Privacy Policy

1. Introduction

MindX Digital Softwares Inc. ("MindX," "MindX AI," "we," "our," or "us") values and respects your privacy. This Privacy Policy describes how we collect, use, share, and safeguard your personal data when you use our websites, applications, integrations, products and services (collectively, the "Services").

We comply with applicable privacy laws, including:

• General Data Protection Regulation (EU) 2016/679 (GDPR)
• UK GDPR & Data Protection Act 2018
• California Consumer Privacy Act (CCPA) as amended by CPRA
• Brazilian General Data Protection Law (LGPD)
• Canadian Personal Information Protection and Electronic Documents Act (PIPEDA)
• Australian Privacy Act 1988
• Other global privacy regulations where we operate

By using our Services, you agree to the practices described in this Policy.

Two categories of data — and our different roles

This Policy covers two distinct types of data, and MindX AI's responsibilities differ for each:

• Website & Account Data – information about visitors to our websites and about the merchants and businesses that hold a MindX AI account. For this data MindX AI acts as a data controller, as described in Sections 3–7.
• End‑Customer Conversation Data – the messages, and related data, of shoppers and end‑users who interact with an AI chatbot that one of our customers has deployed on their own store or channels. For this data, our customer (the merchant) is the data controller and MindX AI acts solely as a data processor, processing it only on the merchant's documented instructions in order to provide the Services.

Where this Policy describes advertising, marketing, analytics or profiling, those activities relate to Website & Account Data only. We do not use End‑Customer Conversation Data for advertising, and we do not use it to train AI models that serve other customers. The safeguards that apply to End‑Customer Conversation Data are set out in Section 21.

2. Data Privacy Framework (DPF) Compliance

MindX Digital Softwares Inc. complies with the EU‑U.S. Data Privacy Framework (EU‑U.S. DPF), the UK Extension to the EU‑U.S. DPF, and the Swiss‑U.S. Data Privacy Framework (Swiss‑U.S. DPF) as set forth by the U.S. Department of Commerce. MindX Digital Softwares Inc. has certified to the U.S. Department of Commerce that it adheres to the EU‑U.S. DPF Principles with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU‑U.S. DPF and the UK Extension to the EU‑U.S. DPF. MindX Digital Softwares Inc. has certified to the U.S. Department of Commerce that it adheres to the Swiss‑U.S. DPF Principles with regard to the processing of personal data received from Switzerland in reliance on the Swiss‑U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU‑U.S. DPF Principles and/or the Swiss‑U.S. DPF Principles, the Principles shall govern.

To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

3. Information We Collect

Information you provide

• Name, surname, job title and company information
• Email address, phone number and contact preferences
• Billing and payment details (processed by trusted third‑party providers). Merchants who use MindX AI from the Shopify App Store are billed by Shopify, and MindX does not receive their card or bank details (Section 22).
• Store addresses and e‑commerce platform data (Shopify, WooCommerce, Magento, etc.)

Information collected automatically

• Log data (IP address, browser, operating system, device identifiers)
• Usage data (clickstream, time spent, pages viewed, referral links)
• Chat transcripts and interaction data. Where these are generated by shoppers interacting with a customer's chatbot, they are End‑Customer Conversation Data that we process as a processor on the customer's behalf (see Sections 1 and 21).
• Approximate geolocation (derived from IP address)
• Advertising identifiers (cookies, pixels, UTM parameters)

Information from third parties

• E‑commerce platforms connected to your account
• Marketing platforms (Google, Meta, LinkedIn, TikTok, etc.)
• Analytics and CRM providers
• Partners and resellers

4. How We Use Your Information

We use data for the following purposes under lawful bases of contract performance, legitimate interest, consent and legal obligation:

• Service provision – to deliver, operate and maintain our Services.
• Account management – to onboard customers, verify identity and provide customer support.
• Service improvement – to analyze interactions and improve the quality, safety and performance of the Services. Each customer's chatbot answers only from that customer's own configured knowledge base and data, which is logically isolated per account; one customer's data is never exposed in another customer's conversations. We do not use End‑Customer Conversation Data to train shared or foundation AI models.
• Analytics and insights – to understand usage patterns, trends and performance.
• Advertising and marketing – to deliver personalized content, email campaigns, retargeting and measure ad effectiveness. These activities use Website & Account Data only and never End‑Customer Conversation Data.
• Compliance and security – to detect fraud, enforce Terms of Service and comply with legal obligations.
• Research and development – to develop new features and enhance user experience.

