Privacy policy

01. Who we are

Mindkode is a web agency that designs, builds and maintains websites and applications. This policy covers the Mindkode website. It does not cover our clients' own sites, which are governed by their own policies.

For anything in this policy, or to make a request about your information, email hello@mindkode.com.

02. What we collect

We only collect what you choose to send us. That falls into three groups.

Information you give us in a form. Our contact form and free audit form ask for:

• Your name and email address (both required)
• Your company name, website address and rough budget, if you fill those in
• The service you are interested in, and the message you write

Information you give us when booking a call. Our booking page embeds a scheduler from Cal.com. When you book, the details you enter (name, email, time zone, any answers to booking questions) are processed by Cal.com and shared with us so we can hold the meeting.

Basic technical information. Our hosting provider records standard server and security logs, such as IP address, browser type and the pages requested. We use these to keep the site running and secure.

We do not ask for payment details on this website, and we do not knowingly collect information from children.

03. How we use it

• To reply to your enquiry and, if it goes further, to scope and quote the work
• To prepare and send a free audit when you request one
• To arrange and hold a call you have booked
• To keep our website secure, available and working properly
• To meet our legal and accounting obligations

We do not sell your information, and we do not use it to send marketing newsletters unless you ask us to.

04. Legal bases

Where data protection law such as the UK GDPR or EU GDPR applies to you, we rely on these grounds for using your information:

• Steps taken at your request before entering a contract, when you ask us to quote or audit something
• Our legitimate interest in responding to enquiries, running the site securely and improving our services
• Consent, where you have given it, which you can withdraw at any time
• Legal obligation, where we must keep records

05. Cookies and similar technology

We ask before setting any analytics cookie. Until you accept, Google Analytics runs in a restricted mode that sets no cookies and cannot identify you. We do not use advertising cookies and we do not sell your data.

We use:

• Google Analytics 4, but only once you accept. It tells us which pages people read and where they arrive from, and we keep it to aggregate reporting rather than tracking individuals.
• A small record of your cookie choice, so we do not ask again on every visit.
• Cookies and local storage set by Cal.com inside the booking widget on our booking page, so the scheduler can work. Those are covered by Cal.com's own privacy policy.

To change your mind, clear this site's cookies and local storage in your browser and we will ask again on your next visit. You can also block cookies entirely in your browser settings, though the booking widget may then not work properly.

06. Who else handles your information

We use a small number of trusted providers to run this site. Each only receives what it needs.

• Supabase, which stores form submissions in a database hosted in the Mumbai (ap-south-1) region.
• Vercel, which hosts and serves this website.
• Resend, which delivers the email notification telling us that you got in touch.
• Cal.com, which powers the scheduler on our booking page.
• Google, for Analytics (only with your consent) and for Workspace email and calendar once we are in touch.

Some of these providers are based outside your country, so your information may be transferred abroad. Where that happens, we rely on the safeguards those providers put in place, such as standard contractual clauses.

We may also disclose information if the law requires it, or to protect our rights, safety or property.

07. How long we keep it

• Enquiries that do not become projects: up to 24 months, so we have context if you come back to us
• Records relating to clients and projects: for as long as we work together, and then as long as tax and accounting rules require
• Server and security logs: short retention periods set by our hosting provider

You can ask us to delete your enquiry sooner, and we will unless we are required to keep it.

08. Security

Submissions are sent over an encrypted connection and stored in a database with row level security, so the public cannot read them. Access is limited to the people at Mindkode who need it, protected by individual accounts. No system is perfectly secure, but we take this seriously and review it regularly.

09. Your rights

Depending on where you live, you may have the right to:

• Ask for a copy of the information we hold about you
• Ask us to correct anything that is wrong
• Ask us to delete it, where we have no obligation to keep it
• Object to or restrict how we use it
• Withdraw consent you have given
• Complain to your local data protection authority

Email hello@mindkode.com and we will respond within 30 days.

10. Changes to this policy

If we change how we handle personal information, we will update this page and the date at the top. For significant changes we will say so clearly on the site.