Privacy Notice (Aviso de Privacidad)

2.1 Identification and Account Data

When you create an account, we collect your full name and email address. Authentication is handled by Firebase Authentication, a Google service: if you sign up with email and password, your password is stored and secured by Firebase — we never receive or store it on our own servers. We store your name, email, the unique Firebase identifier of your account, and the sign-in method used.

If you choose to register with your Google account, we receive your name and email address from Google through Firebase. We do not receive your Google password and do not access any other Google service or data. Email verification is required before using the Service.

2.2 User Content

The core of Mindle is the content you create: text notes, voice notes, meetings you record or paste transcripts of, and images attached to your notes or meetings. Each piece of content is stored with metadata such as creation date, modification date, word count, language, and audio duration where applicable.

Audio is not stored. When you record a voice note or meeting, the audio is sent to a transcription service, converted to text, and then discarded — we keep only the transcript and its duration. Meeting transcripts include generic speaker labels ("Speaker 1", "Speaker 2"); we do not create or store voiceprints or any biometric identifier. Important: when recording a meeting, Mindle may capture your microphone and, in supported browsers, your computer's system audio, so other participants' voices may be recorded and transcribed. You are responsible for informing all participants and obtaining any legally required consent before recording.

Uploaded images are re-encoded (location and camera metadata is removed) and stored on our servers. Each image is analyzed by an AI vision model to generate a description and extract visible text (OCR) so it can be found in search. You retain full ownership of all content you create in Mindle.

legal.aviso.data_collected.content.p4

2.3 AI-Derived Data

When your content is processed by our AI systems, derived data is created and stored: rewritten and structured versions of your text, extracted concepts, detected tasks, content classifications, AI-generated meeting notes, and on-demand artifacts (summaries, bullet points, translations, mind maps).

We also generate vector embeddings — mathematical representations of the meaning of your content — that power semantic search, the "ask" feature, and concept connections. A copy of your content is indexed in our search system, and we store a personal vocabulary of corrections you teach the Service to improve your transcriptions.

2.4 Technical and Usage Data

To operate the Service we use a small number of functional cookies and browser storage (Section 12), and we store your preferences (language, auto-processing, onboarding progress) on our servers. Your Firebase session is kept in your browser by the Firebase SDK.

We meter your usage (counts of notes, meetings, transcription seconds, AI actions, images) to enforce plan limits and billing. Our error-monitoring service (Sentry) receives technical data when failures occur — IP address, browser information, and internal user ID — configured to exclude your content and email. Cloudflare processes your IP address to route and protect traffic.

2.5 Billing Data

If you purchase a subscription, payment is processed by Stripe. Card details are collected and stored directly by Stripe and never reach our servers. We store your Stripe customer and subscription identifiers, plan, subscription status, and billing period dates, and we share your name and email with Stripe to create your customer record.

2.6 Newsletter Information

We collect your email address and, optionally, your full name in two ways: when you subscribe to the newsletter from our site, and when you create a Mindle account. In the second case you are subscribed to product updates by default, and you can unsubscribe from the link in any of those emails without affecting your account or your access to the Service. Both paths are synced to a private Notion workspace, which we use as a mini-CRM for manual follow-up. If you have an account, that workspace also receives aggregate indicators of your use of the Service: how many notes you have created, how many of them arrived through WhatsApp, the date of your last activity and of your last search, and whether you have WhatsApp linked. It never receives the content of your notes, the text of your searches, or your messages.

2.7 Sensitive Personal Data

We do not request or intentionally collect sensitive personal data (racial or ethnic origin, health status, genetic information, religious, philosophical, or moral beliefs, union membership, political opinions, or sexual preference), and we do not process biometric data: meeting transcripts label speakers generically and no voiceprint is generated or stored.

However, as a free-form note-taking tool, any information you voluntarily write, record, or photograph — including, potentially, sensitive data about yourself or third parties — becomes part of your stored content and is processed under this Notice solely to provide you the Service.

We do not collect geolocation data, advertising identifiers, or browsing history from other websites, and we do not use advertising tools. Our only measurement is aggregate page analytics on our public website, which stays off unless you accept it.