5. Cookies and Tracking

We use cookies, pixels, tags and similar technologies for:

• Conversion tracking and campaign optimization
• Website performance and session management
• Analytics (Google Analytics, Mixpanel, Amplitude)
• Advertising and retargeting (Google Ads, Meta Pixel, LinkedIn Ads, TikTok Ads)

You can manage cookie settings via your browser or through our Cookie Preferences Tool. For EU/UK users, no non‑essential cookies are deployed without consent.

6. Sharing of Information and Onward Transfer Liability

We do not sell personal data. We share limited data with trusted providers, including:

• Cloud infrastructure: Amazon Web Services (AWS), Google Cloud
• AI service providers: companies that run the AI models behind the answers in our Services, under contract (for MindX AI, see Section 22)
• Email delivery: our email service provider, for the emails we send
• Analytics: Google Analytics, Mixpanel, Amplitude
• Advertising: Meta, Google Ads, LinkedIn, TikTok
• CRM/Marketing: HubSpot, Intercom, Customer.io
• Automation: Zapier, Segment
• Payments: Stripe, PayPal and other processors, only for customers who pay MindX directly. MindX AI from the Shopify App Store is billed only by Shopify, through Shopify's billing.
• Compliance & Security: Anti‑fraud and security monitoring tools

Each third‑party provider is bound by confidentiality and data processing agreements. When transferring personal data to a third party acting as our agent, MindX Digital Softwares Inc. remains responsible under the DPF Principles if that agent processes such personal data in a manner inconsistent with the Principles, unless we prove that we are not responsible for the event giving rise to the damage.

End‑Customer Conversation Data is treated differently. The advertising, analytics and marketing partners listed above receive Website & Account Data only. We do not share End‑Customer Conversation Data with advertising networks, ad exchanges or data brokers, and we do not use it for cross‑site retargeting or to build advertising profiles. End‑Customer Conversation Data is shared only with the limited infrastructure and AI sub‑processors strictly necessary to deliver the chatbot, each engaged under a data processing agreement and permitted to process the data solely on documented instructions. A current list of sub‑processors is available on request.

7. International Data Transfers

As a U.S.-based company, data may be transferred internationally.

• For EU/EEA/UK customers, transfers are based on Standard Contractual Clauses (SCCs) and UK Addendum where applicable.
• For Swiss customers, transfers follow the Swiss Federal Act on Data Protection (FADP).
• For other jurisdictions, we apply equivalent safeguards.
• For MindX AI (Section 22), store data is stored in India and may be processed in other countries, including the United States, by AI service providers and by our email provider.

8. Data Retention

We keep data only as long as necessary for the purposes outlined in this Policy:

• Account and billing data: retained for 7 years (legal obligation). For the MindX AI Shopify app, Shopify bills the merchant, and the MindX account created for the store is deleted when Shopify sends its shop data erasure request. The records MindX keeps after that, and for how long, are listed in Section 22 under "What MindX keeps after deletion".
• MindX AI store data: kept while the app is installed and deleted when Shopify sends its shop data erasure request, 48 hours after the app is uninstalled. Store updates sent by Shopify are kept for no more than 7 days, except updates MindX could not process, which are kept without customers' contact details until the store's data is deleted. See Section 22.
• Chat logs and End‑Customer Conversation Data: retained for the period configured by the relevant customer (controller) and anonymized or deleted thereafter, unless longer retention is required for security, legal or operational needs. Deletion requests for this data are handled as described in Section 21.
• Marketing data: retained until you opt out or withdraw consent.

9. Data Security

We implement industry‑leading security measures:

• Encryption (in transit and at rest)
• Role‑based access control
• Multi‑factor authentication for internal systems
• Regular audits, monitoring and penetration testing

While no system is 100% secure, we continuously improve safeguards.

10. Your Privacy Rights and Choices

Depending on your jurisdiction, you may have the following rights:

• Right of access – to obtain a copy of your personal data and information about how we process it.
• Right to correction or deletion – to have inaccurate information corrected or deleted when permitted by law.
• Right to restriction – to limit processing under certain circumstances.
• Right to portability – to request a copy of your personal data in a structured, machine‑readable format.
• Right to object or withdraw consent – to object to processing based on legitimate interests or withdraw consent at any time where consent is the legal basis.

Rights under the Data Privacy Framework

• Individuals have the right to access their personal data and to correct, amend or delete information where it is inaccurate or processed in violation of the DPF Principles.
• Individuals also have the right to opt out of the disclosure of their personal data to third parties, or the use of their data for purposes materially different from those for which it was originally collected or subsequently authorized.

To exercise any of these rights, please contact us at support@themindx.ai.

