1. Scope
This Privacy Policy explains how MindLab Inc ("MindLab," "we," or "us") handles information when you visit clixy.com, request access, communicate with us, or use a Clixy workspace. Clixy is a brand of MindLab Inc. A Customer Agreement may add deployment-specific privacy terms for a paid customer deployment.
MindLab provides Clixy, a managed operating service for businesses, combining software, AI, and human Clixy Operators. The Service may process customer-authorized records, documents, communications, and connected-system data to support work, prepare recommendations, coordinate approved actions, and verify outcomes where the configured workflow allows it.
2. Who Is Responsible for the Data
MindLab Inc determines how website, access-request, sales, and direct support information is used for the purposes described in this policy.
For Customer workspace content, the Customer is normally the controller or business and MindLab normally acts as the processor or service provider on the Customer instructions. Customers are responsible for providing required notices, permissions, and legal bases for the information they choose to connect to Clixy.
If MindLab processes your information on behalf of a Customer, contact that Customer first with privacy questions. MindLab will assist the Customer as required by the applicable agreement and law.
3. Information We Collect
The information we collect depends on how you interact with Clixy.
- Contact and business information: the request-access form asks for your name, work email, and company, plus an optional description of the work you want Clixy to handle. We also receive information you choose to share in sales or support conversations.
- Workspace and account information: authorized users, authentication and account information, workspace settings, connector configuration, permissions, workflow rules, and support requests.
- Customer workspace content: information a Customer chooses to upload, connect, or generate in Clixy, which may include operational records, documents, messages, email content, notes, reports, approvals, source metadata, and other business information within the agreed deployment scope.
- Usage, security, and technical information: IP address, browser and device information, request and error logs, performance data, security events, and diagnostics needed to operate and protect the Service.
- Necessary website technologies: technologies needed for site delivery, abuse prevention, and form protection when those controls are enabled. Optional analytics and advertising cookies are not enabled in the current public website.
4. How We Use Information
- Provide, secure, administer, support, and improve Clixy.
- Respond to access requests, support requests, privacy or security inquiries, and other communications you initiate.
- Configure Customer workspaces, connected sources, permission boundaries, review rules, workflow states, and approved actions.
- Provide AI-assisted capabilities such as retrieval, extraction, comparison, anomaly detection, forecasting, drafting, recommendation, coordination, and verification where the configured workflow supports them.
- Maintain reliability, troubleshoot issues, prevent abuse, investigate security incidents, and enforce rate limits and other protective controls.
- Comply with legal obligations, enforce agreements, protect rights and safety, and resolve disputes.
5. Lawful Bases Where Required
Where applicable data-protection law requires a lawful basis, MindLab relies on the basis appropriate to the specific processing activity.
- Contract: to provide a requested service or perform obligations under a Customer Agreement.
- Legitimate interests: to secure and improve the Service, prevent abuse, administer accounts, respond to business inquiries, and protect legal rights, where those interests are not overridden by individual rights.
- Consent: where we specifically ask for consent for a processing activity.
- Legal obligation: where processing or retention is required by applicable law.
- Where a Customer is the controller for workspace content, the Customer is responsible for identifying the lawful basis for its own processing.
7. Service Providers and Sub-processors
The current public website and Service support the providers below. Some providers are used only when the relevant deployment feature is configured. A Customer Agreement or data processing terms may identify additional providers for a specific deployment.
Where required by an applicable Customer Agreement or data processing terms, MindLab will provide notice of new sub-processors that process Customer personal information.
| Provider | Purpose | Data |
|---|---|---|
| Vercel | Website and application hosting, content delivery, and production builds | Website request metadata, logs, and content served through the deployment |
| Resend, when configured | Transactional email for access requests, support responses, and service notices | Contact details and message content needed to send the requested email |
| Upstash, when configured | Distributed rate limiting and abuse prevention | Request identifiers, rate-limit counters, and security metadata |
| Cloudflare Turnstile, when configured | Bot protection for the request-access form | Device, interaction, and challenge-response metadata needed to assess whether a submission is automated |
8. Data Retention
MindLab retains information only as long as reasonably needed for the purposes described in this policy, unless a longer period is required or permitted by law or the applicable Customer Agreement.
Deployment-specific retention periods, deletion commitments, backup handling, and export rights should be confirmed in the applicable Customer Agreement or data processing terms before a Customer relies on them.
| Information | General approach |
|---|---|
| Access and contact requests | Retained while evaluating and responding to the request and for reasonable business recordkeeping, then deleted or archived when no longer needed. |
| Website logs and security events | Retained for a limited period reasonably necessary for operations, abuse prevention, incident investigation, security, and legal requirements. |
| Customer workspace content | Retained during the customer relationship and then handled under the applicable Customer Agreement and data processing terms. |
| Backups | Deletion from backups follows the backup rotation and recovery procedures applicable to the deployment. |
9. AI and Automated Processing
MindLab may use AI systems to retrieve, extract, compare, classify, forecast, draft, summarize, recommend, and coordinate work from Customer-authorized information. AI outputs may be incomplete or inaccurate and should be reviewed according to the risk of the workflow.