3.1 Primary Purposes (necessary for the service relationship)

The following purposes are necessary to provide the Service you request when creating an account:

• Create, manage, and maintain your user account, and authenticate your identity through Firebase
• Store, organize, and display the content you create (notes, transcripts, meetings, images)
• Process your content with artificial intelligence (rewriting, concept extraction, task detection, classification, image description, embeddings, semantic search, and answers) — this is the essential functionality of the Service
• Transcribe your voice notes and meetings through speech-to-text services, discarding the audio afterwards
• Process subscription payments through Stripe and meter usage to enforce your plan limits
• Send you transactional emails (email verification, password reset) and respond to support requests
• Protect the Service against fraud, misuse, and security threats, and comply with applicable legal obligations

3.2 Secondary Purposes (require your consent)

The following purposes are not necessary for the service relationship and require your consent. You may refuse or revoke consent for them at any time through the means indicated in Section 9, without affecting your access to the Service:

• Sending you promotional communications, product news, and feature updates by email

Refusing these secondary purposes will never be grounds for denying you the Service. If you create an account, we treat your consent to these communications as given where this notice has been made available to you and you do not object. Every email carries a one-click unsubscribe link, which is a sufficient means of objecting at any time.

4.1 How AI Processing Works

When you create content, it is sent through a multi-step AI pipeline: your text (or transcribed audio) is processed by OpenAI language models, which rewrite and structure it, identify key concepts, detect tasks, and classify your note. For meetings, an AI model generates structured meeting notes from the transcript. Images are analyzed by an OpenAI vision model to generate a description and extract visible text.

Separately, your content is converted into vector embeddings using OpenAI embedding models, stored in our database and search index, and used to find semantically similar notes, build concept connections, and answer questions about your own knowledge base.

Voice notes are transcribed with OpenAI Whisper. Meeting audio is transcribed by Modulate AI with generic speaker separation. In both cases the audio is processed for transcription only and is not retained by us.

4.2 Implications of Automated Processing

Mindle's automated processing organizes your content; it does not make decisions that produce legal effects on you or significantly affect your rights. Concept extraction, task detection, and classification are navigation tools — they do not restrict features, set prices, or evaluate you as a person.

You can always edit, override, or delete any AI-generated content. Concepts can be renamed, merged, or removed; tasks can be modified or dismissed. You remain in full control of how your knowledge is organized.

4.3 Your Data at Our AI Providers

We use OpenAI's API tier, not consumer products like ChatGPT. Under OpenAI's API data usage policy, content submitted through the API is not used to train or improve its models unless the customer opts in — and we have not opted in. OpenAI may retain API inputs and outputs for up to 30 days for abuse monitoring, after which they are deleted. OpenAI processes data as our processor under a Data Processing Addendum.

Meeting audio is processed by Modulate AI solely to produce the transcript returned to you. Our AI providers are contractually restricted from using your data for their own purposes.

4.4 Right to Object to Automated Processing

Under the LFPDPPP you have the right to object to fully automated processing of your personal data that produces unwanted legal effects or significantly affects you. Mindle does not carry out processing of that nature; nevertheless, you may exercise your right of opposition to AI processing of your content following the procedure in Section 9. Because AI processing is the essential functionality of the Service, exercising this right may significantly limit the usefulness of the Service.

5.1 Service Providers (Processors)

The following providers process your data on our behalf:

5.2 Transfers to Third Parties

We do not currently transfer your personal data to any third party that would process it for its own purposes. If a transfer requiring your consent ever becomes necessary, we will update this Notice and request your consent through the Service before carrying it out, except in the cases where the LFPDPPP permits transfers without consent (for example, legal requirements or protection of your vital interests).

5.3 No Data Selling

We do not sell, trade, or assign your personal data to third parties for their own purposes. We do not participate in data broker networks and do not display third-party advertising in the Service.

7.1 Account Deletion

You may request deletion of your account at any time by writing to a@mindle.mx from the email address associated with your account. Upon verifying your request, we will permanently delete your account and all associated data within 30 calendar days, including notes, transcripts, meetings, images, AI-derived data, concepts, tasks, embeddings, and search index entries.

Some data may be retained beyond this period only where required by applicable law (for example, billing records for tax purposes), in which case it will be blocked, isolated, and deleted once the legal requirement expires.

7.2 Backups

Our database and image storage are backed up nightly for disaster recovery. Backups may contain your data and are kept for 7 days before being overwritten, so deleted data leaves backups within at most 7 days after being purged from our primary systems.

8.1 Right of Access

You have the right to know what personal data we hold about you, how we use it, the conditions of use, and the remissions to processors we make. You may request a copy of your personal data in a readable and commonly used format.

