Mintlify

GDPR overview

GDPR implementation is concrete rather than declarative. The privacy policy, updated and reviewed on 16 June 2026, sets out legal bases under both the GDPR and the UK GDPR. Mintlify has appointed a named DPO, Han Wang, at security@mintlify.com and, being established outside the EU and the UK, Article 27 representatives in both: Instant EU GDPR Representative Ltd in Lucan, Co. Dublin, and GDPRLocal Ltd in Brighton, each with a dedicated portal. Data subject rights are listed in full, from access and copy to rectification, erasure, restriction, portability, objection and withdrawal of consent, and are exercised through a dedicated request form. International transfers rely on the European Commission's standard contractual clauses, the UK IDTA and the EU-US Data Privacy Framework, with transfer impact assessments. An EU DPA is available through the trust center; CCPA and Virginia CDPA are covered separately.

Who owns the data?

Mintlify's terms draw a clean line between Customer Data and the Service. Everything a customer uploads, writes or syncs into the platform stays theirs: the terms state that the customer retains all right, title and interest in the Customer Data, including the intellectual property rights in it. Mintlify keeps ownership of the Service itself, its software and its own intellectual property. The customer alone answers for the accuracy, quality, legality and ownership of what it uploads. One reservation is worth noting: Mintlify may use a customer's name and logo as a commercial reference. Where the customer acts as controller or processor, an EU data processing agreement is available through the trust center.

Reuse rights

Because the customer keeps all right, title and interest in its Customer Data, nothing in the terms requires Mintlify's permission to reuse that content elsewhere: teams can export it and republish it as they see fit, and the platform ships Markdown, PDF and offline exports that make the portability practical. Mintlify's own use is deliberately narrow. The terms commit the company not to use Customer Data to train, fine-tune, improve or develop large language models, generative AI models or machine learning models, and that prohibition is passed on to the third-party providers named in the supplier terms, Anthropic, OpenAI and Google Gemini, which may not use, store or retain customer content for training. The Slack integration follows the same rule: messages reach LLM providers for inference only. LLM middleware is disclosed too, with Helicone for cost tracking and OpenRouter for provider failover. Marketing and analytics processing is handled separately, through tools such as Google Tag Manager, HubSpot, Unify, Attribution, RB2B and Common Room.

Data retention & training

Hosting summary

Mintlify, Inc. is established in the United States and states that most of its sub-processors are based there too. The published infrastructure providers are Amazon Web Services, Vercel, MongoDB Atlas and ClickHouse Cloud. EU hosting exists, but as an option on the Enterprise tier rather than a default, alongside self-hosting for teams that must keep documentation on their own infrastructure. Transfers out of Europe are covered by the European Commission's standard contractual clauses, the UK IDTA and the EU-US Data Privacy Framework, backed by transfer impact assessments. On the technical side, the privacy policy lists encryption in transit and at rest, least-privilege access control, multi-factor authentication, network segmentation, logging, vulnerability scanning, code review and an incident response process. One caveat for anyone checking independently: the site's public IP address (76.76.21.21) belongs to an anycast web front end and says nothing about where customer data is actually stored.