11. Complaints and Inquiries

In compliance with the EU‑U.S. DPF, the UK Extension to the EU‑U.S. DPF and the Swiss‑U.S. DPF, MindX Digital Softwares Inc. commits to resolve DPF Principles‑related complaints about our collection and use of your personal information. EU, UK and Swiss individuals with inquiries or complaints should first contact us at:

Email: support@themindx.ai

12. Independent Recourse Mechanism

In compliance with the EU‑U.S. DPF, the UK Extension to the EU‑U.S. DPF and the Swiss‑U.S. DPF, MindX Digital Softwares Inc. commits to cooperate and comply with the advice of the EU data protection authorities (DPAs), the UK Information Commissioner's Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the DPF. This recourse is provided free of charge to the individual.

13. Investigatory and Enforcement Powers

MindX Digital Softwares Inc. is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).

14. Binding Arbitration

Under certain conditions, and after exhausting other available remedies, individuals may invoke binding arbitration for complaints regarding DPF compliance that are not resolved by other DPF mechanisms. MindX Digital Softwares Inc. is obligated to arbitrate claims and follow the terms as set forth in Annex I of the DPF Principles. For more information, please visit https://www.dataprivacyframework.gov/.

15. Legal Compliance and Disclosure to Authorities

We may disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We also may disclose data when required by law, regulation, court order or to enforce our Terms of Service.

16. Children's Privacy

Our Services are not intended for individuals under 16. We do not knowingly collect personal data from minors. If we discover such data, we will delete it immediately.

17. Third‑Party Links

Our Services may contain links to external websites. We are not responsible for the privacy practices of third parties.

18. Automated Decision‑Making & Profiling

We may use automated tools, including AI algorithms, to personalize recommendations, trigger marketing campaigns and assess engagement. Significant decisions impacting individuals are subject to human oversight where required by law.

19. Do Not Track & Opt‑Out Mechanisms

We honor Do Not Track (DNT) signals where legally required. You can opt out of targeted advertising via the Network Advertising Initiative (NAI) or Digital Advertising Alliance (DAA) opt‑out pages.

20. Changes to This Policy

We may update this Policy periodically. Major updates will be communicated via email or in‑app notifications.

21. Our Role as a Data Processor & Data Processing Agreement (DPA)

When we provide the chatbot and related Services to a business customer, that customer determines the purposes and means of processing End‑Customer Conversation Data and is the data controller; MindX AI acts as a data processor. In that capacity we commit to:

• Process End‑Customer Conversation Data only on the customer's documented instructions and solely to provide the Services;
• Not use that data for our own purposes, including advertising or training shared or foundation AI models;
• Keep each customer's data logically isolated so it is never exposed in another customer's conversations;
• Impose confidentiality and equivalent data‑protection obligations on every sub‑processor, and make the current sub‑processor list available on request;
• Apply Standard Contractual Clauses (and the UK Addendum) to international transfers, as described in Section 7;
• Assist the customer in responding to data‑subject requests and, on termination, delete or return the data subject to legal retention requirements.

Business customers may enter into a Data Processing Agreement (DPA) with us. To request our DPA, contact support@themindx.ai.

22. MindX AI (Shopify App)

MindX AI is our app for Shopify merchants. It is installed from the Shopify App Store and runs inside the merchant's Shopify admin. For the store data it reads, the merchant is the data controller and MindX AI acts as a data processor, as described in Section 21.

What the app reads

• With the merchant's permission, MindX AI reads the store's orders, refunds, fulfilments, products, stock levels and customer totals through Shopify's API. Its access is read-only: it never changes the store.
• From customer records it reads only the customer ID, the dates the record was created and last updated, the number of orders and the amount spent. It does not read customer names, email addresses, phone numbers or postal addresses.
• It also reads the store's own details: its name, web address, currency, time zone and Shopify plan, and the store owner's email address in Shopify (or, if there is none, the store's contact email).
• Shopify sends MindX an update each time an order, fulfilment or product in the store is created or changed, and each time a refund is made.

Why we use it

Only to answer the merchant's questions about their own store and to find problems in it, such as falling sales or orders waiting to ship. The store's name and the store owner's email address are also used to set up the store's MindX account and to send the store owner emails about the app, such as billing notices. We never sell this data, never share it with other merchants, never use it for advertising and never use it to train AI models.