8.2 Right of Rectification

You have the right to request correction of your personal data when it is inaccurate, incomplete, or outdated. You can edit your content directly in the Service, or contact us to correct account data.

8.3 Right of Cancellation

You have the right to request the deletion of your personal data from our records and databases when you consider that it is not being processed in accordance with the principles and duties of the LFPDPPP, when it is no longer necessary for the purposes for which it was collected, or when the retention period has expired. Cancellation proceeds after a blocking period during which data is retained solely for liability purposes arising from the processing.

8.4 Right of Opposition

You have the right to oppose the processing of your personal data for specific purposes, including AI processing of your content and any fully automated processing that could significantly affect you. If you oppose AI processing, your content will be stored but not processed by our AI systems, which will substantially limit the functionality available to you.

8.5 Revocation of Consent

You may revoke the consent you have given for the processing of your personal data at any time, without retroactive effects. To revoke your consent, follow the procedure in Section 9.

8.6 Limitation of Use or Disclosure

You have the right to request limitation of the use or disclosure of your personal data. You may ask us to stop sending you promotional communications at any time. For other limitations, contact us through the procedure in Section 9.

Response Timelines

We will communicate our determination within a maximum of 20 business days following receipt of your request. This period may be extended once for an equal period when justified, with prior notice to you.

If the request is granted, it will be made effective within 15 business days following the date on which we communicate the response, extendable once for an equal period when the circumstances justify it. Exercising ARCO rights is free of charge; only justified shipping or reproduction costs may apply.

Identity Verification

To protect your privacy and security, we will verify your identity before processing any request, by confirming the information associated with your Mindle account (registered email address). If we cannot verify your identity, we reserve the right not to process the request, notifying you of the reasons.

Technical Measures

• All data transmitted between your device and our servers is encrypted using HTTPS/TLS, with Cloudflare providing an additional protection layer against attacks
• Login credentials are managed by Firebase Authentication (Google); we never store passwords on our servers
• Every API request is authenticated by verifying your identity token; unauthenticated requests are rejected
• All data is isolated per account — your content is only ever returned to your authenticated session
• Database access is restricted to our application servers, with no direct public access
• Location and camera metadata (EXIF) is stripped from every image you upload before storage

Organizational Measures

• Access to production systems and user data is limited to the two founders
• We conduct regular security reviews of our codebase and infrastructure
• Service providers are vetted for their security practices before engagement

What We Use

• mindle_session (cookie): a simple flag indicating an active session, used to route you correctly between the marketing site and the app; contains no personal data
• NEXT_LOCALE (cookie): remembers your language preference (Spanish or English)
• mindle_create_mode (cookie): remembers whether you last used recording or writing mode
• Browser storage (localStorage/IndexedDB): the Firebase SDK keeps your login session in your browser, and we store interface preferences (auto-processing, onboarding and tutorial progress, graph layout) locally on your device
• mindle_consent (cookie): records whether you accepted or declined measurement cookies, so we do not ask again. Expires after six months
• _ga, _ga_8JGWEN3977 and _ga_JSL1JX2BSH (Google Analytics cookies): set only if you accept measurement, on our public website. They hold a randomly generated identifier used to count returning visits, expire after two years, and are never set inside the logged-in app

What We Do NOT Use

We do not use advertising cookies, tracking pixels, web beacons, or fingerprinting. We do not run advertising, we do not track you across other websites, and we do not embed social media tracking widgets. For measurement we use Google Analytics 4 on our public website only, loaded with Google Consent Mode v2 set to denied by default: until you accept, it stores nothing on your device and receives no identifier. Advertising signals stay denied permanently. Our other monitoring tool is Sentry, which reports application errors, not your browsing behavior, as described in Section 5.

You can change your mind at any time through the Cookies link in the footer of our website, which reopens the choice. You can also delete or block these cookies from your browser settings; blocking the functional cookies may prevent the Service from working correctly. Google Analytics never runs inside the logged-in app.

Competent Authority

If you consider that your right to personal data protection has been violated, or you are not satisfied with our response, you may file a complaint with the Secretaría Anticorrupción y Buen Gobierno, the authority competent in matters of personal data protection held by private parties in Mexico under the 2025 LFPDPPP (successor to INAI in this function).

For more information about your rights, visit the website of the Secretaría Anticorrupción y Buen Gobierno.