This Privacy Policy explains how MindFull Technologies OÜ ("MindFull", "we", "us", or "our") collects, uses, and shares information across the MindFull platform. It applies to MindFull Backoffice, Kakapo, Sanchari, and the shared MindFull account that signs you in to all of them, together the "Services". It also applies to our website, mindfulltechnologies.com.
A "Workspace" is the account that belongs to one business using the Services. It holds that business's records, its bots, and the people it has invited to work in it. A "bot" is a chat assistant a Workspace builds with Kakapo to answer questions from content the Workspace gives it.
Some of the information we hold is not about you. It is about your customers, and you put it there. Where that is the case you decide what is collected and why, and we process it to run the Services for you. The privacy policy your own customers read is yours to publish, not ours.
Information we collect
We collect information in the following ways:
Details you give us when you create an account or are invited to a Workspace, such as your name and email address.
Your name, email address, and profile picture from Google when you sign in with a Google account, as described under Signing in with Google below.
Billing and subscription details when a Workspace takes a paid plan.
Content a Workspace puts into the platform, such as customer records, inquiries, bookings, offerings, and the content a Workspace gives its bots.
Details a business asks its customers for when they accept a booking agreement, such as a phone number, postal address, identity document number, and arrival details.
Mail received by a mailbox a Workspace connects, messages sent to and from a WhatsApp number a Workspace connects, and busy times on a calendar a Workspace connects, as described under Connected accounts below.
Your WhatsApp number and the identifier WhatsApp gives you, if you link your WhatsApp to a Workspace to receive booking alerts, as described under Booking alerts on WhatsApp below.
Files a Workspace member attaches to a reply sent through the platform.
Photos a Workspace adds to its offerings. We re-encode each one before storing it, which removes the location, camera, and other details a photo file can carry.
Messages sent to a published bot by visitors to a Workspace website.
Inquiries a business's customers send through a form the business shares, either a link sent to one person or a public inquiry page, as described under Public inquiry pages below.
Messages you send us from the MindFull Technologies website, as described under Visiting our website below.
Counts of how much a Workspace uses the AI features, measured against the allowance in its subscription.
Diagnostic records written when something in the platform fails, as described under Records we keep for our own reasons below.
How we use your information
Provide, operate, and maintain the platform.
Keep each Workspace separated from every other Workspace.
Generate answers, drafts, and suggestions where a Workspace has switched an AI feature on.
Measure usage against the allowance included in a subscription.
Improve performance and reliability.
Respond to questions, requests, and support inquiries.
Send service updates, security alerts, and product news.
Comply with legal obligations and enforce our terms.
AI processing
Where a Workspace has switched on an AI capability, content from that Workspace is sent to the AI providers we use so that an answer or a draft can be generated. Content is sent only for the Workspace it belongs to. A bot answers only from the content given to that bot. It never draws on content given to another bot, even one in the same Workspace, and never on another Workspace's content. We do not use your content to train the general-purpose models of third-party providers.
A visitor chatting with a published bot can remove a conversation from the device they are using. That removes the copy their browser holds and nothing else: the conversation stays in the Workspace's message logs, where the business that runs the bot can read it. A request to remove it from those logs is a request to that business.
Signing in with Google
You may create or sign in to your MindFull account with a Google account. Google then gives us your name, your email address and whether Google has verified it, and the address of your Google profile picture, which we link to rather than copy. We use them to create your account, to recognise you when you sign in again, and to show your name and picture where the Services show who you are. If an account already exists for the same verified email address, signing in with Google becomes another way into that account rather than creating a second one.
We ask Google for nothing else. Signing in gives us no access to your mail, calendar, contacts, or files; those are reached only through the connections described under Connected accounts below, and only when a Workspace chooses to make one. We keep these details for as long as the account exists. You can withdraw our access at any time from your Google Account's permissions page, and you can ask us to delete the account and the details with it as described under Your rights. Information we receive from Google this way is covered by the Limited Use commitments at the end of Connected accounts.
