Privacy Policy

1. Who We Are

Mindnodes ("the Service") is provided by Hyperlab BV, Op de Koopman 2, 3960 Bree, Belgium, company number 0768.387.874 ("we"), which is the controller of your personal data. You can reach us about anything in this policy at [email protected] or at the address above. We answer within one month.

2. Data We Collect

• Account information: your name, email address, password (stored only as a hash) and two-factor authentication settings. This is required to create an account; everything else is optional.
• Your content: the nodes, notes, files, images, audio recordings, locations you add, items you send in through the API, and your conversations with the Mindnodes assistant. Your content may include sensitive information, for example about your health; we process it only to provide the features you use.
• Connected accounts: when you connect a Google account, the Gmail and Google Calendar data described in section 4.
• Derived data: what the Service builds from your content to work for you: summaries, search indexes, how your inbox is sorted, the names and email addresses of people you correspond with, and a memory note in which the assistant keeps your preferences.
• Credentials for tools you connect: API keys and the access tokens of agents and tools you link to Mindnodes, stored encrypted.
• Device data: push notification tokens, and the name and platform of the devices you sign in on.
• Technical data: IP address, browser and device type, how much you use the AI features, and server logs and error reports we need to keep the Service running and secure.

3. How We Use Your Data

• To provide the Service — store and sync your content, import your email and calendar, and run the AI features you use, such as search, summaries, suggestions and drafting replies. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• To keep the Service secure and working — detect and prevent abuse and diagnose errors, using technical data, logs and error reports. Legal basis: our legitimate interest in running a secure and reliable service (Art. 6(1)(f) GDPR).
• To communicate with you about your account and important changes to the Service. Legal basis: performance of our contract (Art. 6(1)(b) GDPR).
• To comply with the law — for example accounting rules or a lawful request from an authority. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

We do not sell your data, use it for advertising, or build advertising profiles. We do not use your content to create, train or improve AI models.

4. Google User Data

What we access

Connecting a Google account is optional. If you do, Mindnodes asks for the following access:

• Gmail ("Read, compose, and send emails from your Gmail account"): message headers (sender, recipients, subject, date), message bodies, attachments, threads, labels and drafts.
• Google Calendar ("See the list of Google calendars you're subscribed to" and "View and edit events on all your calendars"): your calendar list, and the title, time, location, description and attendees of events.

How we use it

• Gmail: to import your messages and attachments and keep them in sync; to let the assistant summarise, sort and file them; to apply labels that organise your inbox; and to prepare reply drafts. Mindnodes sends an email only after you approve it, and always through your own Gmail account. When you delete a thread in Mindnodes, it is moved to your Gmail Trash, where Gmail's own retention applies. Mindnodes never permanently deletes messages from your mailbox; the only thing it deletes outright is a draft it created itself.
• Google Calendar: to show your events in Mindnodes and link them to your notes. Mindnodes creates, changes or deletes an event only after you approve it.

Where it is stored and who receives it

Imported Gmail and Calendar data, and what the Service derives from it, is stored on our servers in Falkenstein, Germany (Hetzner). OAuth tokens are stored encrypted. To provide the features above, parts of it are sent to:

• Anthropic processes message and event content to generate summaries, sort your inbox and draft replies.
• Cohere turns message content into search indexes.
• Google Firebase and Apple deliver push notifications, which can show the sender and subject of a new email.

These providers act on our behalf, under contract, and may not use the data for their own purposes or to train their models.

If you connect an agent or tool of your choice to Mindnodes, for example through our MCP server, Mindnodes makes your Gmail and Calendar data available to it only because you asked it to and only for the actions you request. You can revoke that connection at any time.

Limited Use

Mindnodes' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs (Gmail and Google Calendar) will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing features described above, which are visible in the Mindnodes interface.
• We transfer Google user data only: with your consent, to provide or improve those features, to the providers named above and to agents or tools you connect yourself; for security purposes, such as investigating abuse; to comply with applicable laws and regulations; or as part of a merger, acquisition or sale of assets, after obtaining your explicit prior consent.
• We do not use Google user data for advertising, and we do not sell it.
• We do not use Google user data to create, train or improve any AI or machine-learning model, including generalised or foundational models. Our AI providers receive it only to perform the feature you use and return the result, and may not use it for training either.
• No person at Hyperlab reads your Google user data unless: we have obtained and documented your explicit consent to view specific messages or events, for example when you ask for support; it is necessary for security purposes, such as investigating a bug or abuse; or it is required to comply with applicable laws or regulations.

Keeping and deleting it

Imported Google data is kept while your Google account is connected. When you disconnect Google Calendar in the Service's settings, its imported events are deleted. To remove imported Gmail data, delete your Mindnodes account or contact us. Notes you wrote yourself based on an email stay part of your notes until you delete them. Deleted data disappears from our backups within 14 days. You can also revoke Mindnodes' access at any time in your Google Account settings, which stops all further access.