Clixy is designed so Customers control whether and how consequential outputs are used. Employment, purchasing, safety, financial, and customer-facing decisions remain subject to Customer responsibility and the review or approval rules configured for the deployment.
This Privacy Policy does not authorize MindLab to use Customer confidential workspace content or proprietary outputs to train public foundation models. Any broader training or model-improvement use of Customer information must be separately described and authorized in writing.
10. Security
MindLab uses administrative, technical, and organizational measures designed to protect information. The specific hosting, access, encryption, logging, monitoring, retention, authentication, and workspace controls that apply to a Customer deployment are confirmed through the applicable agreement or security documentation rather than assumed from this public policy.
No service is completely secure. Customers remain responsible for their own users, credentials, devices, networks, connected systems, and internal access decisions. Current public security information is summarized at /trust and in /.well-known/security.txt.
11. Your Privacy Rights
Depending on where you live and the law that applies, you may have rights to access, correct, delete, port, restrict, or object to certain processing of personal information, and to withdraw consent where processing is based on consent.
- Submit a request to hello@clixy.com with “Privacy” in the subject line and enough detail for us to understand the request.
- We may need to verify your identity before responding using information reasonably related to the request.
- We will respond within the time required by applicable law and explain any legally permitted extension or denial.
- Where MindLab processes information for a Customer, we may refer the request to that Customer and assist as required by the applicable agreement and law.
- Where applicable law provides an appeal or complaint right, our response will explain the available next step where required.
12. Communications and Opt-Out
MindLab sends service and administrative communications needed to respond to requests, provide the Service, and deliver legal or security notices. The current website does not run a bulk marketing-email program.
If optional marketing communications are introduced later, those messages will include the opt-out method required by applicable law. To stop follow-up about an access request, email hello@clixy.com with “Privacy” in the subject line.
13. U.S. State Privacy Rights
Certain U.S. state privacy laws may provide additional rights, subject to applicable thresholds, exemptions, and the role MindLab plays for the information at issue.
- Depending on applicable law, rights may include access, deletion, correction, portability, and information about categories of data, purposes, sources, and recipients.
- Some laws provide rights to opt out of sale, targeted advertising, or certain forms of sharing. MindLab does not sell personal information or use it for cross-context behavioral advertising in this website deployment.
- Where applicable, authorized agents may submit requests subject to legally permitted verification requirements.
- MindLab will not discriminate against an individual for exercising a privacy right protected by applicable law.
15. Browser Privacy Signals
Where applicable law requires recognition of an opt-out preference signal such as Global Privacy Control, MindLab will honor that signal for processing subject to the applicable requirement. Because this website does not sell personal information or use it for cross-context behavioral advertising, there is no such sale or advertising activity to opt out of in the current website deployment.
Optional analytics is not enabled in the current public website. If that changes, MindLab will add the required notice and consent controls before collection begins.
16. De-identified and Aggregated Data
MindLab may create aggregated or de-identified information that does not reasonably identify a person or Customer. MindLab will not attempt to re-identify data that it has committed to maintain as de-identified, except where permitted by applicable law to test or improve de-identification methods.
17. Third-Party Services
Our website may link to third-party services, and a Customer may choose to connect third-party business systems to Clixy. Those services are governed by their own terms and privacy policies. Customers are responsible for reviewing the permissions they grant to third-party integrations.
18. International Processing and Transfers
MindLab and its service providers may process information in more than one jurisdiction. Where applicable law requires a transfer mechanism or other safeguard, the mechanism for a Customer deployment should be documented in the applicable Customer Agreement or data processing terms before the Customer relies on it.
19. Children
Clixy is intended for business use and is not directed to children. If you believe a child has provided personal information directly through the website, contact hello@clixy.com with “Privacy” in the subject line.
20. Questions and Complaints
For a privacy question or complaint, contact hello@clixy.com with “Privacy” in the subject line. Depending on where you live, you may also have the right to contact a data-protection authority, attorney general, or other regulator.
21. Customer Workspace Data
Customers decide which business sources to connect and are responsible for the notices, permissions, retention choices, and access controls that apply to employee, customer, vendor, and other third-party information in their workspace. MindLab processes Customer workspace content according to the applicable Customer Agreement and configured permissions.
22. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through reasonable means appropriate to the relationship, such as this page, email to designated customer contacts, or an in-product notice.
23. Contact
For privacy questions, rights requests, or security reports, contact MindLab Inc at hello@clixy.com and identify the request type in the subject line. Any additional legal notice details or privacy representative required for a paid Customer deployment will be stated in the applicable Customer Agreement or privacy terms.
24. Version History
Material changes to this Privacy Policy are recorded below with the effective date and a short description.
| Effective date | Change |
|---|---|
| September 29, 2026 | Clarified MindLab Inc as the service provider, controller/processor roles, conditional service providers, AI-data boundaries, cookie practices, and deployment-specific data terms. |