Connected accounts
A Workspace may connect accounts it holds elsewhere so that the Services can work with them. Connecting one is always a choice the Workspace makes, through a sign-in and consent screen that the other provider shows, and it can be undone at any time from the Workspace's settings or from the provider's own account permissions page. When a connection is removed we delete the authorization tokens we held for it.
Mailboxes. A Workspace may connect a Zoho Mail or Gmail mailbox. From the moment it is connected we read the messages that mailbox receives, store them as inquiry conversations in the Workspace, and send the replies the Workspace writes from that same mailbox. A customer's own attachments are not stored; we record only their names and sizes. Files a Workspace member attaches to a reply are stored by us and kept for as long as the inquiry exists. Disconnecting a mailbox deletes the inquiries that arrived through it, except those attached to a booking, which stay with the booking.
WhatsApp. A Workspace may connect a WhatsApp Business number so that customers who write to it on WhatsApp reach the Workspace as inquiries, and so that it can answer them from Backoffice. Meta, which operates WhatsApp, carries every one of these messages between the customer and the business, and handles them under WhatsApp's own terms and privacy policy. The WhatsApp Business Account stays the business's own. With the business's permission:
When a Workspace connects a number, it signs in to Meta in a window Meta shows and chooses which WhatsApp Business Account and number to share. Meta then gives us access to that account and number only, which we store encrypted. We do not receive the Facebook profile, friends, or any other account of the person who connected it.
From the moment a number is connected, Meta delivers us the messages sent to it. We store each one as an inquiry conversation in the Workspace, with the name the sender uses on WhatsApp, the identifier WhatsApp gives them for that business, and their phone number when Meta includes it. Replies written in Backoffice are sent through Meta, and we record whether WhatsApp reports each one as delivered and read.
Where the business still uses the number in the WhatsApp Business app on its phone, Meta also delivers us what the business sends from the phone in a conversation that is already open, and we store it beside the rest.
We do not import chats from before the number was connected. A photo, document, or voice message sent to the number is named on the message, but we do not fetch or store the file; it stays with Meta, which keeps it only for a limited time.
If the business marks a WhatsApp conversation as spam, we delete the inquiry and keep the sender's WhatsApp identifier, with the name and number they had, so that they cannot open another inquiry with that business until it removes the block.
We create message templates, written by us, in the business's WhatsApp Business Account, and send its customers' booking messages through them from its number: the link to the booking agreement, a copy of the signed agreement as a PDF, and updates about approval, payment, and expiry. A booking's messages go on WhatsApp when that is where the customer last wrote to the business, or where they chose when booking online. We record the customer's WhatsApp number as where the agreement link was delivered, which is part of the record of who accepted it. A reply written in Backoffice more than 24 hours after the customer last wrote is sent inside another of our templates, which opens and closes with our wording naming the business and carries the reply as one paragraph.
A customer who books on a business's public page and chooses WhatsApp sends a short reference from their own WhatsApp to the business's number. We use that message to attach the booking to the WhatsApp account that sent it, and remove the contact made from the number typed on the form once nothing else uses it.
WhatsApp messages are kept for as long as the inquiry they belong to. Removing a connected number deletes the inquiries that arrived through it, except those attached to a booking, which stay with the booking. If you wrote to a business on WhatsApp and want your messages deleted from the Services, ask that business, or ask us as described under Your rights.
Google Calendar. A Workspace may connect a Google account so that bookings show in Google Calendar and busy times in Google Calendar are blocked in Backoffice. With your permission:
We create a calendar named Backoffice in the connected account, beside the calendars it already has, and write your bookings, holds, and blocked dates into it as events, including the customer name and the dates of each booking. Those events are kept in sync with the Workspace, so a change you make to one of them in Google is overwritten on the next sync, and deleting one there never cancels or changes anything on the platform.
We read which times are busy on the main calendar of the connected account, and show those times on the Workspace calendar as read-only blocks so that dates already taken elsewhere are not offered to customers. We read only whether a time is busy, never the title, description, or attendees of the event that makes it so, and we read no other calendar in the account.
