MindBreak AI Consulting – Privacy Policy

Effective Date: July 11, 2025
Last Updated: July 11, 2025

1. Introduction

MindBreak AI Consulting (“MindBreak AI,” “we,” “our,” or “us”) is an AI-first consulting firm that designs, builds, and operates AI agents, automations, and related software solutions for clients worldwide. Protecting your privacy and the security of your information are core to our values of transparency and responsible AI. This Privacy Policy explains how we collect, use, share, and safeguard personal data when you:

• visit mindbreak.ai or any site we operate (the “Site”);
• engage us for advisory or technical services;
• use our internal or client-facing AI agents, SaaS dashboards, or APIs; or
• otherwise interact with us online or offline.

This Policy applies to all personal data we process unless a separate contract or notice (e.g., a Data Processing Agreement) states otherwise.

2. Key Definitions

3. What Data We Collect

We do not intentionally collect data from children under 16.

4. How We Collect Data

• Direct interactions – forms, email, phone, contracts, in-person events.
• Automated means – cookies, pixel tags, server logs, telemetry from our SaaS dashboards.
• Third-party sources – LinkedIn, public databases, marketing partners, or your authorized integrations (e.g., Google Drive).
• Generated data – analytics summaries, model embeddings, and usage statistics derived from your interactions.

5. Legal Bases / Purposes for Processing

We do not use your personal data for fully-automated decision-making that produces legal or similarly significant effects without human review.

6. How We Use Data

• Deliver services – design, deploy, and maintain AI solutions per statement of work.
• Operate AI agents – route prompts and content to third-party LLM APIs under strict contractual confidentiality.
• Enhance products – aggregate, de-identify usage metrics to improve accuracy and performance.
• Protect security – detect fraud, monitor abuse, and enforce our Terms.
• Marketing & thought leadership – send industry insights, product updates, and event invites (you may opt-out at any time).

7. Sharing & Disclosure

We never sell personal information as defined by the California Consumer Privacy Act (CCPA) and similar state laws. We share data only:

8. Cookies & Tracking Technologies

We use:

• Essential cookies – site functionality and security.
• Analytics cookies – traffic measurement via Plausible or Google Analytics (IP-masked).
• Marketing pixels – LinkedIn Insight Tag (only on marketing pages).

Cookie banners give you granular control where required by EU, UK, and state laws.

9. Data Retention

We keep personal data only as long as necessary:

• Contracts & billing: 7 years (tax/audit).
• AI prompt & log data: 90 days by default, configurable per client.
• Marketing contacts: until you unsubscribe or two years of inactivity.
• Back-ups: erased within 30 days of scheduled deletion.

10. Security Measures

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Role-based access controls and MFA for all staff.
• Annual penetration tests and continuous vulnerability scans.
• Documented incident-response plan & 72-hour breach-notification commitment (GDPR Art. 33).

11. International Transfers

We are headquartered in Florida, USA. If we transfer personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to third countries:

• We rely on EU Standard Contractual Clauses (SCCs) and the UK Addendum.
• We implement supplementary safeguards (encryption, pseudonymization).
• Data may be stored in US-based AWS or GCP regions.

12. Your Privacy Rights

To exercise any right, email privacy@mindbreak.ai (subject: “Privacy Request”) or use our self-service portal. We will verify your identity and respond within the timeframe required by law.

13. Automated AI Disclosures

When you send content to our agents, it may be processed by third-party LLMs hosted in the US or EU. We:

• pass only the minimal data required to fulfil your request;
• disable data-logging or model-training flags where offered;
• maintain Data Processing Agreements and audit sub-processors annually.

14. Children’s Privacy

Our services are not directed to children under 16. If we learn we have collected personal data from a child without verifiable parental consent, we will delete it promptly.

15. Changes to This Policy

We may update this Policy to reflect legal, technical, or business changes. We will post the revised version and update the “Last Updated” date. Material changes will be announced via email or in-app notice at least 15 days before they take effect.

16. Contact Us

If you have unresolved concerns, you may lodge a complaint with your local data-protection authority (for EEA/UK residents) or the California Privacy Protection Agency.