5. AI Processing

Mindnodes' features run on AI models from third-party providers. To answer a question, summarise an email or suggest where something belongs, the relevant part of your content is sent to the provider, processed, and the result returned to you. Under our agreements with them, these providers may not use your content to train their models. They may keep inputs and outputs for a limited period, currently up to 30 days, to detect misuse, and then delete them.

The assistant sorts incoming email, suggests where items belong and keeps a memory note to tailor its help to you. These are suggestions you review: Mindnodes makes no decisions about you that have legal or similarly significant effects.

6. Service Providers

We use the following providers to operate the Service. Each processes your data only on our instructions and only for the purpose listed.

• Hetzner (Falkenstein, Germany): the servers, database and file storage that run the Service, and backups
• Cloudflare (Cloudflare Inc., United States; storage in the European Union): a second copy of our backups
• Anthropic (United States): AI models behind the assistant, inbox sorting and summaries, including attachments you let it read and web searches it runs for you
• Cohere (Canada): search indexes and ranking, including the text of imported emails
• OpenAI (United States): transcription of audio recordings
• Mailgun (Mailgun Technologies Inc., United States; EU region): sending transactional emails about your account, such as a password reset. These contain no content from your notes or mailbox
• Google Firebase and Apple Push Notification service (United States): delivering push notifications
• Google Maps Platform (United States): showing maps of your locations
• Iframely (United States): previews for links you add; only the link itself is sent
• Laravel Nightwatch (Laravel Holdings Inc., United States): application monitoring and error reports
• Laravel Forge (Laravel Holdings Inc., United States): server management and deployment, with technical access to our servers

Content you embed, such as a YouTube video, is loaded from its own provider, which may set cookies of its own.

7. Connected Tools

When you connect a third-party agent or tool, for example through our MCP server, an external MCP server you add to the assistant, or a remote agent host running on your own account, we share with it the data you authorise, at your instruction. From then on, that tool's provider is responsible for it under its own terms; for Google user data, section 4 applies.

8. People Who Are Not Mindnodes Users

Emails and calendar events that our users import contain personal data of other people, such as names, email addresses and message content. We process this data only to provide the Service to the user who imported it, never to contact or profile those people, and we delete it when the user deletes it or closes their account. Our legal basis is the legitimate interest of our users and of Hyperlab in providing a personal email and knowledge tool (Art. 6(1)(f) GDPR). If you believe we hold your data through one of our users, you can contact us to exercise your rights.

9. International Transfers

Some of the providers above process data outside the European Economic Area. For Cohere, we rely on the European Commission's adequacy decision for Canada. For providers in the United States, we rely on their certification under the EU–US Data Privacy Framework where they are certified, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of these safeguards.

10. How Long We Keep Your Data

• Your account and content are kept for as long as you have an account.
• When you delete an item, it disappears from the Service right away. It is permanently erased when you delete your account.
• When you delete your account, every sign-in to it is revoked straight away; a device that is offline at that moment removes its copy of your data the next time it connects. Your data is then permanently deleted from our systems within 24 hours, and from our backups within 14 days after that. We email you a confirmation once it is done, and keep only a record that an account was deleted and when, without your name, email address or content.
• Imported Google data is kept as described in section 4.
• Server logs and error reports are deleted after [TODO] days.

11. Data Security

Data is encrypted in transit. OAuth tokens and credentials for connected tools are stored encrypted. Access to production systems is limited to the people who need it to run the Service, who are bound by confidentiality. You can protect your account with two-factor authentication.

Our apps keep a copy of your data on your device so you can work offline. That copy is protected by your device's own security and is removed when you sign out or uninstall the app.

12. Your Rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Have your data erased: delete individual items, or your whole account from the account settings in the app, or ask us
• Restrict processing in certain cases
• Receive the data you gave us in a structured, machine-readable format
• Withdraw consent where we rely on it, at any time

Right to object: you can object at any time to processing based on our legitimate interests (see sections 3 and 8).

To exercise these rights, contact us at the address in section 1. You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, dataprotectionauthority.be, or with the authority in the EU country where you live.

13. Cookies and Local Storage

We use only essential cookies and local storage on your device: to keep you logged in, protect against forged requests, and let the app work offline. We do not use tracking or advertising cookies. See section 6 for content loaded from other providers.

14. Children

Mindnodes is not intended for children under 16, and we do not knowingly collect their data. If we learn that a child under 16 has an account, we delete it.

15. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email or in the Service before they take effect.

16. Contact

For privacy questions or requests, email [email protected] or write to Hyperlab BV, Op de Koopman 2, 3960 Bree, Belgium.