Privacy Policy

MindPair AI (“MindPair,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect Personal Information when you visit or use the MindPair website and service at https://mindpair.isolah.com/, including account registration, Google sign-in, paid sessions, interviews, uploads, recommendations, and PDF reports. If you are in the EEA, UK, or Switzerland, section 8 explains our GDPR and UK GDPR practices.

“Personal Information” or “Personal Data” means information that identifies, relates to, describes, or can reasonably be linked to an individual.

This Privacy Policy applies to:

• Visitors who browse the MindPair website;
• People who create an account with email and password or Google;
• Customers who subscribe to MindPair Pro, buy a Single Session, or buy extra AI requests;
• Users who start thinking sessions, upload documents, enable web research, or download reports; and
• People who email us or submit the Contact Us form about support, billing, or data deletion.

MindPair is a direct-to-user service. If you use a shared computer or an email address provided by an employer, that organization may also have access to that mailbox or device.

• Identification and contact information: email address, name, and optional profile image.
• Account and authentication information: hashed passwords (Argon2id), email verification status, Google OAuth account identifiers and tokens stored only as required by Auth.js, and session tokens.
• Billing information: subscription status, plan, paid-through dates, Single Session credits, purchased AI request packs, Stripe customer and subscription identifiers, and checkout or webhook event records. Card numbers are collected by Stripe and are never stored by MindPair.
• Session content: goals, expert-role instructions, interview transcripts, uploaded files, research notes, recommendations, and downloadable reports.
• Usage and fair-use information: counts of AI requests, web research calls, new discussions, and storage used.
• Technical information: IP address used for rate limiting, browser session data, and timestamps needed to operate and secure the service.
• Communications: messages you send through the Contact Us form (name, email, phone, company, subject, and message) and emails you send us, such as support or deletion requests.

• Create and authenticate your account, including Google sign-in;
• Provide adaptive interviews, optional web research, recommendations, and PDF reports;
• Process MindPair Pro subscriptions, Single Session purchases, and AI request packs through Stripe;
• Apply fair-use limits and prevent abuse;
• Detect, prevent, and respond to security incidents and technical problems;
• Send transactional email such as verification or password reset when email is configured;
• Comply with legal, tax, and recordkeeping obligations; and
• Improve reliability and customer experience of the service.

We do not use your interview content to sell advertising.

We do not sell Personal Information. We may share Personal Information with:

• Stripe, to process payments, manage subscriptions, and handle the Customer Portal. See Stripe’s privacy policy for how Stripe handles card data.
• OpenAI, to generate interview questions, optional web-research summaries, and recommendations. Interview text, uploaded files, and related notes may be sent to OpenAI for that purpose. Do not upload secrets you cannot share with those processors.
• Google, if you choose Continue with Google, so Google can authenticate you. Google’s use of data is governed by Google’s policies.
• Hosting, backup, and email delivery providers that help us operate MindPair;
• Professional advisors, and government or law-enforcement parties when required by law; and
• Other parties with your direction or consent, or as otherwise permitted by law.

Some processors may handle data in the United States or other countries. If you are in the EEA, UK, or Switzerland, see section 8 for how we handle those transfers.

MindPair uses cookies and similar technologies as described in our Cookie Notice. Strictly necessary cookies keep you signed in and protect the service. The session cookie is authjs.session-token locally and __Secure-authjs.session-token in production. It is HTTP-only. Optional categories (preferences, analytics, functional media, and marketing) stay off unless you accept them in Cookie Settings. When you allow Analytics cookies, we use Google Analytics (measurement ID G-SPLP3SKFSJ) to understand page visits. We do not currently load advertising tags.

You can manage optional cookies in Cookie Settings, or block cookies in your browser. If you block essential cookies, sign-in and paid features may not work.

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to certain processing of Personal Information, to receive a copy of data you provided to us, and to opt out of marketing (MindPair does not currently send marketing email).

Signed-in users can download a copy of their account data and delete their account from Account settings. Deletion requires recent authentication, cancels an active Stripe subscription, removes uploads, deletes associated OpenAI files and vector stores where we can, revokes sessions, and deletes application data we control. See also Data deletion.

You can also request access, correction, deletion, restriction, objection, or portability through the Contact Us form with the subject “MindPair GDPR request” and the email on the account. We respond within 30 days, or sooner where the law requires it, and retain only legally required billing references after deletion.

If you are in the European Economic Area, the United Kingdom, or Switzerland, this section applies in addition to the rest of this Policy. The data controller is MindPair AI, operated from the United States. Privacy requests go through the Contact Us form.

We process Personal Data on these lawful bases:

• Contract (Article 6(1)(b)): creating your account, running paid sessions, generating reports, processing Stripe checkout and subscriptions, applying fair-use limits, and providing customer support you request.
• Legitimate interests (Article 6(1)(f)): securing the service, rate limiting, preventing abuse and fraud, and keeping the product reliable, where those interests are not overridden by your rights.
• Legal obligation (Article 6(1)(c)): tax, accounting, and records we must keep after a purchase or deletion request.
• Consent (Article 6(1)(a)): optional Google sign-in. You can disconnect Google in account settings and still use email sign-in where a password exists.

You may request access, rectification, erasure, restriction, data portability, and objection, and you may withdraw consent for optional Google sign-in without affecting processing that already happened. You may lodge a complaint with your local supervisory authority (in the UK, the ICO). We do not use your data for automated decisions that produce legal or similarly significant effects. Interview recommendations are a thinking aid; you remain responsible for decisions you make.

We transfer data to the United States and other countries where our processors operate, including Stripe (payments), OpenAI (interview and report generation), Google (optional sign-in), and the hosting and email providers that run MindPair. Those providers apply their own safeguards, which may include the EU-U.S. Data Privacy Framework, UK extensions, and/or Standard Contractual Clauses. Interview text and uploads may leave the EEA when sent to OpenAI to provide the service you requested.

We have not appointed a separate EU or UK representative. You can exercise your rights directly with us through Contact Us or Account settings. We will not require you to create a new paid session solely to make a privacy request.

We use reasonable administrative, technical, and organizational safeguards designed to protect Personal Information, including hashed passwords, TLS in production, database access limited to the application host, and rate limiting on sensitive routes.

We retain account, session, billing, and content data while your account is open and as needed to provide the service. After account deletion we retain Stripe identifiers and similar records only where legally required for tax and accounting. Fair-use counters are kept by billing month while the account exists.

MindPair is intended for adults making business or personal decisions. It is not directed to children. We do not knowingly collect Personal Information from children under 13, or under 16 where that is the applicable age of digital consent in the EEA or UK. If you believe a child has created an account, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we update it, we will revise the “Last updated” date above.

Questions may be sent through the Contact Us form. Related pages: Terms of Service, Cookie Notice, and Data deletion.

Privacy policy URL for OAuth consents: https://mindpair.isolah.com/privacy