1. Data Controller & Scope
This Privacy Policy governs how Mindaeon, Inc. ("Mindaeon", "we", "our"), located at 548 Market St, Suite 62410, San Francisco, CA 94104, USA, collects, processes, and protects personal data across mindaeon.com, mindaeon.ai, the Mindaeon Web Console, Mindcode CLI, Mindaeon Desktop, and our IDE, Browser, and Office 365 extensions.
2. Zero Training on Customer Code & Prompts
Your source code, repository graphs, prompts, agent trajectories, and Foundry blueprint outputs belong exclusively to your organization. Mindaeon never sells customer data and never uses customer code, prompts, or audit logs to train, fine-tune, orshared-weight update any foundation model.
3. Categories of Data Processed
- Workspace Account Metadata: Work email address, full name, organization name, workspace slug, billing contact, and role-based access control (RBAC) assignments.
- Authentication & Security Telemetry: OIDC/SAML subject identifiers, WebAuthn/Passkey public key credentials, session token hashes, IP addresses for rate limiting, and immutable hash-chained audit records.
- Client Surface Execution Data (Cloud Edition only): Repository symbol metadata, tool execution requests evaluated against Open Policy Agent (OPA), and encrypted session state stored inside your dedicated tenant boundary.
- Sovereign Appliance Edition: In air-gapped Sovereign Appliance deployments, zero bytes of personal data, source code, or telemetry leave your infrastructure.
4. Tenant Isolation & Cryptographic Controls
Every workspace is isolated via PostgreSQL 18 Row-Level Security (RLS) policies and per-tenant OpenBao Transit encryption keys. All agent tool calls pass through a deterministic pre-execution secret and PII redaction filter before leaving the runtime.
5. Subprocessors (Managed Cloud Edition)
- Cloudflare, Inc. (Global Edge routing, WAF, DDoS protection, D1 edge metadata — US/EU)
- Google Cloud Platform (Isolated Kubernetes & Cloud SQL compute in customer-selected US or EU regions)
- Customer-Configured LLM Providers (BYOK): Only invoked when explicitly configured by your workspace administrator under zero-data-retention (ZDR) enterprise endpoints.
6. International Transfers, GDPR & CCPA Rights
For EEA, UK, and Swiss customers, Mindaeon executes the Standard Contractual Clauses (SCCs) in our Data Processing Addendum (DPA) and supports EU-only data residency. You may exercise rights of access, rectification, erasure, portability, or restriction at any time via your Console settings or by emailing privacy@mindaeon.com.