We store the busy times we read for as long as they remain on your calendar and the connection remains in place, and we store the authorization tokens Google gives us, encrypted, so the connection can be kept without asking you to sign in again.
Disconnecting Google Calendar removes the busy times we imported from Backoffice and stops us reading or writing your Google account. The Backoffice calendar we created, and the events on it, stay in your account as ordinary events, yours to keep or delete.
MindFull's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
We do not use Google user data for advertising.
We do not sell Google user data, and we do not transfer it to anyone except as needed to provide or improve the sign-in, calendar, and mailbox features you use, to comply with the law, or as part of a merger or acquisition with notice to you.
We do not use Google user data to train general-purpose AI models.
No person at MindFull reads it unless you have given permission, it is needed for security or to comply with the law, or it has been aggregated and anonymized for internal operations.
Booking alerts on WhatsApp
A member of a Workspace may choose to hear about the Workspace's bookings on WhatsApp, from MindFull's own number. Linking is separate for each Workspace and is always the member's own choice. If you link yours:
You link your WhatsApp by sending a code shown in Backoffice from your own WhatsApp to MindFull's alerts number. We then keep your WhatsApp number and the identifier WhatsApp gives you, for that Workspace only.
We message that number from MindFull's own WhatsApp account when a customer books online, asks to book, says they have paid, or pays online. Each message names the Workspace, the customer, what was booked and when, and links to the booking in Backoffice. These messages travel through Meta, and MindFull pays for them.
We keep the link until you turn the alerts off in Backoffice, reply STOP in that chat, which turns them off for every Workspace you linked, or leave the Workspace. Anything else you send to that number is answered automatically and not kept.
Public inquiry pages
A Workspace may publish a page on customer.mindfulltechnologies.com presenting what it offers, with photos, a video, and a description, where anyone can send the business an inquiry. It shares the address in posts, bios, or flyers, and the page may appear in search results. The business is responsible for what the page says, including where its links lead, and for what it does with the inquiries it receives. If you send one:
What you write on the form, your name, the email address or phone number you give, and any dates, party size, and message, goes to the business whose page it is, as an inquiry in its Workspace. That business decides how it is answered and how long it is kept.
Before the form is sent, Cloudflare Turnstile checks that a person rather than a script is sending it. It runs in your browser, and Cloudflare receives technical signals from it: your network address, a fingerprint of your browser's secure connection, your browser's user agent, and which page asked for the check. Cloudflare processes these on our behalf to detect and block bots, and on its own behalf to improve that detection, and states that it does not use them to identify, profile, or target anyone. We receive only whether the check passed.
If the page lets you book and you choose to get your agreement on WhatsApp, you send a short reference to the business from your own WhatsApp. Your booking is then attached to that WhatsApp account, and the agreement and updates about the booking are sent to you there, through Meta, as described under Connected accounts above.
To stop automated abuse, we count submissions and questions about prices and dates by network address for a short window, and keep nothing once the window has passed.
A page may show a video the business has on YouTube or Vimeo. Nothing from YouTube or Vimeo loads until you press play. When you do, the video plays from that provider, in YouTube's privacy-enhanced mode or with Vimeo's do-not-track setting, and the provider receives what any visit to its player sends it, under its own privacy policy.
A request to see or remove an inquiry you sent from a public page is a request to the business you sent it to, as described under Your rights.
Visiting our website
Nobody signs in on mindfulltechnologies.com, so what we hold about a visitor is only what they send us:
When you write to us through the contact form, we receive your name, your email address, the subject you chose, and your message. We deliver them to our own inbox, send you an acknowledgement at the address you gave, and record the message as an inquiry in our own Workspace so that we can answer it. We keep it for as long as we need to answer and follow up on it.
To stop automated abuse, the contact form counts submissions by network address for a short window and keeps nothing once the window has passed.
The chat on the website is a Kakapo bot that we run ourselves. What you write to it is handled as any other published bot conversation, as described under AI processing above.
