Privacy Notice

1. Who we are. MindForge is operated by Kimberley Williams, trading as MindForge ("we", "us"). We are the data controller for personal data processed about you in connection with the Service.

2. Personal data we collect.

• Account data: name, email address, password (hashed), country, parish/state/region.
• Profile data: avatar, display preferences, study settings.
• User content: documents, notes, chats, quizzes, flashcards, and other material you upload or generate.
• Support data: messages you send via the in-app Support inbox.
• Usage and telemetry: pages viewed, features used, study streaks, quiz scores, error reports.
• Device and technical data: IP address, browser type, device identifiers, cookies and similar identifiers.
• Billing data: we do not store full payment card details. Paddle, our Merchant of Record, collects and processes payment data directly.

3. Purposes and legal bases.

• Provide and operate the Service, including authentication, file processing, and AI-generated study materials — performance of a contract.
• Process subscriptions, billing, tax, and invoices via Paddle — performance of a contract / legal obligation.
• Detect, prevent, and respond to fraud, abuse, and security incidents — legitimate interests.
• Improve product quality, reliability, and features — legitimate interests.
• Respond to support requests — performance of a contract / legitimate interests.
• Send transactional emails (account, billing, security) — performance of a contract.
• Send marketing communications, where permitted — consent, which you can withdraw at any time.
• Comply with legal obligations — legal obligation.

4. AI processing. When you ask MindForge to generate summaries, quizzes, or chat responses, the relevant portions of your content and prompt are sent to our AI providers for processing. Providers act as processors on our behalf and are contractually restricted from using your content to train their models other than as needed to deliver the response to you.

5. Sharing of personal data. We share personal data only with:

• Paddle — our Merchant of Record, for subscription management, payments, tax compliance, invoicing, and refund handling.
• Hosting, database, storage, and analytics providers that operate the Service infrastructure.
• AI providers that process your prompts and content to generate outputs.
• Email delivery and customer support tooling.
• Professional advisers (legal, accounting) where reasonably necessary.
• Authorities, regulators, or law enforcement where required by law.

6. International transfers. Personal data may be processed in countries other than your own. Where data is transferred outside your jurisdiction, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

7. Retention. We keep personal data for as long as your account is active and for a reasonable period afterwards to comply with legal obligations, resolve disputes, and enforce agreements. When your account is deleted, your personal content is deleted or anonymised within 30 days, subject to legal hold requirements. Billing records held by Paddle are retained per Paddle's policy and applicable tax law.

8. Your rights. Depending on your jurisdiction, you may have rights to: access, rectify, erase, restrict, or object to processing of your personal data; data portability; withdraw consent; and lodge a complaint with a supervisory authority. To exercise these rights, contact us via the in-app Support page. We will respond within the timeframes required by applicable law (in the EU/UK, within one month).

9. Security. We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, row-level security on database tables, and audit logging. No system is completely secure; you are responsible for keeping your credentials confidential.

10. Cookies. We use essential cookies necessary for authentication and to operate the Service, and limited analytics cookies to understand product usage. You can manage non-essential cookies through your browser settings. Paddle may set additional cookies during checkout.

11. Children. The Service is not directed to children under 13 (or the local digital-consent age). If you believe a child has provided us personal data, contact support and we will delete it.

12. Changes to this Notice. We may update this Notice from time to time. Material changes will be notified in-app or by email.

13. Contact. Questions about this Notice or our data practices can be submitted via the in-app Support page.