Privacy Policy

Mind Code AI LTD is a company registered in England and Wales, number 17410117. We operate Mind Code, a coding agent available through our website, CLI, desktop app, integrations, and hosted services. This policy explains how we handle personal data when you use these services or contact us.

We decide how account, billing, support, and service-security data is processed and act as its controller. When an organisation provides content for us to process on its instructions, that organisation acts as controller and we act as processor. The relevant customer agreement governs that processing.

The data we receive depends on the features you use and the services you connect.

• Account details: your name, email address, profile information, organisation membership, and sign-in records. GitHub sign-in supplies profile and account identifiers. Passkeys provide a public key and credential identifier; we do not receive your device's private key or biometric unlock data.
• Work content: prompts, specifications, code, files, repository and pull request information, tool results, generated responses, and review findings. Content retrieved from a connected service can also contain personal data about other people.
• Connected services: access credentials, permissions, and content needed for the integrations you authorise. Cloud-hosted connections and connections managed on your device can store credentials in different places.
• Billing details: your plan, payment status, invoices, and billing contact information. Stripe handles card collection and payment processing; our application does not store full payment card details.
• Service activity: request times, IP addresses, browser and device details, model usage, token and cost records, job progress, security events, and error information.
• Communications: support messages, sales enquiries, feedback, and the material you include with them.

You choose which repositories, files, and integrations to make available. Only provide personal data that you are authorised to use. Avoid including credentials or sensitive personal information unless it is necessary for the task and permitted by your organisation.

Where UK or EU data protection law applies, we use the following grounds for processing:

• Providing the service: we use account details, work content, and connected-service data to carry out tasks, generate responses, run agents, index authorised content, and review changes. For individual customers, this is necessary to perform our contract. For organisation content, we follow the customer's instructions.
• Billing and administration: we manage subscriptions, invoices, service limits, and support as part of our contract. We also retain records needed to meet accounting and tax obligations.
• Security and reliability: our legitimate interests include protecting accounts, preventing misuse, investigating failures, and keeping the service reliable. We consider the impact on people when relying on these interests.
• Optional participation: we rely on consent for voluntary training contributions and optional marketing where consent is required. You can withdraw that consent.
• Legal requirements: we process information when required to comply with law, respond to a valid legal request, or establish, exercise, or defend a legal claim.

Some information is needed to provide the feature you request. Without account information we cannot create your account; without relevant code or context an agent may be unable to complete a task.

Generating a response can require sending your prompt and relevant context to the model provider selected for that task. That context may include code, retrieved documents, tool output, and earlier messages. Using a local client does not make a cloud-model request local.

Training participation is off by default. Contributing sessions to Mind Code model training requires an account opt-in. Organisation policies can prevent participation even when a member has opted in. Declining training participation does not itself prevent ordinary use of the service.

You can change your training choice in account data-sharing settings. Turning it off prevents new training-session contributions under that consent. Withdrawal does not make earlier lawful processing unlawful. Contact us about erasure of data already submitted; we assess the request and any applicable legal exceptions.

Training permission is separate from processing needed to answer your request, maintain your session, secure the service, or resolve an issue you report. Data handling by a provider also depends on the provider, deployment, and applicable agreement. Do not assume that every provider or configuration has identical retention terms.

We use filtering and access controls to reduce exposure of sensitive information. These measures are not a guarantee that every secret or personal identifier will be detected. Check content before sharing it.

We disclose data where needed to operate the service, carry out your instructions, or meet a legal obligation. Recipients can include:

• Infrastructure and communications providers, including Amazon Web Services for hosting and service email.
• AI providers used for your requests, including OpenAI, Anthropic, Google, and models accessed through AWS Bedrock. Other providers may receive data when selected or enabled for a task.
• Stripe for checkout, subscription management, fraud prevention, and payment records.
• Sentry for application error and performance diagnostics where configured. Browser diagnostics can include masked interaction replays and technical context.
• Services you connect, and people you choose to share work with. Posting a review to GitHub, for example, makes it available under that repository's access rules.
• Organisation administrators who manage memberships, permissions, shared work, billing, and activity available within their account.
• Professional advisers, public authorities, or a successor business where disclosure is necessary for legal proceedings, protection against abuse, or a business transaction.

We do not sell personal data. Connecting a third-party service does not make its privacy practices identical to ours. Review that service's policy and the permissions you grant.

Mind Code and its providers may process data outside your country, including in the United States. The location depends on the service, model provider, and deployment you use. Do not assume a UK account keeps every request in the UK.

When a transfer is subject to UK or EEA data protection restrictions, the applicable arrangement must provide a lawful transfer mechanism, such as an adequacy decision or appropriate contractual safeguards. Contact us for details of the safeguards that apply to your service or customer agreement.

Retention depends on why the data is held. Account and work records support the service and your history. Billing records may need to remain after account closure to satisfy accounting, tax, or dispute requirements. Security and diagnostic records are kept according to their purpose, the risks involved, and the applicable provider configuration.

We also consider customer agreements, deletion requests, backup recovery needs, and legal preservation requirements. Disconnecting an integration stops future access through that connection; it does not necessarily erase previously stored work, reviews already posted to another service, or records we must retain.

We use authentication, permissions, scoped integration access, and other technical and organisational measures to protect the service. Access should be limited to people and services that need it. No online system can guarantee complete security.

Diagnostic information helps us investigate failures and performance problems. Reports may include error messages, stack traces, client versions, and usage context. Client reporting controls vary by application. Browser diagnostics and server-side service logs are separate from training consent.

Depending on the law that applies, you may be able to:

• Ask for access to your personal data and a portable copy where applicable.
• Correct inaccurate information or request deletion.
• Object to processing based on legitimate interests or request a restriction.
• Withdraw consent for processing that relies on it, including voluntary training participation.
• Opt out of marketing messages using the unsubscribe option or by contacting us.
• Complain to a data protection authority. In the UK, this is the Information Commissioner's Office.

If we process the data for your organisation, we may refer your request to its administrator. Generated output can be inaccurate; contact us if it includes personal information that you believe is incorrect or should be removed.

When you connect a Google service, the permissions you grant determine what the integration can access. We use the resulting data to provide the connected feature and related user-requested tasks. We do not use Google API data to train general-purpose AI models.

Mind Code is intended for adults aged 18 or over. If you believe a child has provided personal data, contact us so we can investigate and take appropriate action.

We update this policy as our services or obligations change. The date at the top identifies the current revision. Where required, we provide additional notice of a material change. Continuing to browse is not consent to a new optional use of your data.