What we store, where and for how long

• The store's MindX account. When the app is first opened, MindX creates an account for the store from its name, web address and the store owner's email address, and links the store owner's MindX login to it, creating one if needed.
• The Shopify connection. The store's access tokens, encrypted with AES-256-GCM.
• Store updates, for up to 7 days. Each update Shopify sends about an order, refund, fulfilment or product is kept encrypted until MindX has read it. It is deleted within 7 days of arriving, together with Shopify's IDs for the record and for the customer it names. An update MindX could not process is kept for review, without customers' contact details, until the store's data is deleted.
• Store memory. To compare periods and explain what changed, MindX may keep the store's order, refund, fulfilment, product and customer-total records, and the figures behind its answers and findings, in the store's own store memory. Shopify does not give MindX AI customers' names, email addresses, phone numbers or postal addresses, so the app does not receive them and store memory does not keep them. Order records can include other details Shopify sends with an order, such as the shopper's IP address and browser, and notes written on the order.
• The app's own work. The merchant's questions and the app's answers, its findings and the merchant's decisions on them, actions proposed and approved in the app, notifications, settings, a copy of the product catalogue, and billing records: the plan, the number of answers used in each billing cycle, and the credits bought and used.
• Records of what was done. An audit log of who did what in the app and when, a record of each customer privacy request Shopify sends, and records of MindX support staff asking the store owner for access to the store.
• Apart from the store updates and the records listed under "What MindX keeps after deletion" below, this data is kept while the app is installed and is deleted as described under "Deletion". It is stored on Amazon Web Services in Mumbai, India (ap-south-1), and is encrypted at rest and in transit.

AI service providers and other recipients

• To write the app's answers and explanations, MindX sends the merchant's question and the store data needed to answer it to AI service providers. They process it only on MindX's behalf, under contract, and may process it outside India, including in the United States.
• AI service providers may not use this data to train their models. They may keep it only for a limited time, as their contract allows, for example to monitor for abuse.
• Emails from the app to the store owner, such as billing notices and answers to customer data requests, are sent through our email provider, which may process them outside India.

Deletion

• When the merchant uninstalls the app, Shopify ends the app's access to the store. When Shopify tells MindX about the uninstall, MindX deletes the store's access tokens, including the copy used by its AI tools, and any unused credits are forfeited. The tokens are deleted in any case with the rest of the store's data, as described next.
• Shopify sends its shop data erasure request 48 hours after the app is uninstalled. MindX then deletes the store's data listed above: the installation and the Shopify connection, any store updates still kept, the store memory, the copy of the product catalogue, and the app's conversations, findings, decisions, notifications, settings, feedback, credit balance and question history.
• MindX also deletes the MindX account it created for the store when the app was first opened: the account, the list of who belongs to it, its invitations, sign-in sessions and onboarding data. The MindX login of each person on that account is deleted too, unless that person also uses another MindX workspace.
• If the store was linked to a MindX account that existed before the app was installed, or the account is also used by another Shopify store, that account is kept: only its link to the store, sign-ins made from the store's Shopify admin and the store's data are deleted.
• If the app is installed again before Shopify's erasure request arrives, only store updates still waiting to be read are deleted; the account and the rest of the store's data stay.
• Backups that contain deleted data expire within 7 days.

What MindX keeps after deletion

• The store's billing records: its web address, the number of answers used in each billing cycle, the credits bought, used and forfeited, when a free trial started, and which billing notices were sent. The plan itself is ended. Apps installed from the Shopify App Store are billed by Shopify, so these records hold no payment details. They are kept for up to 7 years (Section 8).
• Records of MindX support staff asking the store owner for access to the store, and the owner's answer. They are kept for one year.
• The app's audit log: which user did what in the app and when, with any short note a user wrote on a decision, Shopify's ID of any customer whose details were viewed, and the line that records the erasure.
• Records of actions proposed and approved in the app: which action, who approved it, when, and the result.
• A record of each customer privacy request Shopify sent: Shopify's IDs for the store, the customer and the orders named, and the customer's email address and phone number in hashed form only.
• A list of the store's customers erased at Shopify's request, by Shopify's customer ID, so that they are not added back.
• Technical records of the app's work for the store, such as when its data was last synced and weekly answer-quality statistics. They hold IDs, dates, statuses and counts.
• These records hold no question text and no customer names or contact details from Shopify, other than the hashed email addresses and phone numbers in the privacy request records. Apart from the billing and support access records, they are kept as evidence of what was done in the app and of how privacy requests were handled, for as long as MindX may need to show this, for example in a dispute or to a regulator.

Requests about one customer

• When Shopify sends a customer data erasure request, MindX removes from the app's findings, conversations, question history and store memory everything that names that customer by their Shopify customer ID, email address or phone number, and deletes store updates that name them. The store's orders are kept as the store's records, without the link to the customer. MindX keeps the record of the request, the customer's Shopify ID on the list of erased customers, and audit log lines that show that ID, as described above.
• When Shopify sends a customer data request, MindX gathers what the app's findings, conversations, question history, store memory and audit log hold about that customer and emails it to the store owner at the store owner's email address in Shopify.
• Both are carried out automatically within 30 days; a step that fails is tried again every hour until it is done.

Questions about MindX AI and privacy: support@themindx.ai.