Privacy Policy

Last updated: 10 September 2026

This Privacy Policy explains how MindStack (“MindStack”, “we”, “us”, or “our”) collects, uses, and protects your personal data when you visit mindstack.cloud or get in touch with us. We are based in St. Julian’s, Malta, and we process personal data in line with the EU General Data Protection Regulation (GDPR) and the Maltese Data Protection Act.

1. Who we are

MindStack is an AI software studio based in St. Julian’s, Malta. For any privacy-related question or request, you can reach us at hello@mindstack.cloud. MindStack acts as the data controller for the personal data described in this policy.

2. What data we collect

• Information you give us — when you book a call or contact us, we collect your name, email address, and any optional details you provide such as company, phone number, the service you’re interested in, and the message you send.
• Booking and enquiry data — your requested availability, service interest, and message. We use these details to respond and arrange a call; submitting the form does not automatically create a calendar event.
• AI chat data — the messages you choose to send to the MindStack AI assistant and the assistant’s replies. Please do not include confidential, special-category, or otherwise sensitive personal data.
• Technical and usage data — basic information such as your IP address, browser type, and how you interact with the site, collected through cookies and similar technologies (see our Cookie Policy).

3. How we use your data

• To respond to your enquiries and schedule and manage calls.
• To provide, operate, and improve our services and website.
• To send you booking confirmations, invites, and related service communications.
• To provide requested responses through our AI assistant.
• To keep the site secure and prevent abuse.

4. Legal basis for processing

We process enquiries and booking requests to take steps at your request before entering a contract. We process AI chat messages because you expressly request that service. We rely on our legitimate interests to operate and secure the Site, prevent abuse, and respond efficiently, after balancing those interests against your rights. Where a non-essential browser technology requires consent, we rely on consent and you may withdraw it at any time.

5. Who we share it with

We do not sell your personal data. We share it only with trusted service providers who help us run the site and our services, including:

• Netlify — website hosting and serverless functions.
• Anthropic — processing AI-assistant messages through the commercial Claude API.
• Resend — delivering booking and enquiry emails.
• Google — delivering the web fonts used by the Site, which may involve receiving technical data such as your IP address and browser information.

These providers process data on our behalf under appropriate agreements. We may also disclose data where required by law.

6. International transfers

Some providers process data in the United States or elsewhere outside the European Economic Area. Where required, we use the transfer safeguards made available under our provider agreements, such as the European Commission’s Standard Contractual Clauses. You may contact us for more information about applicable safeguards.

7. Data retention

Enquiry and booking information is normally retained for up to 24 months after our last interaction, unless it becomes part of a client relationship or must be kept longer for legal, tax, or dispute-resolution purposes. We do not intentionally save AI-chat conversations after the active browser session. Anthropic’s standard commercial API service may retain inputs and outputs for up to 30 days, subject to its contractual exceptions. Security and infrastructure logs are kept only for the period reasonably required to operate and protect the Site.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request erasure of your data;
• restrict or object to processing;
• data portability;
• withdraw consent at any time; and
• lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) in Malta.

To exercise any of these rights, email us at hello@mindstack.cloud.

9. Automated decision-making

The AI assistant provides general information and project guidance. It does not make decisions that produce legal or similarly significant effects about you. You can always contact a person at the email address below.

10. Security

We use appropriate technical and organisational measures to protect your data against unauthorised access, loss, or misuse. No method of transmission over the internet is completely secure, but we work to keep your data safe.

11. Changes to this policy

We may update this Privacy Policy from time to time. The “last updated” date at the top reflects the most recent revision. Significant changes will be highlighted on this page.

12. Contact us

For any questions about this policy or how we handle your data, contact us at hello@mindstack.cloud.