); the models are provided by Amazon and OpenAI. MindPolar sends data to this third-party service only when a member uses Polaris, and it is covered by agreements with those third parties. MindPolar cannot control how the model itself works internally.

When a member asks Polaris something, MindPolar sends the AI model service the member's message; the member's name, role, job position, department, team and location; basic details of the workspace, such as its name, type, size, country and plan; the name of the conversation the member is in and, in a conversation between two people, the other person's display name; and the workspace records Polaris reads in order to answer. Polaris reads only what that member is already allowed to see, one request at a time, and cannot create, change or delete anything. Earlier messages are not sent unless Polaris looks them up to answer.

AWS may process a Polaris request in any region where it offers the model service, which can include countries outside India, and the request travels encrypted. MindPolar stores Polaris's replies with the rest of the workspace's data, in India.

Under AWS's terms, content may be kept only as those terms allow, to detect abuse. Polaris's replies, and the reasoning shown beside them to the member who asked, are stored like other messages and are deleted with the workspace. MindPolar also keeps daily counts of Polaris messages for plan limits and usage totals; these hold no message content.

MindPolar does not use your content to train AI models, and does not provide it to anyone for that purpose.

Polaris's answers are generated automatically and can be wrong or out of date. Check anything important against the record itself. Polaris makes no decision about any person and has no legal or similarly significant effect on anyone.

A reply Polaris posts in a shared conversation, such as a department, a team or a conversation between two people, is visible to everyone who can read that conversation, not only to the member who asked.

The workspace feed deletes messages automatically on a rolling monthly schedule once they pass the retention floor described above. A former employee's non-identifying directory record persists indefinitely as a terminal record for the organization's own audit history, with no automatic expiry.

Erasing your account scrubs your identifiers from your employee-directory record, as described above. It does not remove your name from feed messages you previously caused: each feed message stores a frozen snapshot of the name and email of the person who caused it, captured when the message was written, and that snapshot is not updated or removed when the account is later erased. Your name and email can therefore remain retrievable from any feed message you caused until that message's own retention period ends — up to about 120 days, per the retention floor described above.

Deleting a workspace is the customer's decision. An Owner can schedule the workspace for deletion, and an Owner can cancel it until the deletion date. The deletion date is 90 days after the deletion is scheduled, or the end of the period already paid for if that is later. A workspace whose plan is not renewed moves to the free plan and is not deleted. Members are told when a deletion is scheduled and when it is cancelled, and from the deletion date the workspace can no longer be opened.

On the deletion date, all of the workspace's data is permanently deleted. Deleted data cannot be restored or exported.

Deleted data may remain in encrypted backups for up to 7 days, until they expire. Backups are used only to recover the service after an incident and are never used to restore a deleted workspace.

MindPolar keeps the billing records of a deleted workspace, such as invoices and payments, for up to 10 years, as tax and accounting law requires.

Deleting a workspace does not delete the personal accounts of its members; they keep access to their other workspaces.

Depending on where you are, you may have the right to:

• Access the personal data MindPolar holds about you, and information about how it is processed.
• Correct inaccurate data. For identity data this is self-service: name, email, and password are all correctable in-product.
• Erase your data — see the 14-day grace-window process above.
• Restrict how your data is processed.
• Receive your data in a portable form.
• Object to processing, including processing based on legitimate interest.
• Withdraw consent at any time, without affecting processing already carried out.
• Have a grievance addressed, and complain to your country's data protection authority if it is not resolved.
• Nominate another person to exercise these rights for you if you die or become incapacitated.

Most of these are self-service inside your account settings. For anything not self-service — an access request, a portability request, an objection, a complaint — contact hello@mindpolarai.com.

If you are a customer organization, your relationship with MindPolar for employee-directory data is additionally governed by a Data Processing Agreement, which sets out MindPolar's obligations as processor, and the sub-processor list.

• Data is encrypted in transit, on every connection to the web application and API.
• Data is encrypted at rest, in the database and in file storage.
• Tenant isolation — row-level security enforced in the database itself, on every organization-scoped table, so an application bug cannot leak one organization's data into another's query.
• Least-privilege access roles per function; no long-lived cloud access keys used by the application at runtime.
• Passwords are hashed, never stored or logged in plain text.
• Pseudonymisation of IP addresses used for rate-limiting.

No system is unbreakable, and this section is not a guarantee.

Where a breach of personal data creates a risk to individuals, MindPolar will notify affected customer organizations, and — where MindPolar is the controller — affected individuals, without undue delay, as applicable law requires.

Polaris generates answers automatically (see section 5.1); it makes no decision about any person. MindPolar does not perform automated decision-making that produces legal or similarly significant effects on an individual. The product's organizational maturity diagnostic produces a score about the organization as a whole, from answers the organization's own people submit — it does not profile or score an individual, and no output is used to make an automated decision about any specific person.

MindPolar is a B2B product not directed at children, and does not knowingly collect data from anyone under the age of legal majority in their jurisdiction.

MindPolar will update this policy as the product, its sub-processors, or its data-residency footprint change, posting the new version and effective date at the top of this page and in the changelog below.

By using MindPolar you accept the version of these documents in force at that time; the current version and its effective date are shown at the top of each page.

Privacy questions, requests and complaints: hello@mindpolarai.com.