Privacy Policy

We collect: email address, display name (provided by you), authentication provider data, research session data (AI interactions you choose to save), subscription and payment metadata, and anonymized usage analytics. We do not collect sensitive personal data beyond what is necessary for platform functionality.

Your data is used to: authenticate your account, provide AI copilot services, track your research project progress across Minds, process payments, and improve platform performance. We do not sell your data to third parties.

Research data you enter into AI copilots is processed by Google Vertex AI to generate responses. Your research data is not used to train AI models. Session data is stored in your personal Firestore document and is accessible only to you.

Data is encrypted in transit (TLS) and at rest (Google Cloud, Google-managed keys). Authentication uses Firebase Auth with industry-standard security. We implement session timeouts, cross-tab logout, and device fingerprinting for account protection. Specific region and retention details will be published after the Phase 0 infrastructure audit completes.

Account data is retained for the duration of your account. Research sessions are retained until you delete them. Payment records are retained as required by Indian tax law. Upon account deletion, personal data is removed within 30 days.

You have the right to: access your data, request correction, request deletion, and export your data. To exercise these rights, contact privacy@rsminds.com or visit our Data Rights portal.

We use essential cookies for authentication and session management. The exact cookie inventory will be finalized after the Phase 0 cookie audit. We do not use third-party advertising cookies.

Data is processed on Google Cloud Platform. Primary Firestore region is currently us-central1 (United States). Vertex AI calls route via Google's global endpoint. We are evaluating migration to asia-south1 (Mumbai)for Indian users in Phase 2. Google Cloud's standard data processing agreements apply for cross-border transfers.

You may withdraw consent for data processing or request deletion of your personal data at any time via our Data Rights portal. Withdrawal of consent will result in loss of access to RSMinds services. We will process your request within 30 days per GDPR Art 12 and DPDP §13.

Under DPDP §9, we require verifiable consent for users under 18. Sign-up requires attestation that you are 18 years of age or older. If we discover an account belonging to a user under 18 without parental consent, we will delete it within 7 days of discovery and notify the registered email address.