Privacy Policy — Mindknot

This Privacy Policy explains how Mindknot Labs ("Mindknot", "we", "us", or "our") collects, uses, discloses, and protects your personal data when you use the Mindknot mobile application and website (the "Service").

We are an India-based entity operating from Gurugram, Haryana. This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

1. Data Fiduciary

For the purposes of the DPDP Act, Mindknot Labs is the Data Fiduciary. You are the Data Principal.

2. Personal data we collect

Account data: name, email, authentication identifiers.
Content you provide: voice recordings, transcripts, typed entries, tasks, journals, and mood data ("Spills").
Usage data: device type, OS version, app interactions, crash logs, IP address, approximate location derived from IP.
Payment data: processed by Apple, Google, or our payment processor. We do not store card details.

3. Purposes and lawful basis

We process your personal data on the basis of your consent and for the following legitimate uses under Section 7 of the DPDP Act:

To provide the Service (transcription, sorting, storage of Spills).
To maintain your account and respond to support requests.
To improve reliability, prevent abuse, and ensure security.
To comply with applicable Indian law and lawful requests.

4. AI processing

Spills are processed by third-party AI service providers solely to transcribe audio and generate tasks, mood reads, and journal entries. Providers act as Data Processors under written contracts. Your content is not used to train any third-party model.

5. Sharing and transfers

We share personal data only with: (a) processors who help operate the Service (hosting, AI, analytics, payments); (b) authorities where required by Indian law; (c) successors in the event of a corporate transaction. Cross-border transfers are made only to jurisdictions not restricted by the Central Government under Section 16 of the DPDP Act.

6. Retention

Free-tier voice recordings are deleted automatically after 7 days.
Transcripts, tasks, mood, and journal entries are retained while your account is active.
On account deletion, personal data is erased within 30 days, except where retention is required by law.

7. Your rights as a Data Principal

Under the DPDP Act you have the right to:

Access a summary of your personal data and processing activities.
Correct, complete, update, or erase your personal data.
Withdraw consent at any time.
Nominate another individual to exercise rights in case of death or incapacity.
Grievance redressal through the Grievance Officer named below, and thereafter approach the Data Protection Board of India.

To exercise rights, email privacy@mindknot.app or use the in-app Export and Delete options.

8. Security

We follow reasonable security practices aligned with ISO/IEC 27001 controls as contemplated by Rule 8 of the IT (SPDI) Rules, 2011, including encryption in transit and at rest, role-based access, and audit logging.

9. Children

Mindknot is not directed to individuals under 18. We do not knowingly process the personal data of a child without verifiable consent of a parent or lawful guardian, as required by Section 9 of the DPDP Act.

10. Grievance Officer (India)

In accordance with the IT Act, 2000 and Rule 3(2) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:

Grievance Officer
Mindknot Labs
Gurugram, Haryana, India
Email: grievance@mindknot.app

We acknowledge grievances within 24 hours and resolve them within 15 days.

11. Changes

We may update this Policy. Material changes will be notified in-app or by email. Continued use after the effective date constitutes acceptance.

12. Governing law

This Policy is governed by the laws of India. Courts at Gurugram, Haryana shall have exclusive jurisdiction.