PRIVACY POLICY

This Privacy Notice for GoMind AI LLC ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://www.gomind.ai or any website of ours that links to this Privacy Notice
• Download and use our mobile application (GoMind AI), or any other application of ours that links to this Privacy Notice
• Use GoMind AI. GoMind AI is an AI-powered productivity app that helps you manage tasks, notes, and daily goals in one place. We collect only the information needed to deliver features like calendar sync, email integration, birthday tracking, and location-based reminders. Your data is never sold to third parties and is protected with industry-standard encryption.
• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at hello@gomind.ai.

Summary of Key Points

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.

Do we process any sensitive personal information? We may process precise geolocation and account login information, which some jurisdictions consider sensitive, only with your consent or as otherwise permitted by applicable law.

Do we collect any information from third parties? Only when you choose to connect them, such as your Google account (Gmail metadata and Google Contacts) or a sign-in provider.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

Do we use Google user data to train AI? No. Google user data is never used to develop, improve, or train generalized or foundational AI/ML models, by us or by any AI service provider we use.

With which parties do we share personal information? We share information only in specific situations and with specific service providers, including our AI service provider (Anthropic) to power AI features you use.

How do we keep your information safe? We have organizational and technical processes in place to protect your personal information. However, no electronic transmission or storage technology can be guaranteed to be 100% secure.

What are your rights? Depending on where you are located, applicable privacy law may give you certain rights regarding your personal information.

How do you exercise your rights? The easiest way is by visiting https://www.gomind.ai/account_deletion, or by contacting us. We will act on any request in accordance with applicable data protection laws.

Table of Contents

1. 1. What information do we collect?
2. 2. How do we process your information?
3. 3. What legal bases do we rely on to process your personal information?
4. 4. When and with whom do we share your personal information?
5. 5. Do we use cookies and other tracking technologies?
6. 6. Do we offer artificial intelligence-based products?
7. 7. How do we handle your social logins?
8. 8. How long do we keep your information?
9. 9. How do we keep your information safe?
10. 10. What are your privacy rights?
11. 11. Controls for Do-Not-Track features
12. 12. Do United States residents have specific privacy rights?
13. 13. Do other regions have specific privacy rights?
14. 14. Do we make updates to this notice?
15. 15. How can you contact us about this notice?
16. 16. How can you review, update, or delete the data we collect from you?

1. What Information Do We Collect?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, participate in activities on the Services, or otherwise contact us.

Personal Information Provided by You. The personal information we collect depends on the context of your interactions with us and the Services, the choices you make, and the features you use. It may include:

• Names
• Email addresses
• Phone numbers

Sensitive Information.

When necessary, with your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information:

• Precise geolocation (for location-based reminders)
• Account login information

Payment Data. We do not collect or store your payment card details. All purchases are processed and stored by the Apple App Store or Google Play Store. Please refer to their privacy notices: https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy.

Sign-In Data. We may allow you to register using an existing account, such as your Google or Apple account. If you do, we receive certain profile information from that provider, as described in "How Do We Handle Your Social Logins?" below.

Google Account Data (Gmail and Contacts)

If you choose to connect your Google account, we access limited Google data solely to power the specific features you enable, and only for your own account. This data is never used to access, infer, or act on any other user's information, and is never sold or used for advertising.

Email integration (Gmail metadata). If you connect Gmail, we access email metadata only, such as sender, subject line, labels, and timestamps. We do not access, read, or store the body, content, or attachments of your emails. This metadata powers our AI email-filtering feature, which surfaces emails that may need your attention alongside your tasks and calendar. If you ask our AI assistant ("AI Mode") about received emails, it can tell you that an email arrived and show its sender and subject line, nothing more. We do not send email on your behalf and do not modify anything in your Gmail account. When you choose to reply to or edit an email, we deep link you to Gmail so the action is completed there, not within our app.

Contacts sync (birthday and anniversary tracker). If you connect Google Contacts, you can tap Sync to import contact names and birthday/anniversary information into your birthday and anniversary tracker. This access is read-only and one-way. We never write to, modify, or sync data back to your Google Contacts. Re-syncing picks up contacts newly added to your Google account since your last sync. If you use AI Mode, contact names and birthday/anniversary dates from your tracker may be processed by our AI service provider solely to answer your questions (for example, reminding you of an upcoming birthday). You can also add birthdays and anniversaries manually without connecting a Google account.

