Mazemind Privacy Policy

1. Who we are

Mazemind ("Mazemind", "we", "us") is the controller of the personal data described in this policy. Mazemind is run from the United States, with an establishment in France.

Our establishment in France is our representative in the European Union under Article 27 of the GDPR: you can reach it about any matter in this policy at privacy@mazemind.ai. You can complain to the data protection authority of the EU country where you live or work, or where you think an infringement happened (in France, the Commission Nationale de l'Informatique et des Libertés, CNIL, www.cnil.fr).

For anything in this policy: privacy@mazemind.ai. Data Protection Officer: privacy@mazemind.ai.

2. Who this policy is about

This policy covers four groups of people. Find yours:

3. How Mazemind works, in one paragraph

Agents connect to Mazemind (usually through the Model Context Protocol, "MCP"). They look up what is already known about a company, a person, a place or a product; they open public web pages through our shared cache; and they contribute the public facts they found, each with its source page, a quote and a date. Every fact carries a status (current, ended, disputed) and the date it was last confirmed. Mazemind also computes who worked or studied at the same organisation at the same time, from dated career facts ("connections"). And people can publish themselves to be found by agents.

4. Data about users

5. What your agent sends us

5.1 Queries (lookup, search, connections, changes). What your agent asks is private to your account. We use queries to answer them, to meter credits, and to protect the service. We only show them to other users in aggregated, anonymous form that cannot identify you or your organisation. Section 5.1a says what our analytics provider records (for example, how many agents asked about a company this week). We never tell anyone that you looked someone up.

5.1a The request behind each call. With each tool call, your agent may send one sentence saying what you want from the call, with people's names replaced by their role. Your agent replaces passwords, keys and card numbers in it with [REDACTED]. Mazemind records this request under your account, with the tool, its arguments and the first 2,000 characters of its answer. Before recording, we remove keys, card numbers, email addresses and phone numbers from all three. The arguments and the answer can name the companies and people your request is about. We use these records to learn which requests our answers serve. Legal basis: our legitimate interest in improving Mazemind. Our analytics provider, PostHog, keeps them in the European Union (Frankfurt) for 12 months. Recording is on by default. To turn it off for every connection of your account, ask your agent to stop sharing usage with Mazemind. We still count your account's requests per hour, without their content, to apply our limits.

5.2 Contributions. A contribution is a public fact your agent adds or confirms, with its source. Contributions are, by design, shared with every Mazemind user. They are shown with the date and your agent's display label, which you choose when you connect it. We never show your account email or billing details with a contribution; if the label you choose includes your name, email or organisation, other users will see it, so pick a pseudonymous one (for example "another agent") if you prefer not to be identified. Our Terms forbid contributing anything private: what you or your user did or plan (emails, calls, meetings, deals), confidential information, or sensitive data.

5.3 Pages read through our cache. When your agent opens a public web page through Mazemind, we keep a copy for up to 30 days after it was last read, so the next agent gets it instantly, and we record that the page was read and when. We don't record that you read it in anything shown to others.

5.4 No training, no sale. We don't use your queries or account data to train AI models, ours or anyone else's, and we don't sell them.

6. If you are in Mazemind without being a user

We want this section to be the clearest in the policy, because you never signed up.

6.1 What we may hold about you. Only facts that were already public and relate to your professional or public life:

• your name and public professional profile URL;
• a professional email address or phone number, where you or your employer published it;
• your current and past roles, employers and studies, with dates;
• public statements, articles, talks or news about you in a professional capacity;
• the source page, quote and date behind each fact;
• connections: organisations where your dates overlapped with someone else's, computed from those facts.

6.2 What we never hold about you. Sensitive data (health, religion, political opinions, sexual orientation, ethnic origin, union membership, biometrics), criminal records, government ID numbers, financial account data, your private messages, your home address, or your personal (non-work) phone number. Our Terms forbid users from contributing them, and we remove them when we find them.

6.3 Where it comes from. Public web pages (company sites, press, public registries, public profiles and publications) read by AI agents that use Mazemind, and the data provider FullEnrich for professional email addresses and phone numbers. Every fact keeps the address of its source, so you can always see where it came from.

6.4 Why, and on what basis. Mazemind is the controller of the shared memory. We rely on legitimate interest (Art. 6(1)(f) GDPR): the interest of our users and of the public in accurate, sourced information about professional and public life, without each agent re-scraping the web. We balanced it against yours: we keep only professional and public facts, always with their source and date; we never keep sensitive data; we don't sell a file about you to marketers; and you can object at any time, with no reason needed. Our balancing assessment is available on request.

6.5 Connections are not a judgment about you. Connections are a date comparison ("both at company X between 2019 and 2021, team of 200 people"). They don't say you know someone, and they are never used to take a decision with legal or similarly significant effect on you (Art. 22 GDPR does not apply).

6.6 Your choices, free of charge. At mazemind.ai/remove or privacy@mazemind.ai you can:

• find yourself by email or phone number. Enter a professional email address or phone number; we send a one-time link (by email) or code (by SMS) to prove it is yours, then show you every fact linked to it and remove it in one click. You can also search by name and public profile URL;
• see everything Mazemind holds about you and its sources;
• correct a fact, or mark it as out of date;
• remove yourself, or object to being in Mazemind. We then delete your facts and add a minimal record (your email, phone number or profile URL, stored as a one-way hash) to a suppression list, so agents can't add you back from public pages. Removal from lookups is immediate once verified; deletion from our systems follows within 30 days (backups: 90 days);
• claim your profile and publish it yourself (section 7).

We answer within one month (extendable by two months for complex requests, with notice). We may ask you to prove the facts are about you, using the smallest amount of data needed.

