Privacy Policy

1. Controller and contact

Mindcapita is a product and brand of Dreaverr Digital Solutions LLP, 1103 - 11871 Horseshoe Way, Richmond, British Columbia, Canada V7A 5H5, represented by Robinson Guerra. Contact for data protection enquiries: contact@mindcapita.com.

We are established in Canada. Where we process the personal data of people in the European Union in connection with offering our service to organisations there, the GDPR applies to that processing under Article 3(2) GDPR, and this policy describes the processing on that basis.

Enquiries about this policy, and requests to exercise the rights in section 12, go to contact@mindcapita.com and are answered by us directly.

2. Two roles: our website and your employer's measurement

2.1 Where we are the controller. For this website, for contact requests and for the accounts of our customers, we decide about the purposes and means of processing. Sections 3 to 5 apply.

2.2 Where we are a processor. When a company uses the platform to run a measurement, that company is the controller. It decides who is invited, what is measured and what happens with the results. We process this data only on its documented instructions, under a data processing agreement pursuant to Article 28 GDPR. Sections 6 to 8 describe what happens technically; for the legal basis of the measurement itself, please contact your employer.

3. Visiting this website

3.1 When you open this website, your browser transmits technical data that our hosting provider records in server log files: IP address, date and time, the page requested, referrer, browser and operating system. This is necessary to deliver the site and to defend against attacks. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in a secure and functioning website.

3.2 We set no cookies for analytics, advertising or tracking, and we embed no third-party analytics. Fonts are delivered through the application's own font pipeline, which self-hosts the font files; no request to a third-party font service is made when you open the page.

3.3 After you log in, a session cookie is set. It is technically required to keep you logged in and is not used for any other purpose. Legal basis: Article 6(1)(b) GDPR and section 25(2) no. 2 TDDDG.

4. Contact requests

4.1 If you use the contact form, we process the name, work email address, company, optionally the company size, and your message. We use this to answer your enquiry and to prepare a possible contract. Legal basis: Article 6(1)(b) GDPR and Article 6(1)(f) GDPR.

4.2 The message is stored in our database and sent to our own inbox. We keep enquiries that do not lead to a contract for six months, then delete them. Where a contract follows, the statutory retention periods for business correspondence apply.

4.3 We limit how often the form can be submitted from one connection. For this we briefly store a shortened technical identifier. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in defending against abuse.

5. Customer accounts

5.1 For an account we process: organisation name, email address, a password stored only as a salted hash, role, and the timestamps of registration and email verification. Legal basis: Article 6(1)(b) GDPR.

5.2 For paid plans we process the billing data required for the contract. Payments are handled by our payment provider acting as merchant of record; that provider is itself the controller for the payment transaction and processes card data, which we never see.

5.3 We send transactional emails, such as verification and invitation mails. These are required to perform the contract.

6. Taking part in an interview

6.1 If your employer invites you, we process on their behalf: your email address, the team or department assigned to you, a personal invitation token, the timestamps of your consent and participation, the content of the conversation as a transcript, your questionnaire answers, and the values derived from them.

6.2 The conversation is conducted by an AI system. Speech is transmitted to a model provider for the duration of the conversation to produce the reply and the transcript. See section 9.

6.3 The platform can keep a short summary of previous conversations per email address, so that a later measurement can build on the earlier one instead of starting from scratch. This summary is content-related, not a personality profile, and it is not visible to your employer.

6.4 If you name something that would make your work easier, that is stored as a short anonymous phrase, without your name and without the wording you used. It is only ever reported to your employer bundled with the same wish from at least four other people; anything named by fewer people is never shown.

6.5 Participation begins with your consent. You can decline participation and you can end the conversation at any time. Where you decline, no conversation data is created.

7. The optional camera channel

7.1 If your employer has enabled this function, you are asked separately whether your camera may be used during the conversation. You can decline, and declining has no effect on your participation or its result.

7.2 If you agree, the analysis runs exclusively in your browser, on your own device. No image and no video is transmitted to us or to any third party, and none is stored. What leaves your device is a single coarse value per conversation.

7.3 That value only ever enters group results, never an individual result, and only once at least five people in a group have taken part.

7.4 The channel is off unless your employer switches it on and you agree to it separately. Your employer can run the whole measurement with it switched off, and you can withdraw your agreement at any time with effect for the future.

8. What your employer can and cannot see

8.1 Your employer never sees your conversation transcript, your individual questionnaire answers or an individual score. No role in the platform, including administrators, has access to these.

8.2 Your employer sees group results only once at least five people in a group have completed their participation. Below that threshold nothing is displayed. This threshold is enforced by the software.

8.3 Your employer does see, for organisational purposes, who has been invited and whether an invitation has been completed, because it needs this to run the campaign. It does not see what you answered.

8.4 The terms of use prohibit customers from using results for decisions about individual employees.

9. Recipients and processors

We engage the following service providers. Each is bound by a data processing agreement and processes data only on our instructions.

Cloud infrastructure provider: operation of the application and storage of all platform data. The provider currently engaged and its processing location are named on request to contact@mindcapita.com.

OpenAI:conducting the AI conversation and evaluating the answers. Conversation content is transmitted for this purpose, under OpenAI's data processing addendum. Content sent through the API is not used to train their models.

Resend: delivery of transactional emails. Recipient address and message content are transmitted.

Paddle: payment processing as merchant of record for self-service subscriptions.

The face analysis library used for the optional camera channel runs locally in your browser and transmits nothing.

10. Transfers outside the EU

10.1 Some of the providers named in section 9 process data in the United States. For those transfers we rely on the EU standard contractual clauses agreed in each provider's data processing addendum, and, where the provider is certified under the EU-US Data Privacy Framework, on that certification in addition. They are supplemented by the technical and organisational measures described in the data processing agreement.

11. Retention

11.1 Account and contract data is retained for the duration of the contract and afterwards for the statutory retention periods under commercial and tax law (generally six or ten years).

11.2 Measurement data is retained for as long as the customer's contract requires it. After the contract ends, the customer can export its results for a limited period; after that we delete the data, unless the data processing agreement provides otherwise.

11.3 Contact enquiries: see section 4.2. Server log files: 30 days.

12. Your rights

12.1 You have the right to access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), and to object to processing based on legitimate interests (Article 21).

12.2 Where processing is based on your consent, you may withdraw it at any time with effect for the future.

12.3 For a measurement run by your employer, your employer is the controller. Requests are best addressed there; if you contact us, we will forward the request to the controller and support them in answering it.

12.4 You have the right to lodge a complaint with a supervisory authority. As we are established in Canada, there is no lead supervisory authority for us in the EU; you may address the authority of your habitual residence or place of work. Where the processing concerns a measurement run by your employer, that employer is the controller and its competent authority applies.

13. Changes to this policy

We update this policy when the service or the legal situation changes. The current version is the one published here.