Disconnecting your Google account. You may disconnect your Google account at any time from within the app. When you do, we will ask whether you want to keep or delete the previously synced entries:

• If you keep them, they remain in your tracker as standalone data, are no longer linked to Google, and are not updated by future syncs.
• If you delete them, the synced entries are permanently removed at the time of disconnect.

You may reconnect the same Google account, or connect a different one, at any time.

Data security and Limited Use. Data we access through Google APIs is encrypted in storage and in transit, is used only to power the features described above for your own account, and is never sold or shared for advertising or marketing purposes. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Google user data, including raw, aggregated, anonymized, or derived data, is never used to develop, improve, or train generalized or foundational AI/ML models, by us or by any AI service provider we use.

Application Data

If you use our application, we may also collect the following information if you choose to provide access or permission:

• Geolocation Information. We may request permission to access your device's location, either continuously or while you are using the app, to provide location-based reminders. You can change this in your device's settings.
• Mobile Device Access. We may request access to features of your device or connected accounts, including location services, notifications, reminders, calendar, and, if you choose to connect them, Gmail (metadata only) and Google Contacts (read-only), as described above. You can change this in your device's settings or by disconnecting the account within the app.
• Mobile Device Data. We automatically collect device information such as device ID, model, manufacturer, operating system and version, app version, IP address, mobile carrier, and which app features you use.
• Push Notifications. We may send push notifications about your account or app features. You can turn them off in your device's settings.

This information is primarily needed to maintain the security and operation of our app, for troubleshooting, and for internal analytics and reporting. All personal information you provide must be true, complete, and accurate, and you must notify us of any changes.

Information automatically collected

In Short: Some information, such as your IP address and browser and device characteristics, is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This may include your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and information about how and when you use our Services. We also use cookies and similar technologies, as described in our Cookie Notice.

• Log and Usage Data. Service-related, diagnostic, usage, and performance information, such as your IP address, device information, date/time stamps, features used, and error reports ("crash dumps").
• Device Data. Information about the computer, phone, or tablet you use, such as IP address, device and app identifiers, browser type, hardware model, carrier, and operating system.
• Location Data. Your device's precise or approximate location, based on GPS or your IP address, depending on your device settings. You can opt out by refusing or disabling location access, though some features may not work.

2. How Do We Process Your Information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes only with your prior explicit consent.

• To facilitate account creation and authentication and otherwise manage user accounts.
• To deliver services to you, including AI features, email filtering, calendar sync, birthday tracking, and location-based reminders.
• To respond to user inquiries and offer support.
• To request feedback and contact you about your use of our Services.
• To protect our Services, including fraud monitoring and prevention.
• To identify usage trends so we can improve our Services. Google user data is never used for this purpose beyond what is needed to operate the features you use.
• To save or protect an individual's vital interest, such as to prevent harm.

3. What Legal Bases Do We Rely On to Process Your Personal Information?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law.

If you are located in the EU or UK, we may rely on the following legal bases under the GDPR and UK GDPR:

• Consent. You have given us permission to use your personal information for a specific purpose, such as connecting your Google account. You can withdraw your consent at any time.
• Performance of a Contract. Processing is necessary to provide our Services or to take steps at your request before entering into a contract with you.
• Legitimate Interests. Processing is reasonably necessary for our legitimate business interests, such as analyzing how our Services are used, diagnosing problems, preventing fraud, and improving user experience, where those interests do not outweigh your rights and freedoms.
• Legal Obligations. Processing is necessary to comply with the law, cooperate with law enforcement or regulators, or exercise or defend our legal rights.
• Vital Interests. Processing is necessary to protect your vital interests or those of a third party.