How we share your information
We share information only where it is needed to provide the Services, comply with the law, or protect our rights. This may include:
Service providers who help us run the platform, such as hosting, storage, email delivery, payment processing, the AI model providers that generate answers, and Cloudflare, which checks that a public inquiry page is being sent by a person.
Meta, which carries every message between a WhatsApp number a Workspace connects and the people who write to it, the booking messages we send its customers there, and the booking alerts we send from our own number, as described under Connected accounts and Booking alerts on WhatsApp above.
Law enforcement or regulators where applicable law requires it.
A successor entity in the event of a merger, acquisition, or asset sale.
We do not sell personal information, and we do not share one Workspace's content with another.
Cookies
We use cookies only to keep you signed in and to keep signing in secure. The MindFull account and each product you sign in to set their own, and they end when you sign out or the session expires. We do not currently use cookies for analytics or advertising, and our website sets none. A public inquiry page loads Cloudflare's check, described under Public inquiry pages, which is a security measure rather than analytics or advertising. A video on such a page is loaded from YouTube or Vimeo only when you press play, and what that provider then sets is covered by its own policy. The Backoffice page where a Workspace connects WhatsApp loads Meta's JavaScript SDK, which opens Meta's own sign-in window, and Meta may set or read its own cookies there under its own policy. If we add analytics, we will name the provider and what it collects here, and ask for your consent before setting any cookie that is not needed to sign you in.
A published bot keeps its conversation in the visitor's browser so that it can be continued, as described under AI processing. You can block cookies and clear browser storage in your browser settings, but you will not be able to sign in while cookies are blocked.
Data retention and security
We keep personal information for as long as we need it to provide the Services and to meet our legal obligations. We apply reasonable safeguards to protect it, but no method of transmission or storage is completely secure.
When you delete a bot, its configuration, the content it was given and any files uploaded for it, its API keys, and its conversation history are removed from the platform.
When a Workspace is deleted, access to it ends and it disappears from every product, but its records are archived rather than erased. Nothing deletes them afterwards on a schedule, and we do not promise a period after which they are gone. Bookings, agreements, reviews, and billing history are kept because customers and travelers have an interest in them that outlasts the business that held them, and because the law may require it. A deleted Workspace can be restored by our support team for as long as its records exist. A request to erase records inside a deleted Workspace is handled under Your rights below.
Details a customer gives when accepting a booking agreement, including an identity document number, are kept with the agreement they were given against for as long as the booking record is kept.
Records we keep for our own reasons
Most of what we hold is what you or a Workspace chose to put there. Two kinds of record are made by us, for reasons you did not ask for, and we name them here because they are still about you:
When we decide that an account may no longer open one of our products, we record the category of the decision and a written note explaining it. Neither is shown to the person the decision concerns, but both are personal data about them, and a request to see them is handled as any other access request.
When something in the platform fails, we write a diagnostic record of what failed, on which page, and for which account and Workspace. The record is meant to hold identifiers rather than content, but the text of an error can quote whatever the failing request carried, so a fragment of what you typed or were sent may be held in it.
Diagnostic records are not deleted on a schedule. An administrator removes them in batches by age, and each removal is itself recorded. We cannot remove the diagnostic records of one person on their own, so a deletion request that reaches them is met by the next batch removal covering that period.
Your rights
Depending on where you live, you may have the following rights under the GDPR or comparable law:
The right to access. You can request copies of your personal data.
The right to rectification. You can request that we correct information you believe is inaccurate.
The right to erasure. You can request that we erase your personal data.
The right to restrict processing. You can request that we restrict how we process your personal data.
The right to data portability. You can request that we transfer the data we hold to you or to another organization.
To make a request, email hello@mindfulltechnologies.com or reach us through the contact page. If your request concerns records held inside a Workspace you do not own, we will pass it to the business that does, because that content is theirs rather than ours. If the Workspace has been deleted, we will handle the request ourselves.
Children's privacy
The Services are not intended for children under 13, and we do not knowingly collect personal information from children.
Changes to this policy
We may update this Privacy Policy from time to time. Where a change is material we will post the updated policy on this page, and the date at the top of it will tell you when it last changed.