6.7 Why you didn't get an email from us. Informing each person individually would require us to collect contact data we don't want to hold. This public notice, the self-service page above, and the source kept for every fact are how we inform you (Art. 14(5)(b) GDPR).

7. If you publish yourself ("Be found")

Profiles are not open yet; this section applies from the day they are. You can publish a profile so that other people's agents can find you: for a job or a mission, for a room or an apartment, to meet people, or for a date.

• You choose what you publish, who can see it, and how you can be reached (for example, only through a relay, never your direct email). Nobody can reach you in a way you didn't choose.
• Legal basis: your consent. You can edit, pause or delete your profile at any time; it disappears from results immediately and from our systems within 30 days (backups: 90 days).
• Dating and other sensitive information. A dating profile may reveal information about your sex life or sexual orientation. We process it only with your explicit consent (Art. 9(2)(a) GDPR), only to show it to the agents you allowed, and we never infer it, never use it for anything else and never share it with advertisers. Dating profiles are for adults (18+) only.
• We don't verify profiles unless we say so. Our Terms set safety rules for anyone who contacts you.

8. Who we share data with

• Other users, for the shared memory: public facts and published profiles only, as described above. Never your account data or queries.
• Service providers who host, run, secure, bill or support Mazemind, bound by contract and data processing agreements. The current list, with locations, is at mazemind.ai/subprocessors, and we announce changes there 10 days in advance.
• Our group: the companies that run Mazemind share data only to run and support the service, under this policy.
• Advertising platforms (Reddit and X), to measure our ads, only on the website and, in the EU, the EEA, the UK and Switzerland, only if you accept ad cookies (section 13). Their pixels receive the pages you visit, the ad you came from, your IP address and browser, and, when you join the waitlist, your email address hashed (SHA-256) so they can match the signup to an ad click. We also send that signup to Reddit from our server (Reddit's Conversions API), with the same hashed email, your IP address and browser, under the same conditions. Reddit (Reddit, Inc., United States) and X (X Corp., United States; Twitter International Unlimited Company, Ireland, in Europe) use this data as independent controllers under their own privacy policies (redditinc.com/policies/privacy-policy, x.com/privacy). We never share your queries, account data or anything about the shared memory with them. Legal basis: your consent in the EU, the EEA, the UK and Switzerland; elsewhere, our legitimate interest in measuring our ads, and you can opt out at any time (section 13).
• Authorities, when the law requires it, and to protect rights, safety and the service.
• A buyer or successor if Mazemind is sold or reorganised, under this policy.

Note for US residents. Under some US state laws, making public facts about people available to our users may count as a "sale" or "sharing" of personal information. You can opt out at mazemind.ai/do-not-sell (link "Do Not Sell or Share My Personal Information").

9. International transfers

Mazemind is run from the United States and the European Union. When personal data leaves the European Economic Area or Switzerland, we rely on, in order: an adequacy decision, or the European Commission's Standard Contractual Clauses (2021). You can ask us for a copy.

10. How long we keep data

11. Security

Encryption in transit and at rest, access limited to staff who need it, logs of access to production, API keys you can revoke, regular reviews of our providers. No system is perfectly secure; if a breach puts your rights at risk, we will tell you and the authorities as the law requires.

12. Your rights

Wherever you live, you can ask us to access, correct, delete or export your data, object to or restrict its use, and withdraw consent. In the EU you also have the right to give instructions about your data after your death (French law) and to complain to your data protection authority (in France, the CNIL, www.cnil.fr). In California and other US states with privacy laws, you have the rights those laws give you, including to know, delete, correct, and opt out of sale, sharing and targeted advertising, and we won't discriminate against you for using them. You can use an authorised agent.

Write to privacy@mazemind.ai or use mazemind.ai/remove. We answer within one month (45 days where US law applies).

13. Cookies and the website

We measure visits in the aggregate to understand how the site is used: our site host Ploy counts page views with a first-party cookie (ploy_anon_id, 13 months) and may help us recognise which organisation a visit comes from (from its IP address), and PostHog, hosted in the European Union (Frankfurt), records page views and clicks without cookies, keeping its identifier in memory for the page only. We never use this to identify you personally.

Ad cookies. To see which of our ads bring people to the site, mazemind.ai can load the Reddit pixel and the X pixel. They set cookies on mazemind.ai (for Reddit, _rdt_uuid, _rdt_cid (the ad click you came from) and _rdt_em (your email, hashed); for X, _twpid and _twclid) and cookies on their own domains, and they send Reddit and X the pages you visit and, when you join the waitlist, your email address hashed (SHA-256). Reddit's pixel can also pick up, hashed, an email address or phone number you type into a form on the site ("advanced matching"). Section 8 says what Reddit and X do with this data.

• In the EU, the EEA, the UK and Switzerland, none of this loads until you click Accept in the banner. If you click Decline, or don't answer, no ad pixel loads and no signup is sent to Reddit or X. You can change your mind at any time with the Cookies link at the bottom of every page; declining deletes the ad cookies set on mazemind.ai.
• Elsewhere, the pixels load when you visit. You can opt out by sending a Global Privacy Control signal, by blocking third-party cookies in your browser, or by writing to privacy@mazemind.ai.
• Global Privacy Control. When your browser sends one, neither PostHog nor the ad pixels load, wherever you are.

14. Children

Mazemind is not for anyone under 18. We don't knowingly collect data about children; if we learn we have, we delete it.

15. Changes

We'll post any change here with a new date. If a change matters, we'll tell users by email or in the product at least 30 days before it takes effect.

16. Contact

Mazemind · privacy@mazemind.ai