If you are located in Canada, we may process your information with your express or implied consent, which you may withdraw at any time. In exceptional cases, applicable law may permit us to process your information without consent, for example:

• If collection is clearly in an individual's interests and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions, provided certain conditions are met
• For identifying injured, ill, or deceased persons and communicating with next of kin
• If we have reasonable grounds to believe an individual has been, is, or may be a victim of financial abuse
• If disclosure is required to comply with a subpoena, warrant, court order, or court rules
• If the information is publicly available and is specified by the regulations

4. When and With Whom Do We Share Your Personal Information?

In Short: We share information only in the specific situations described in this section and with the following service providers.

• AI Service Providers. We share limited information with Anthropic, PBC solely to provide AI features you use. Where relevant, this includes Gmail metadata (sender, subject line, labels, timestamps, never email content) and contact names and birthday/anniversary dates. Anthropic acts as our service provider and, under its Commercial Terms of Service, may not use this data to train its models. See "Do We Offer Artificial Intelligence-Based Products?" below.
• Google Maps Platform APIs. We may share your location with Google Maps Platform APIs (such as the Maps API and Places API) to provide location-based features. Your location is cached on your device. You may revoke your consent at any time by contacting us.
• Analytics Providers. We use Google Analytics to understand how our Services are used. See "Do We Use Cookies and Other Tracking Technologies?" below.
• Business Transfers. We may share or transfer your information in connection with any merger, sale of company assets, financing, or acquisition of all or part of our business.

We do not sell, rent, or share Google user data (including Gmail metadata or Google Contacts data) with third parties for advertising, marketing, or any purpose unrelated to providing the features described in this Privacy Notice.

5. Do We Use Cookies and Other Tracking Technologies?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar technologies (like web beacons and pixels) when you interact with our Services. These help us maintain security, prevent crashes, fix bugs, save your preferences, and support basic site functions and analytics.

Google user data obtained through Google APIs (including Gmail metadata and Google Contacts data) is never used for advertising or ad targeting, and is never shared with advertising or analytics partners.

Details about how we use these technologies and how you can refuse certain cookies are in our Cookie Notice.

Google Analytics

We may share usage information with Google Analytics to analyze how the Services are used. To opt out, visit https://tools.google.com/dlpage/gaoptout. For more on Google's privacy practices, see the Google Privacy & Terms page.

6. Do We Offer Artificial Intelligence-Based Products?

In Short: Yes. We offer features powered by artificial intelligence, provided through Anthropic.

As part of our Services, we offer products, features, or tools powered by artificial intelligence ("AI Products"). The terms in this Privacy Notice govern your use of the AI Products.

Use of AI Technologies

We provide the AI Products through a third-party AI service provider, Anthropic, PBC (Claude models), accessed directly through Anthropic's commercial API. We do not use any other AI service provider, aggregator, or model gateway. Your inputs, outputs, and the limited personal information needed to answer your request are processed by Anthropic solely to generate a response for you. Under Anthropic's Commercial Terms of Service, Anthropic may not use this data to train its models, and it deletes API inputs and outputs within 30 days. You must not use the AI Products in any way that violates Anthropic's terms or policies.

Our AI Products are designed for the following functions:

• AI bots
• AI tasks
• AI filtered emails
• Summarize with AI
• Format with AI
• AI prioritization
• AI suggestions

Google user data and AI

AI filtered emails and AI Mode use Gmail metadata only (sender, subject line, labels, timestamps), never email bodies or attachments. AI Mode may also use contact names and birthday/anniversary dates from your tracker to answer your questions. AI Mode has read-only access and cannot send, modify, or delete anything in your Gmail or Google Contacts. Google user data, including raw, aggregated, anonymized, or derived data, is never used to develop, improve, or train generalized or foundational AI/ML models, by us or by Anthropic.

How We Process Your Data Using AI

All personal information processed by our AI Products is handled in line with this Privacy Notice and our agreement with Anthropic.

How to Opt Out

You can:

• Choose not to use AI features, or disconnect your Google account from within the app
• Update your preferences in your account settings
• Delete your account, which permanently deletes your information
• Contact us using the contact information provided

7. How Do We Handle Your Social Logins?

In Short: If you sign in using a third-party account, we may receive certain information about you.

Our Services let you register and log in using a third-party account, such as your Google or Apple account. When you do, we receive certain profile information from that provider, typically your name, email address, and profile picture.

