Privacy Policy

Effective date: May 14, 2026

This Privacy Policy describes how mindmap.io ("we", "us", "our") collects, uses, and shares personal information when you use our website and services at mindmap.io (the "Service"). By using the Service, you consent to the practices described in this policy.

1. Information We Collect

Information you provide

  • Account information: Your email address and name when you sign up via Google OAuth or email magic link.
  • User Content: The mindmaps, prompt maps, prompts, AI responses, and all associated data you create within the Service.
  • Payment information: When you subscribe to a paid plan, payment is processed by Stripe. We store your Stripe customer ID and subscription status but never your credit card number or full payment details.
  • Communications: Messages you send to us via email, feedback forms, or support requests.

Information collected automatically

  • Usage data: Anonymous, aggregated analytics about how you interact with the Service (pages visited, features used) collected via Umami, a privacy-focused, cookie-free analytics tool.
  • Device information: Browser type, operating system, and general location (derived from IP address) for security and performance purposes.
  • Log data: Server logs including IP address, access timestamps, and error logs for debugging and security.

Information we do not collect

We do not knowingly collect sensitive personal information such as biometric data, health information, genetic data, religious beliefs, political opinions, or sexual orientation.

2. How We Use Your Information

  • Providing the Service: To operate, maintain, and improve mindmap.io, including storing your content, processing AI requests, and managing your account.
  • Authentication: To verify your identity and manage access to your account.
  • Payments: To process subscription payments and manage billing via Stripe.
  • Communications: To send transactional emails (login links, payment receipts, subscription updates) via Mailgun. We do not send marketing emails unless you opt in.
  • Security: To detect, prevent, and address fraud, abuse, and security issues.
  • Improvement: To analyze aggregated, anonymous usage patterns to improve the product. We may create de-identified or anonymized data from personal information; once anonymized, it is no longer personal information.
  • Legal compliance: To comply with applicable laws, legal processes, and regulatory requirements.

3. AI Features and Your Data

We do not use your User Content to train AI models, nor do we permit any third party to use your User Content for AI model training. Your prompts, responses, and mindmap data are used solely to provide the Service to you.

When you use PromptMap features, your prompts and conversation context are sent to the third-party AI provider you select. Each provider processes your data under their own privacy policies:

We do not control how these providers handle your data once it is transmitted to them. We recommend reviewing each provider's privacy policy.

4. Third-Party Services

We use the following third-party services to operate mindmap.io:

We may share your personal information with these service providers solely to the extent necessary for them to perform their services. We do not sell your personal information to any third party.

5. How We Share Your Information

We may disclose your personal information in the following circumstances:

  • Service providers: Third-party companies that help us operate the Service (hosting, payments, email, analytics, AI providers), as described above.
  • Legal requirements: When required by law, subpoena, court order, or government request.
  • Safety and rights: To protect the rights, property, or safety of mindmap.io, our users, or the public.
  • Business transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as a business asset. In such event, we will notify you before your information becomes subject to a different privacy policy.

We do not sell or share your personal information for cross-contextual behavioral advertising or targeted advertising purposes.

6. Data Storage and Security

Your data is stored on servers located in the United States. Data is protected with encryption in transit (TLS) and at rest.

We implement commercially reasonable technical and organizational measures to protect your personal information from unauthorized access, loss, misuse, and alteration. However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

7. Data Retention

We retain your personal information only as long as necessary to provide the Service and fulfill the purposes described in this policy:

  • Account data: Retained as long as your account is active.
  • User Content: Retained as long as your account is active. You may delete content at any time.
  • Payment records: Retained as required by applicable tax and financial regulations.
  • Log data: Retained for up to 90 days for security and debugging purposes.
  • Analytics data: Anonymized analytics data may be retained indefinitely.

If you delete your account, your personal data and User Content will be permanently removed within 30 days, except where retention is required by law.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate or incomplete data.
  • Deletion: Request deletion of your account and associated personal data.
  • Portability: Export your mindmaps and content in JSON, Markdown, or PNG format at any time through the Service.
  • Objection: Object to certain types of processing of your personal data.
  • Restriction: Request restriction of processing while a request is pending.
  • Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may verify your identity before processing your request.

9. International Data Transfers

mindmap.io is operated from the United States. If you use the Service from outside the United States (including from the European Economic Area, United Kingdom, or other jurisdictions), your personal information will be transferred to and processed in the United States. By using the Service, you consent to this transfer. Where required by applicable law, we ensure an adequate level of data protection through appropriate safeguards.

10. Cookies

mindmap.io uses a session cookie for authentication purposes only. We do not use tracking cookies, advertising cookies, or third-party cookies. Our analytics provider (Umami) is cookie-free and does not track individual users across sessions.

11. Do Not Track

Some browsers offer a "Do Not Track" (DNT) setting. Since we do not use tracking cookies or engage in cross-site tracking, the Service effectively honors DNT signals by default.

12. Children's Privacy

mindmap.io is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at [email protected].

13. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

  • The right to know what personal information we collect, use, and disclose.
  • The right to request deletion of your personal information.
  • The right to opt out of the sale of personal information. We do not sell your personal information.
  • The right to non-discrimination for exercising your privacy rights.

To exercise your CCPA rights, contact us at [email protected].

14. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data on the following legal bases:

  • Contract performance: Processing necessary to provide the Service to you (account management, content storage, AI processing).
  • Legitimate interests: Processing for security, fraud prevention, service improvement, and analytics, where these interests are not overridden by your rights.
  • Consent: Where you have given explicit consent (e.g., optional communications).
  • Legal obligation: Processing required to comply with applicable laws.

You have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. If we make material changes, we will notify you by email or through the Service. Continued use of the Service after changes become effective constitutes acceptance of the updated policy.

16. Contact

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

mindmap.io
Email: [email protected]