MindPal

GDPR overview

MindPal never states, in so many words, that it is GDPR-compliant. 'GDPR' appears once in the terms (section 10), only to point enterprise customers towards a data processing agreement, which is available. The privacy policy, effective 25 October 2025, nevertheless sets out several GDPR-shaped elements: legal bases for processing – contract performance, legitimate interests, consent and legal obligation (4.4); Standard Contractual Clauses for transfers from the EEA, the United Kingdom and Switzerland (9); and rights of access, rectification, erasure, portability, objection and withdrawal of consent (10), answered within 30 to 45 days. Global Privacy Control signals are honoured where the law requires it (12), and the service is not intended for under-16s (13). No Article 27 EU representative and no data protection officer are named; every request goes to support@mindpal.io.

Who owns the data?

Under the terms of service you keep all ownership rights to the Customer Content you upload (section 6.1), and you own the Outputs generated for you (section 9.2), although MindPal gives no guarantee that comparable outputs will not be produced for other users. You grant MindPal a limited, worldwide, non-exclusive, royalty-free licence solely to operate the service; it ends when you delete the content or close your account, subject to backup cycles (6.2). Section 6.3 rules out selling your content, using it for advertising or claiming your ideas and intellectual property. Feedback is the one exception: MindPal keeps a perpetual, unrestricted licence over it (6.4).

Reuse rights

Because you own both your inputs and the outputs generated for you, no further permission from MindPal is needed to reuse them; the terms only warn that similar outputs may be produced for other users, so uniqueness is not guaranteed. On its side, MindPal states that customer content is used to run the service, execute agents, detect fraud, test quality and improve the product (privacy policy 4.1), and that prompts, files, outputs and third-party integration data are not used to train foundation AI models by default (section 5); a future anonymised data-contribution programme would require separate, explicit consent that can be withdrawn. Content may be aggregated and anonymised for analytics, research and product improvement (terms 6.2). Data is shared with named providers – AWS for hosting, OpenAI, Anthropic and Google for models, Lemon Squeezy for payments (privacy 7.1) – with no sale of personal data and no cross-site behavioural advertising. Connected integrations such as Google Workspace, Slack or GitHub only reach the scopes you authorise, and that access can be revoked.

Data retention & training

Hosting summary

MindPal states that all user data is stored in AWS S3 and MongoDB databases hosted exclusively in data centres in the United States. No EU or other regional hosting option is offered, and transfers from the EEA, the United Kingdom and Switzerland are covered by Standard Contractual Clauses. The published security practices describe TLS 1.3+ in transit and AES-256 at rest through S3 default encryption, least-privilege AWS IAM access controls with multi-factor authentication and key rotation, VPC isolation with security groups and network ACLs, CloudTrail and CloudWatch logging, bcrypt password hashing, secrets held in AWS Secrets Manager, tenant-level data isolation, environment segregation, access limited to authorised technical staff with detailed access logs, and regular security audits and vulnerability assessments. No external certification of MindPal itself is published, neither SOC 2 nor ISO 27001, and the certifications referenced on the data security page are those of the cloud providers. A data processing agreement is available for enterprise customers. Note that the privacy policy still carries an unfilled placeholder, 'primarily in [US regions]', where the hosting regions should be named.