We use this information only for the purposes described in this Privacy Notice or otherwise made clear to you. We do not control, and are not responsible for, other uses of your personal information by your sign-in provider. Please review their privacy notice to understand how they handle your information.

8. How Long Do We Keep Your Information?

In Short: We keep your information for as long as necessary to fulfill the purposes in this Privacy Notice unless otherwise required by law.

We keep your personal information only as long as necessary for the purposes in this Privacy Notice, unless a longer period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice requires us to keep your personal information longer than you have an account with us.

• Google Contacts data is kept until you choose to delete it when disconnecting (see "Google Account Data" above) or until you delete your account, whichever comes first.
• Gmail metadata is processed to power the email-filtering feature and is not kept beyond what is needed to display current suggestions in your workspace. It is deleted when you disconnect Gmail or delete your account.
• AI requests sent to Anthropic are deleted by Anthropic within 30 days, under its standard commercial terms.

When we have no ongoing legitimate business need to process your personal information, we delete or anonymize it. If that is not possible (for example, because it is in backup archives), we securely store it and isolate it from further processing until deletion is possible.

9. How Do We Keep Your Information Safe?

In Short: We aim to protect your personal information through organizational and technical security measures.

We have implemented appropriate technical and organizational security measures to protect the personal information we process, including data accessed through Google APIs, which is encrypted in transit and at rest. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. We cannot promise that unauthorized third parties will never be able to defeat our security. Transmission of personal information to and from our Services is at your own risk, and you should access the Services only in a secure environment.

10. What Are Your Privacy Rights?

In Short: Depending on where you live, such as certain US states, the EEA, UK, Switzerland, or Canada, you may have rights that give you greater access to and control over your personal information.

In some regions (like the EEA, UK, Switzerland, and Canada), you may have the right to: (i) access and obtain a copy of your personal information; (ii) request rectification or erasure; (iii) restrict processing; (iv) data portability, where applicable; and (v) not be subject to automated decision-making. If a decision with legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. You may also have the right to object to processing. To make a request, contact us using the details in "How Can You Contact Us About This Notice?"

If you are in the EEA or UK and believe we are unlawfully processing your personal information, you may complain to your Member State or UK data protection authority. If you are in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent. Where we rely on your consent, you may withdraw it at any time by contacting us or updating your preferences. For Google account access, you can withdraw consent immediately by disconnecting your Google account within the app, or by removing GoMind AI's access at https://myaccount.google.com/permissions. Withdrawal does not affect the lawfulness of processing before it, or processing based on other lawful grounds.

Account Information

To review or change your account information or terminate your account, you can:

• Log in to your account settings and update your account
• Delete your account from settings to permanently delete all information
• Contact us using the contact information provided

When you request account termination, we will deactivate or delete your account and information from our active databases. We may retain some information to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, or comply with legal requirements.

If you have questions about your privacy rights, email us at hello@gomind.ai.

11. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") setting. No uniform technology standard for recognizing DNT signals has been finalized, so we do not currently respond to DNT signals. If a standard is adopted that we must follow, we will describe it in a revised version of this Privacy Notice. California law requires us to disclose how we respond to DNT signals; because there is no industry or legal standard for them, we do not respond to them at this time.

12. Do United States Residents Have Specific Privacy Rights?

In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to access, correct, get a copy of, or delete your personal information, and to withdraw your consent to processing. These rights may be limited in some circumstances by applicable law.

Categories of Personal Information We Collect

The table below shows the categories of personal information we have collected in the past twelve (12) months. For a full description, see "What Information Do We Collect?"

We collect sensitive personal information only as permitted by law or with your consent. We do not collect or process sensitive personal information to infer characteristics about you. You may have the right to limit its use or disclosure.

We may also collect personal information when you contact customer support, take part in surveys, or otherwise interact with us. We keep personal information as needed to provide the Services, and Category L for as long as you have an account with us.

Sources, Use, and Sharing

We collect personal information from you directly, automatically from your device, and from accounts you choose to connect (such as Google). See "What Information Do We Collect?" and "How Do We Process Your Information?" for details.

