Mindbird is software that businesses use to talk to their customers on WhatsApp, Instagram, Facebook and their own websites. Most of the personal data here belongs to those businesses' customers, and we hold it on their behalf — they decide what is collected and why; we process it for them. Where the law uses those words, each business is the controller and the operator of this service is the processor.
What is collected
| Messages | The content of conversations between a business and its customers, with timestamps and delivery status. |
| Contact details | Phone number, and a name and email where the customer gives one or the business already holds it. |
| Profile information | The display name and profile picture Meta provides for a WhatsApp, Instagram or Facebook account that starts a conversation. |
| Comments | Public comments on a business's own Instagram and Facebook posts, where comment automations are switched on. |
| Website chat | Messages sent through a chat widget, and the page the visitor was on. |
| Campaign activity | Which messages were delivered, and which links were tapped. |
| Staff accounts | Name, work email, role, and a hashed password, for the people who sign in. |
Nothing is bought from data brokers, and nothing is collected by tracking people across other websites.
Why
To deliver messages a business sends and replies its customers send back; to answer questions automatically from documents the business supplies; to record consent and opt-outs; to show the business how its campaigns performed; and to keep the service secure — sign-in throttling, abuse limits and audit records.
Who else processes it
These are the only services that receive personal data from Mindbird:
| Meta Platforms | WhatsApp, Instagram and Facebook themselves. Messages travel through Meta, which keeps its own copies under its own policies. |
| Vercel | Hosting. Every request is processed on their infrastructure. |
| Supabase | The database and file storage, running on Amazon Web Services. |
| Message and comment text is sent to the Gemini API to generate replies and to index a business's own documents. | |
| LeadSquared | Only where a business has connected their own CRM account. Contacts and message activity are copied to it. |
None of them are permitted to use the data for their own purposes. A business can avoid the Google one entirely by supplying its own API key, or by switching automatic replies off.
How long it is kept
For as long as the business using Mindbird keeps it, and then as described under deletion below. Sign-in attempt records and abuse counters are short-lived and are cleared automatically. Records of what an administrator did are kept after an account closes, because the point of them is to be answerable later.
Security
Traffic is encrypted in transit. Passwords are hashed and never stored in a readable form. A second factor is required for every account that signs in. Integration credentials a business supplies are encrypted before they are stored. Each business's data is separated at the database level, and incoming messages from Meta are rejected unless they carry a valid signature.
No system is perfectly secure. If a breach affects your data we will tell the affected businesses without undue delay, along with what happened and what to do about it.
Your choices
- Stop the messages — reply STOP to any WhatsApp message. It takes effect at once, on every channel.
- Ask what is held — we will tell you, or get it from the business you were talking to.
- Correct it — a wrong name or number can be fixed.
- Have it deleted — see Delete my data.
- Take a copy — a business can export everything in its workspace as a single file.
- Nominate someone — under India's DPDP Act you may nominate another person to exercise these rights on your behalf if you die or become unable to act. Tell us in writing and we will record it.
Children
The service is sold to businesses and is not directed at children. We do not knowingly collect data from anyone under 18; if you believe we have, tell us and it will be removed.
Where data is held
On infrastructure operated by the providers named above, which may be outside your country. Where data leaves the region it was collected in, it is transferred under the safeguards those providers offer.
Changes
If this policy changes in a way that affects how data is used, the businesses using the service will be told before it takes effect. The date at the top always reflects the last substantive change.
If you are in India
India's Digital Personal Data Protection Act, 2023 applies to this service. Under it, the business you were talking to is the Data Fiduciary for your data and the operator of this service is its Data Processor. For the accounts of the staff who sign in to Mindbird, the operator of this service is the Data Fiduciary.
Personal data is processed on the basis of your consent, or for a legitimate use the Act permits. Consent can be withdrawn at any time and withdrawing it is as easy as giving it — replying STOP to a WhatsApp message withdraws it instantly, on every channel. Withdrawing consent does not undo processing that already happened lawfully.
Grievance Officer
If you are unhappy with how your data has been handled, raise it with our Grievance Officer. They are required to respond, and going to them first is the route the Act expects you to take.
| Grievance Officer | Not yet published — contact the operator of this service. |
| Not yet published. | |
| Postal address | Not yet published. |
| Response time | We aim to acknowledge within 72 hours and resolve within 30 days. |
If we do not answer, or you are not satisfied with the answer, you can complain to the Data Protection Board of India. You are expected to have raised it with the Grievance Officer first.
Contact
Contact the operator of this service.