Privacy Policy

1. Information we collect

• Account information: your name, email address, and authentication details.
• Salesforce connection: encrypted OAuth access/refresh tokens and your org’s instance URL and org id.
• Usage data: the questions you ask, the changes you request and approve, strike consumption, and product analytics used to provide and improve the service.
• Billing data: subscription and payment status via Stripe (we never see or store full card numbers).

2. What we do NOT store

We do not copy or retain your Salesforce records. Org Insights runs read-only queries and returns results to your browser; Org Forge deploys only the changes you approve. Query results are used to render your charts and are not persisted as a shadow copy of your CRM. We do not use the contents of your Salesforce org to train third-party AI models.

3. How we use your information

We use your information to operate the service (connect to Salesforce, answer questions, deploy approved changes, run health checks), to bill your subscription, to send transactional and lifecycle email, and to secure and improve the product. We do not sell your personal information.

4. How we store and protect data

Salesforce access and refresh tokens are encrypted with AES-256-GCM before storage. All data is transmitted over TLS. We apply least-privilege access controls and row-level security so each organization can access only its own data. Access to production systems is restricted and audit-logged.

5. Subprocessors

We rely on a small set of trusted infrastructure providers, each processing data only as needed to deliver the service:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting and edge delivery.
• Stripe — subscription billing and payment processing (card data is handled by Stripe; we never store full card numbers).
• Anthropic — AI processing of the requests you make (Claude).
• Resend — transactional and lifecycle email delivery.
• Cloudflare — bot and abuse protection (CAPTCHA) on public forms.
• Google — email routing/SMTP relay and workspace communications.

6. Cookies

We use strictly necessary cookies for authentication and session management (including “remember me” and inactivity timeouts). We do not use third-party advertising cookies. You can control cookies through your browser, though disabling essential cookies will prevent you from signing in.

7. Data retention & deletion

We retain account and usage data while your account is active and for up to 30 days after cancellation to allow reactivation, after which it is deleted or anonymized. Disconnecting Salesforce immediately removes your stored OAuth tokens. Billing records are retained as required by law.

You can request deletion of your account and associated personal data at any time by contacting privacy@mindzolt.ai; we will delete or anonymize it within the timeframe required by applicable law, except where we must retain certain records for legal or accounting purposes.

8. Your rights (GDPR / CCPA)

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. California residents have the right to know what personal information we collect and to request deletion, and we do not sell personal information. To exercise any of these rights, contact privacy@mindzolt.ai; we will respond within the timeframe required by applicable law.

9. International transfers

Our providers may process data in the United States and other regions. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

10. Children

mindZolt is a business product intended for use by professionals and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact privacy@mindzolt.ai and we will delete it.

11. Changes & contact

We may update this policy from time to time; material changes will be communicated by email or an in-app notice before they take effect. Questions can be sent to privacy@mindzolt.ai.