GoldMine AI

GDPR overview

GoldMine AI never writes that it is GDPR compliant, but its privacy policy carries concrete provisions. Section 10, "Your Rights (GDPR/CCPA)", with a sub-section on GDPR rights for European users, lists access, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interest, and human review of automated decisions. Californian residents get separate CCPA rights, including the right to know, to delete and to opt out of sale, with the statement that personal information is not sold. Section 11 accepts transfers outside your country, including the United States, and cites Standard Contractual Clauses approved by the European Commission, adequacy decisions and processing agreements with providers. Rights are exercised by email. Missing: no Article 27 EU representative, no named DPO, no certification such as SOC 2 or ISO 27001. Policy dated 15 July 2025.

Who owns the data?

Section 7.1 of the terms leaves ownership of what you submit with you: startup ideas, business descriptions and any other content. Section 5.2 adds that you own the AI-generated content created from your inputs, and section 5.3 authorises commercial use of it, naming landing pages, reports and prospecting. In exchange you grant GoldMine AI a worldwide, non-exclusive licence to process that content, store it on its own systems and on third-party systems, and use anonymised data to improve its AI models and services. The same clause warns that similar inputs may produce similar content for other users. Backups remain your responsibility: section 7.3 declines any liability for data loss.

Reuse rights

You may reuse what the agents generate without asking permission: section 5.3 of the terms grants commercial use of the generated content, naming landing pages, reports and prospecting campaigns. On its own side, GoldMine AI states in section 3 of its privacy policy that data serves to deliver and personalise the service, improve the platform, communicate, prevent fraud and meet legal obligations. The processors are named one by one: OpenAI GPT for idea analysis, market research, lead qualification and chat, Anthropic Claude for landing pages and code, Google Gemini for branding, Perplexity Sonar for web and competitor research, then Supabase, Pinecone, Apollo.io through Apify, SerpAPI, Google Trends, Reddit, the Meta Marketing API, plus DataFast and Hotjar for analytics. On training, the two documents disagree and the site never reconciles them: the privacy policy states "We do not use your data to train AI models", while section 7.1 of the terms grants the right to "use anonymized data to improve our AI models and services". No customer-side opt-out is documented.

Data retention & training

Hosting summary

Section 8 of the privacy policy states that "your data is stored in secure cloud infrastructure provided by our service partners (Supabase, Pinecone)", each provider keeping its own certifications. No hosting country and no region is ever named, so the jurisdiction where your data physically sits cannot be established from the site. Section 11 accepts that data may be transferred to and processed outside your own country, including the United States, and cites Standard Contractual Clauses approved by the European Commission, adequacy decisions and processing agreements with third-party providers as safeguards. The security measures listed are HTTPS/TLS in transit, hashed passwords, row-level security in the database, JWT token authentication, API keys kept in environment variables and regular security audits. No certification is displayed, neither SOC 2 nor ISO 27001 nor HIPAA. The front end is served behind Cloudflare, whose anycast address resolves in the United States, but that says nothing about where the data itself lives.