Privacy Policy

Overview

Masterminds AI (“Masterminds AI,” “we,” “us,” or “our”) operates The Agentic Product OS, a platform where product teams run AI Master Agents across the product lifecycle. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use our website and platform, including personal data of users in Brazil (under the Lei Geral de Proteção de Dados, “LGPD”) and in the European Union and United Kingdom (under the General Data Protection Regulation, “GDPR”). Masterminds AI is operated by a Brazilian company and serves customers internationally.

Data We Collect

• Account data. Name, email address, and authentication credentials managed through our identity provider (Supabase Auth) when you create an account or sign in.
• Workspace content. The content you and your team create or upload within workspaces, channels, sessions, and documents, including prompts, files, and AI-generated output.
• Contact and lead-form data. Information you submit through our marketing forms (for example, a Master Sprint application or a Corporate Sales inquiry), such as name, company, work email, WhatsApp number, role, and team headcount.
• Technical and usage data. Device, browser, and log information, and basic product analytics events generated as you navigate and use the service.

How We Use Data

We use personal data to:

• provide, operate, secure, and improve the service;
• authenticate users, maintain accounts, and deliver the AI-assisted features you request;
• respond to contact and lead-form submissions and communicate about the service, including transactional and lead-notification email;
• understand product usage through aggregated analytics to improve reliability and user experience;
• comply with legal obligations and enforce our terms.

AI Processing

To deliver the AI-assisted features you request, the relevant content you submit (such as prompts, documents, and connected files) is sent to third-party large language model (“LLM”) providers that act as our subprocessors. This processing occurs only to produce the user-facing output you ask for. We do not use your content to train, improve, or create generalized, foundation, or frontier AI models, and our LLM subprocessors are engaged under terms that do not permit them to use your content to train their foundation models.

Google Drive Data and Google API Services User Data Policy

The Google Drive connector is optional and user-authorized. When you connect Google Drive, Masterminds AI requests the restricted Google Drive scope:

https://www.googleapis.com/auth/drive.readonly

This permission technically allows read-only access to Google Drive files that your Google Account can access. Masterminds AI uses this permission only to list, preview, retrieve, and attach Drive files that you choose to use in Masterminds workflows. We use Google Drive file names, metadata, and file contents only to provide or improve user-facing Masterminds AI features that you request, such as using a Drive document as context for a product plan, research task, or AI-assisted workflow. We do not use Google user data for advertising, retargeting, selling data, credit decisions, lending decisions, or unrelated analytics.

Masterminds AI’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell Google user data. We do not use Google user data to train, improve, or create generalized, foundation, or frontier AI models. When you ask Masterminds AI to process Drive content, the relevant content may be processed by our application infrastructure and service providers only to deliver the user-facing feature you requested and under confidentiality and data protection obligations. Human access to Google user data is limited to cases where you provide permission, security investigation is required, legal obligations apply, or aggregated internal operations require it. You can revoke Google Drive access at any time from your Google Account permissions, or by contacting contact@masterminds.com.ai.

Subprocessors

We rely on trusted service providers who process personal data on our behalf under data protection agreements:

• Anthropic, OpenAI, and Google — LLM providers that process submitted content to deliver AI features.
• Supabase — authentication, database, and application hosting.
• Google Cloud — cloud infrastructure and hosting.
• Resend — transactional and lead-notification email delivery.

Cookies and Local Storage

We use browser local storage for essential product functionality, such as remembering your language preference (mm_lang) and temporarily holding a pending idea or query while you sign in. We use cookies and similar technologies only as needed to operate the service and to collect basic, aggregated analytics events. We do not use third-party advertising cookies.

Data Retention and Deletion

We retain personal data for as long as your account is active or as needed to provide the service, maintain user-visible workspace history, comply with legal obligations, resolve disputes, and enforce our agreements. When data is no longer required, we delete or anonymize it. You may request deletion of your account data or workspace content by contacting contact@masterminds.com.ai.

Security Program

We maintain a security program with practices aligned with the SOC 2 Trust Services Criteria. These practices include role-based access controls (RBAC) and least-privilege access, encryption of data in transit and at rest, logging and monitoring of system activity, vendor and subprocessor management, and operational safeguards designed to protect personal data from unauthorized access, disclosure, alteration, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

International Transfers

Masterminds AI is operated from Brazil and uses infrastructure and subprocessors that may process personal data in other countries, including the United States and the European Union. Where we transfer personal data across borders, we rely on appropriate legal safeguards, such as standard contractual clauses or equivalent mechanisms recognized under the LGPD and GDPR.

Your Rights

Subject to applicable law, including the LGPD and GDPR, you have the right to access, correct, delete, and port your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. To exercise any of these rights, contact us at contact@masterminds.com.ai. We will respond within the timeframes required by applicable law. You also have the right to lodge a complaint with your local data protection authority (the ANPD in Brazil, or your supervisory authority in the EU or UK).

Children’s Privacy

The service is not directed to individuals under 18 years of age, and we do not knowingly collect personal data from them. If you believe a minor has provided us with personal data, contact us and we will take appropriate steps to delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where required by law, seek your consent before using personal data for a new purpose.

Contact

For questions about this Privacy Policy or to exercise your data protection rights, contact us at contact@masterminds.com.ai.