Privacy Policy.

This Privacy Policy explains how MindHYVE.ai, Inc. (“MindHYVE,” “we,” “us”) handles personal data when you use our websites and products. It applies across our product lines (ArthurAI™, ChironAI™, JustineAI™, TheoAI™). Where a product processes regulated data, a product-specific notice or data-protection agreement supplements this Policy.

1. Data we collect

• Account data — name, email, organization, and authentication identifiers (via Microsoft Entra ID).
• Payment data — billing details processed by our payment processor, Stripe, Inc. We do not store full card numbers; Stripe handles card data under PCI-DSS.
• Usage data — logs, device and diagnostic information used to operate and secure the Services.
• Customer Content — the prompts, documents, and data you submit to the Services, which may include regulated data depending on the product.

2. How we use data

• Provide, operate, secure, and improve the Services.
• Process payments, manage subscriptions, and prevent fraud.
• Provide support and send service-related communications.
• Comply with legal obligations and enforce our terms.

We do not sell personal data. We do not use Customer Content to train shared foundation models without a lawful basis and, where required, your explicit consent.

3. Legal bases (GDPR)

Where the GDPR applies, we rely on performance of a contract, our legitimate interests in operating and securing the Services, your consent (where required), and compliance with legal obligations.

4. How we share data

We share personal data only with:

• Infrastructure providers — Microsoft Azure (Eve-Grid™) for hosting, storage, identity (Entra ID), and security.
• Payment processor — Stripe, Inc. for billing and fraud prevention.
• Legal and safety — where required by law or to protect rights and safety.

We do not permit subprocessors to use your data for their own purposes. A current subprocessor list is available on request.

5. Regulated data

Some products process data subject to specific laws. Where ChironAI™ processes Protected Health Information, we act as a Business Associate under HIPAA and a Business Associate Agreement governs that processing. Where ArthurAI™ processes student records, we handle them consistent with FERPA. We do not knowingly collect data from children under 13 without verifiable parental consent (COPPA).

6. Data residency and security

Data is encrypted in transit and at rest. Regulated data is kept in the appropriate region — ChironAI™ PHI remains in United States regions. We apply zero-trust access controls, Azure-managed (or customer-managed, for PHI) encryption keys, and audit logging via Azure Monitor.

7. Retention

We retain personal data only as long as needed for the purposes above or as required by law, after which it is deleted or de-identified. Each data store has a defined retention period or lifecycle policy.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to withdraw consent. California residents have rights under the CCPA/CPRA, including the right to know and to delete, and we do not sell or share personal data as defined by that law. To exercise a right, contact us below.

9. International transfers

We operate from the United States with regional operations in Pakistan and Kenya. Where we transfer personal data internationally, we use appropriate safeguards such as Standard Contractual Clauses.

10. Cookies and analytics

Our public websites use first-party cookies and similar technologies to operate the site and to understand how it is used. We use Microsoft Clarity, which records anonymized session interactions and heatmaps using first-party cookies, and Microsoft Azure Application Insights for performance and error diagnostics. We disable cross-advertising identity syncing, do not use third-party advertising trackers, and do not sell personal data. Where consent is legally required for non-essential analytics, we honor it, and you can block or delete cookies through your browser settings.

11. Asking Eve on our websites

Eve, our Digital Employee, answers questions in a panel on this site and on our product sites. That conversation is not kept: it exists for the length of your visit, we hold no profile or history of you, and we do not use it to recognize you later. We apply short-lived request counters, keyed to your network address and to the current conversation, to keep the service available — they hold a number and an expiry, not your questions.

Eve will only pass your details to our team if you ask her to. She tells you what she is collecting and who receives it, asks for your permission first, and records the words you agreed to alongside the resulting record, so the basis for holding it is visible to us and to you. She asks for a name and an email; anything else is collected only if you offer it in answer to that request. You can decline and still get every answer she has. To have a record removed, contact us using section 14 below.

12. Eve connectors

Eve connectors let members of the MindHYVE team link their own LinkedIn, Facebook, or Instagram accounts, and the company pages and business accounts they administer, to Eve inside our staff application. Eve can then prepare posts and, after the person confirms each one, publish it for them. This section applies to that feature, to the team members who use it, and to people whose activity on those platforms it touches, such as someone who comments on a post. It supplements the rest of this Policy. On each platform’s sign-in screen the application appears under the name “MindHYVE.ai”.

What we access. Only what the person connecting grants on the platform’s consent screen. Depending on the platform and what is granted, this can include:

• the person’s basic profile (name, profile photo, and the platform’s identifier for them);
• the list of company pages, Facebook Pages, or Instagram business accounts they administer;
• permission to publish, edit, and delete posts, and to post and manage comments, on those accounts;
• comments and reactions on those posts, the public profile details of the people who made them, and engagement statistics for the posts and pages; and
• for Facebook Pages and Instagram business accounts only, and only where the platform permits, messages sent to that Page or account.

We do not access personal Facebook timelines or personal Facebook messages, personal (non-business) Instagram accounts, or LinkedIn messages. Those platforms do not make that data available to applications such as ours.

How we use it. To draft posts and publish the ones the person has confirmed; to show comments and engagement so the person can respond; to prepare engagement summaries for the person and, for company pages, for that page’s administrators; and to check drafts against our content rules before they are published. Nothing is published, scheduled, edited, or deleted on a platform until the person (or, for a company page, a page administrator) confirms it on screen. Eve may use the drafts and edits a person makes in Eve to suggest future posts in that person’s style, and may use aggregate engagement counts to improve suggestions.

We do not use data obtained from these platforms for advertising, sales prospecting, or recruiting; we do not combine it with other data to build profiles of the people who interact with posts; we do not sell it; and we do not use it to train AI models.

Storage and security. Access credentials issued by a platform are stored in Microsoft Azure Key Vault, encrypted, in a vault used only for this feature. Access is limited to the Eve service, through its managed identity, and to a named company administrator. They are not written to application databases or logs. Content retrieved from a platform is kept no longer than that platform’s terms permit; for example, comments and other members’ activity retrieved from LinkedIn are kept for no more than 48 hours, and the profile details of people who comment are cached for no more than 24 hours.

Administrator visibility. MindHYVE administrators can see every post made through Eve: the account it was posted to, its text and media, when it was published, who confirmed it, and the result. Eve tells team members this before they connect an account.

Disconnecting and deletion. A team member can disconnect an account in Eve at any time. When an account is disconnected, or when the team member leaves MindHYVE, we delete the stored access credentials and purge them from Key Vault’s recovery store, cancel any scheduled posts for that account, and delete the data we retrieved from the platform for it. If a purge does not complete, Key Vault keeps the deleted credential in a deleted but recoverable state for no more than 7 days and then removes it permanently. We keep the record of posts already published through Eve as a company business record. A person can also remove the “MindHYVE.ai” application from their platform account settings (on Facebook, under Settings & privacy, then Apps and websites); when a platform notifies us of a deletion request, we delete that person’s data and give them a confirmation code and a page where they can check the status of the request.

Anyone, including a person who interacted with a post but does not use Eve, can ask us to delete data we hold about them from these platforms by writing to hello@mindhyve.ai with the subject “Eve connectors data deletion” and the platform and account name concerned. We will confirm receipt and complete the request within 30 days.

13. Changes

We may update this Policy. Material changes will be posted here with a new effective date.

14. Contact

For privacy questions or to exercise a right, contact hello@mindhyve.ai or write to MindHYVE.ai, Inc., 1501 Quail St, Suite 130, Newport Beach, CA 92660, USA. See also our Terms of Service.