MindStudio

GDPR overview

GDPR compliance is claimed on the homepage (SOC II & GDPR compliant) and on the Remy page (SOC 2 Type I & II, GDPR). The privacy policy, effective 7 November 2025, carries a dedicated section for the EU, the UK and Switzerland covering access, rectification, erasure, withdrawal of consent, portability, objection, restriction and the right to lodge a complaint with a supervisory authority. Rights are exercised by email to support@mindstudio.ai or through a form in account settings. A public DPA incorporates the EU Standard Contractual Clauses (modules 2 and 3) and the UK addendum, the list of approved sub-processors is published on the trust center, and technical measures include encryption at rest and in transit. Two gaps stand out: no Article 27 representative in the EU is named, and no data protection officer is appointed.

Who owns the data?

The privacy policy is explicit that MindStudio is the controller of the personal data it processes in connection with the Services. The roles reverse when MindStudio handles data belonging to a customer's own end users: the customer is then the controller and MindStudio acts as processor, or as a sub-processor where the customer is itself processing on behalf of a third-party controller, as set out in the published DPA. Content submitted to the platform remains the responsibility of whoever it came from, per the Terms of Use. The DPA commits MindStudio not to sell or share personal data, and not to retain or use it outside the direct business relationship.

Reuse rights

MindStudio collects profile and contact details, payment information, device and IP data, web analytics, referral data, approximate location derived from IP, photos, videos and recordings, plus anything a user volunteers. It uses them to deliver and improve the service, run accounts, bill, support, personalize, prevent fraud, market and correspond, relying on contractual necessity, legitimate interest, consent and legal obligations. Data reaches hosting providers, third-party AI providers, security and fraud vendors, support tools, Stripe for payments, advertising partners, analytics providers, HubSpot for email marketing and Google Analytics. On training the position is unambiguous: neither personal information nor inputs are used to train MindStudio's models, and the third-party AI services it calls do not train on that data either. Google Workspace APIs fall under the Limited Use commitment, so they never feed generalized model development, and the self-hosted DeepSeek instances run inside MindStudio's own infrastructure with no transfer to outside parties. MindStudio also states that it does not sell data within the meaning of Nevada Revised Statutes 603A, and that it does not honor Do Not Track signals.

Data retention & training

Hosting summary

The privacy policy states that MindStudio is hosted on servers in the United States and that data is transferred to and processed in the United States and possibly other countries. No European hosting region is offered on the standard plans, and generated content is delivered through a global CDN. Business customers can self-host MindStudio on their own infrastructure, on-premise or in a private cloud, which is the only published way to move processing out of the vendor's US environment. Transfers from the EU, the UK and Switzerland are framed by a public data processing agreement incorporating the EU Standard Contractual Clauses and the UK addendum, with encryption at rest and in transit listed among the technical measures. As a network observation rather than a vendor claim, the domain resolves to 216.150.1.1, an anycast address announced by Amazon (AS16509) in the United States.