InterMIND

GDPR overview

GDPR compliance is claimed explicitly and documented in unusual detail. The privacy policy and terms in force since 17 June 2026 name an Article 27 EU representative, MindMeeting OÜ, Juhkentali 8, Tallinn 10132, Estonia, reachable at privacy@intermind.com. Access, rectification, erasure, portability, objection, restriction and withdrawal of consent are all offered, erasure and portability in self-service, with a right to complain to the local supervisory authority. An Article 28 DPA is signed per customer, with 30 days' notice on sub-processor changes and 72-hour breach notification; the 18 sub-processors are listed by name, location and safeguard. Transfers outside the EEA rely on standard contractual clauses and/or the EU-US Data Privacy Framework — the UAE, where the operating company sits, has no adequacy decision. Minimum age is 16. Certifications stop at a CSA STAR Level 1 self-assessment and Cyber Essentials: no ISO 27001, no SOC 2.

Who owns the data?

Under the terms in force since 17 June 2026, you keep every right in the content you create or upload — meetings, recordings, transcripts, chat messages and documents — and the publisher claims no ownership. You grant only the licence needed to run the service: hosting, storing, transmitting, transcribing, translating, summarising and displaying that content, and it ends when the content is deleted. Golden Fish LLC is the data controller, unless an organisation uses the service under its own contract, in which case that organisation is controller and InterMIND its processor. Deleting an account permanently erases database records and stored files and cancels the subscription; a full ZIP account export is available from the settings for seven days.

Reuse rights

Because you keep all rights in your content, you may reuse recordings, transcripts, translations and summaries without asking permission: they can be downloaded, exported as a full ZIP archive from the settings and used for any purpose you are otherwise entitled to. On the publisher's side, the privacy policy and terms in force since 17 June 2026 state that personal data is never sold and that meeting content is never used to train AI models. Meeting audio and video are not stored at all: they transit the media infrastructure in France for transmission, speech recognition and translation, for the duration of the call only. What is kept is what you deliberately produce — transcripts, recordings you start, chat and documents. The post-meeting summary sends the transcript once to Mistral AI in France under a zero-retention agreement, neither stored nor used for training; document translation goes to DeepL in Cologne with no retention for training; voice-note transcription at Mistral is deleted after 30 days; the voice sample used to render the speaker's voice is ephemeral, existing only during the meeting and never stored. PostHog analytics and session replay are off by default and consent-gated through Usercentrics. The privacy policy sets out a legal basis field by field — contract, legitimate interest, consent or legal obligation.

Data retention & training

Hosting summary

Everything runs inside the European Union. The web application and API are on Vercel in Frankfurt (fra1); the real-time server carrying chat, presence and transcript words in transit is on Fly.io in Paris (CDG); meeting media, speech recognition and translation run on the publisher's own engine (Mind API, intra-group) at OVH in France. The database is Neon Postgres in Frankfurt (AWS eu-central-1); object storage for recordings, attachments and documents is Tigris, EU multi-region across Frankfurt and Amsterdam; transactional e-mail is Resend in Ireland (eu-west-1); analytics is PostHog EU Cloud and error monitoring Sentry in Germany; the OIDC session cache is Upstash in Frankfurt. AI summaries go to Mistral in the EU under zero retention, document translation to DeepL in Cologne. Several of these providers are US companies operating EU regions, covered by standard contractual clauses and/or the Data Privacy Framework. Meeting audio is never stored, and translated audio is streamed, never written to disk.