We disclose personal information to our service providers (such as Anthropic, Google Maps Platform, and Google Analytics) under written contracts, as described in "When and With Whom Do We Share Your Personal Information?" We may use your personal information for internal research and development of our Services; Google user data is never used for this purpose. This is not considered a "sale" of personal information.

We have not sold or shared personal information for cross-context behavioral advertising in the preceding twelve (12) months, and we will not do so in the future.

Your Rights

You have rights under certain US state data protection laws. These rights are not absolute, and we may decline a request as permitted by law. They include the right to:

• Know whether we are processing your personal data
• Access your personal data
• Correct inaccuracies in your personal data
• Request deletion of your personal data
• Obtain a copy of the personal data you previously shared with us
• Non-discrimination for exercising your rights
• Opt out of processing for targeted advertising, sale of personal data, or profiling in furtherance of decisions with legal or similarly significant effects

Depending on your state, you may also have the right to:

• Access the categories of personal data being processed (for example, Minnesota)
• Obtain a list of the categories of third parties to which we have disclosed personal data (for example, California, Delaware, and Maryland)
• Obtain a list of specific third parties to which we have disclosed personal data (for example, Minnesota and Oregon)
• Obtain a list of third parties to which we have sold personal data (for example, Connecticut)
• Review, understand, question, and correct how personal data has been profiled (for example, Connecticut and Minnesota)
• Limit use and disclosure of sensitive personal data (for example, California)
• Opt out of collection of sensitive data and data collected through voice or facial recognition (for example, Florida)

How to Exercise Your Rights

Visit https://www.gomind.ai/account_deletion, email us at hello@gomind.ai, or use the contact details at the end of this notice. You may designate an authorized agent to make a request on your behalf; we may deny a request from an agent who cannot prove they are validly authorized.

Request Verification

We will verify your identity before acting on your request, using only the information you provide for that purpose. If needed, we may ask for additional information to verify your identity and prevent fraud. Authorized agents must provide written, signed permission from you.

Appeals

If we decline to act on your request, you may appeal by emailing hello@gomind.ai. We will respond in writing with our decision and reasons. If your appeal is denied, you may file a complaint with your state attorney general.

California "Shine The Light" Law

California Civil Code Section 1798.83 lets California residents request, once a year and free of charge, information about personal information we disclosed to third parties for direct marketing purposes in the preceding calendar year. We do not disclose personal information for third parties' direct marketing. To make a request, contact us using the details below.

13. Do Other Regions Have Specific Privacy Rights?

In Short: You may have additional rights based on the country you reside in.

Australia and New Zealand

We collect and process your personal information under Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020. This Privacy Notice satisfies the notice requirements of both Acts, including what personal information we collect, from which sources, for which purposes, and who receives it.

If you do not provide the personal information needed for a purpose, we may not be able to offer the products or services you want, respond to your requests, manage your account, or confirm your identity and protect your account.

You may request access to or correction of your personal information at any time using the details in "How Can You Review, Update, or Delete the Data We Collect From You?" If you believe we are unlawfully processing your personal information, you may complain to the Office of the Australian Information Commissioner or the Office of the New Zealand Privacy Commissioner.

Republic of South Africa

You may request access to or correction of your personal information at any time using the details in "How Can You Review, Update, or Delete the Data We Collect From You?" If you are unsatisfied with how we address a complaint, you can contact the Information Regulator (South Africa):

• General enquiries: enquiries@inforegulator.org.za
• Complaints (complete POPIA/PAIA form 5): PAIAComplaints@inforegulator.org.za and POPIAComplaints@inforegulator.org.za

14. Do We Make Updates to This Notice?

In Short: Yes, we update this notice as needed to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by the "Last updated" date at the top. If we make material changes, we may notify you by prominently posting a notice or by sending you a notification directly. We encourage you to review this Privacy Notice regularly.

15. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, email us at hello@gomind.ai or write to us at:

16. How Can You Review, Update, or Delete the Data We Collect From You?

You have the right to request access to the personal information we collect from you, details about how we have processed it, correction of inaccuracies, or deletion of your personal information. You may also have the right to withdraw your consent to our processing. These rights may be limited by applicable law. To review, update, or delete your personal information, visit https://www.gomind.ai/account_deletion.