Privacy Policy

MindAura ("we", "us", "our") respects your privacy. This Privacy Policy explains what personal information we collect, how we use it, and your choices.

By using MindAura you agree to the practices described here.

1. Information we collect

From you directly

• Account info: name, email, phone number, password (hashed), birthdate (optional)
• Booking info: which businesses/services you book, appointment times, therapist preferences, notes you enter
• Payment info: we do NOT store your credit card number. Payments are processed by Stripe, which stores card details subject to its own privacy policy. We store only the last 4 digits, brand, and Stripe reference IDs for our records.
• Reviews and messages: ratings, review text, SMS conversations with the AI Chief of Staff (if you are a business owner)

Automatically

• Usage data: pages viewed, features used, click patterns
• Device data: IP address, browser type, operating system, referrer
• Cookies and similar: to keep you logged in and remember preferences

From Businesses

If you booked with a business that already had you as a customer (e.g. imported from Vagaro or their previous system), the business may have provided us with your contact info.

2. How we use your information

• Provide the Service — process bookings, send confirmations and reminders, handle payments, sync your appointment history
• Improve the Service — analyze usage patterns, debug errors, train our AI assistant on aggregated (non-personally-identifiable) data
• Communicate with you — transactional messages (bookings, reminders, receipts, cancellations) and, if you opted in, marketing messages from the businesses you have booked with
• Prevent fraud and abuse — verify accounts, block suspicious activity, comply with legal obligations
• Legal compliance — respond to lawful requests from law enforcement, tax reporting, dispute resolution

3. When we share your information

We do NOT sell your personal information. We share it only:

• With the Business you booked — your name, contact info, appointment history at that business, and any notes needed for them to serve you
• With service providers — Stripe (payments), Twilio (SMS), Google (email), Vercel (hosting), Sentry (error tracking), Langfuse (AI observability). Each of these is bound by contract to use your data only for the purposes we specify.
• When required by law — subpoenas, court orders, legal process
• In business transfers — if MindAura is acquired or merged, your data may transfer to the acquiring entity subject to this Privacy Policy

4. AI processing

We use large language models (currently DeepSeek) to power our AI assistant (the "Chief of Staff") for business owners. Prompts sent to the LLM may include:

• The business's booking data (customer names, appointment times, service history)
• Reviews and other customer-facing content
• The business owner's chat messages with the AI

We attempt to redact obvious personally identifiable information (phone numbers, emails, payment tokens) before sending prompts, but customer names and service history are included so the AI can be useful. We do not use your customer data to train third-party AI models.

If you are a customer and do not want your data used to inform AI suggestions for the businesses you book with, contact us at louis@neptunelab.ai to request suppression.

5. Data retention

• Active accounts: we keep your data as long as your account is active
• Deleted accounts: we delete or anonymize your personal data within 60 days of deletion request, except where retention is required for legal, tax, or fraud-prevention purposes
• Bookings: kept indefinitely for accounting and dispute-resolution purposes, in accordance with tax law (typically 7 years)
• SMS and email history: kept for 12 months
• AI conversation history: kept for 12 months for quality improvement, then deleted or anonymized

6. Your rights

Depending on where you live, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Delete your account and associated personal data (subject to legal retention obligations)
• Object to certain processing (e.g. marketing)
• Portability — receive a copy of your data in a machine-readable format
• Opt out of marketing — reply STOP to any SMS, click unsubscribe in any email, or update your account preferences

California residents: you have specific rights under the CCPA, including the right to know what personal information we collect and the right to opt out of the sale of personal information (we do not sell your data).

To exercise any of these rights, email us at louis@neptunelab.ai.

7. Security

We use industry-standard security measures — TLS for all connections, encrypted passwords, encrypted-at-rest databases via Google Cloud SQL, scoped access via IAM, secret management via Google Secret Manager, regular dependency updates. No online service can guarantee 100% security. If we discover a breach affecting your data, we will notify you as soon as reasonably possible and no later than required by law.

8. Children

MindAura is not intended for anyone under 18. We do not knowingly collect information from minors. If we discover we have collected data from a minor, we will delete it.

9. International data transfers

Our servers are hosted in the United States. If you access MindAura from outside the US, your data will be transferred to and processed in the US.

10. Changes to this policy

We may update this Privacy Policy from time to time. If changes are material, we will notify you by email or by posting a notice on the Service. Continued use after the effective date constitutes acceptance.

11. Contact

Questions or requests about this Privacy Policy? Email us at louis@neptunelab.ai.