Privacy policy

MindoraLabs Pte. Ltd. ("MindoraLabs", "we", "us", "our") is a Singapore-incorporated company that builds AI automation for business operations. This privacy policy explains how we collect, use, and protect information when you visit our website, engage with our marketing and sales, or participate in any pre-launch evaluation or pilot deployment of our products.

Registered address: 3 Phillip Street, #19-02, Royal Group Building, Singapore 048693. For any privacy enquiry, contact us at sales@mindoralabs.io.

We collect only the information we need to provide and improve our services, and to communicate with you. Specifically:

• Information you provide directly: your name, work email, company, role, and the content of messages when you request a demo or contact us.
• Google account information: when you sign in with Google, we receive your Google profile (name, email address, profile photo) to create and associate your MindoraLabs account.
• Google Workspace data (pilot customers only): if an authorised user of a pilot or contracted customer grants us access, we process Gmail messages and Google Calendar events strictly to deliver the AI features the customer has agreed to.
• Usage and device data: pages viewed, interactions, approximate location derived from IP, and browser and device information.
• Cookies: essential cookies for session handling, and analytics cookies (where enabled) to understand how our site is used.

MindoraLabs's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Scopes we request and why

• Basic profile (email, name, picture): used to identify the signed-in user and link their Google identity to their MindoraLabs workspace.
• Gmail (send and read): used to send outreach messages on behalf of the authorised user and to read incoming replies so the AI can update lead and customer status. We do not use Gmail data to train generalised AI or machine learning models.
• Google Calendar (events): used to create, update, and read appointments and availability on behalf of the authorised user. We do not use Calendar data to train generalised AI or machine learning models.

What we do not do

• We do not sell Google user data, and we do not share it with third parties except as necessary to provide the user-facing features the customer has authorised.
• We do not use Google user data for advertising, ad targeting, or profile enrichment.
• Only a limited number of employees may access Google user data, and only when required to provide support, investigate a reported issue, comply with applicable law, or with the customer's explicit consent.
• You can revoke MindoraLabs's access to your Google account at any time via your Google Account permissions page.

• To deliver the features we and our customers have agreed on.
• To communicate with prospects about demos, pilots, and sales enquiries.
• To operate, secure, and improve our products, using aggregated and de-identified analytics.
• To prevent fraud and abuse, and to comply with applicable laws and legitimate legal requests.
• We do not use your personal data to train general-purpose AI or machine learning models.

We do not sell your personal data. We share information only in the following limited cases:

• Google Cloud Platform: our primary infrastructure sub-processor. Most production workloads run in the Singapore region.
• Google LLC: provides the Google OAuth, Gmail API, and Calendar API services that process user-authorised data.
• Additional sub-processors, if any, are disclosed in the written master service agreement between MindoraLabs and each contracted customer.
• Legal and compliance disclosures: made where required by applicable law, a binding legal request, or to defend our rights.
• Successors in interest: if MindoraLabs is involved in a merger, acquisition, or asset sale, data may be transferred subject to the terms of this policy.

• Sales and marketing enquiries: retained for up to 24 months from last contact, or until you ask us to delete them.
• Pilot and customer data: retained for the period set out in the applicable master service agreement, with a default of 12 months following termination unless a shorter period is agreed.
• Operational and security logs: up to 90 days.

• Encryption of data in transit (TLS) and at rest.
• Least-privilege access controls, enforced via Google Cloud IAM.
• Regular review of access, secrets, and dependencies.
• Responsible disclosure: please report any suspected vulnerability to sales@mindoralabs.io.

Subject to applicable law, you may request to access, correct, delete, or export your personal data, and to object to or restrict certain processing. You can also revoke Google permissions at any time via your Google Account permissions page.

To exercise any of these rights, email sales@mindoralabs.io. We will respond within 30 days. If you are not satisfied with our response, you may refer the matter to the Personal Data Protection Commission of Singapore.

MindoraLabs is headquartered in Singapore. Personal data may be processed in Singapore and in other jurisdictions where our sub-processors operate. Where required, we rely on appropriate safeguards, including standard contractual clauses, to protect transferred data.

Our services are intended for businesses and for individuals who are at least 18 years of age. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact sales@mindoralabs.io so we can take appropriate action.

We may update this privacy policy from time to time. When we make material changes, we will notify affected users by email, or by a prominent notice on our website, at least 14 days before the changes take effect. The effective date at the top of this page reflects the latest version.

Privacy enquiries and requests: sales@mindoralabs.io.

Postal: MindoraLabs Pte. Ltd., 3 Phillip Street, #19-02, Royal Group Building, Singapore 048693.