Privacy policy

MindoraLabs Pte. Ltd. ("MindoraLabs", "we", "us", "our") is a Singapore-incorporated company that builds AI automation for business operations. This privacy policy explains how we collect, use, and protect information when you visit our website, engage with our marketing and sales, or participate in any pre-launch evaluation or pilot deployment of our products.

Registered address: 3 Phillip Street, #19-02, Royal Group Building, Singapore 048693. For any privacy enquiry, contact us at sales@mindoralabs.io.

We collect only the information we need to provide and improve our services, and to communicate with you. Specifically:

• Information you provide directly: your name, work email, company, role, and the content of messages when you request a demo or contact us.
• Google account information: when you sign in with Google, we receive your Google profile (name, email address, profile photo) to create and associate your MindoraLabs account.
• Google Workspace data (pilot customers only): if an authorised user of a pilot or contracted customer grants us access, we process Gmail messages and Google Calendar events strictly to deliver the AI features the customer has agreed to.
• WhatsApp Business messaging data (customer deployments only): when a business customer connects a WhatsApp Business Account, we process the phone numbers and message content of the people who message that business, as described in section 04.
• Usage and device data: pages viewed, interactions, approximate location derived from IP, and browser and device information.
• Cookies: essential cookies for session handling, and analytics cookies (where enabled) to understand how our site is used.

MindoraLabs's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Scopes we request and why

• Basic profile (email, name, picture): used to identify the signed-in user and link their Google identity to their MindoraLabs workspace.
• Gmail (send and read): used to send outreach messages on behalf of the authorised user and to read incoming replies so the AI can update lead and customer status. We do not use Gmail data to train generalised AI or machine learning models.
• Google Calendar (events): used to create, update, and read appointments and availability on behalf of the authorised user. We do not use Calendar data to train generalised AI or machine learning models.

What we do not do

• We do not sell Google user data, and we do not share it with third parties except as necessary to provide the user-facing features the customer has authorised.
• We do not use Google user data for advertising, ad targeting, or profile enrichment.
• Only a limited number of employees may access Google user data, and only when required to provide support, investigate a reported issue, comply with applicable law, or with the customer's explicit consent.
• You can revoke MindoraLabs's access to your Google account at any time via your Google Account permissions page.

OktoCrew, our AI operations product, is operated by MindoraLabs Pte. Ltd. as a Meta Partner Solution for the WhatsApp Business Platform. When a business customer connects its WhatsApp Business Account, we process the messages exchanged between that business and the people who message it, so that the AI features the business has enabled can read, draft, and send replies on its behalf.

What we receive and why

• End-customer phone numbers and message content: the WhatsApp number a person messages from, and the text and media they send, used to maintain the conversation record and to let the AI assistant respond on the business's behalf.
• WhatsApp Business Account details: the WhatsApp Business Account ID, phone number ID, business profile, and message templates belonging to the connected business.
• Meta Platform Data: the Meta API access token and related account identifiers issued when a business grants the connection. Under our Partner Solution these are held and used by our WhatsApp Solution Partner, 360dialog, to send and receive messages on our behalf.
• AI processing: message content is sent to Google Vertex AI to generate suggested and automatic replies. It is not used to train Google's models, or any generalised model of ours.

What we do not do

• We do not sell WhatsApp message content or end-customer phone numbers, and we do not share them for advertising, ad targeting, or profile enrichment.
• We do not use WhatsApp message content to train generalised AI or machine learning models.
• Only a limited number of employees may access WhatsApp message content, and only when required to provide support, investigate a reported issue, comply with applicable law, or with the customer's explicit consent.
• A business can disconnect its WhatsApp Business Account at any time, which ends our access to new messages.

• To deliver the features we and our customers have agreed on.
• To communicate with prospects about demos, pilots, and sales enquiries.
• To operate, secure, and improve our products, using aggregated and de-identified analytics.
• To prevent fraud and abuse, and to comply with applicable laws and legitimate legal requests.
• We do not use your personal data to train general-purpose AI or machine learning models.

We do not sell your personal data. We share information only in the following limited cases:

• Google Cloud Platform: our primary infrastructure sub-processor. Most production workloads run in the Singapore region. Its Vertex AI service also processes message and conversation content to generate AI replies.
• Google LLC: provides the Google OAuth, Gmail API, and Calendar API services that process user-authorised data.
• 360dialog GmbH: our WhatsApp Solution Partner. It holds and uses the Meta API access token for our Partner Solution to send and receive WhatsApp messages on our behalf, and processes end-customer phone numbers and message content as part of providing that service.
• Additional sub-processors, if any, are disclosed in the written master service agreement between MindoraLabs and each contracted customer.
• Legal and compliance disclosures: made where required by applicable law, a binding legal request, or to defend our rights.
• Successors in interest: if MindoraLabs is involved in a merger, acquisition, or asset sale, data may be transferred subject to the terms of this policy.

• Sales and marketing enquiries: retained for up to 24 months from last contact, or until you ask us to delete them.
• Pilot and customer data: retained for the period set out in the applicable master service agreement, with a default of 12 months following termination unless a shorter period is agreed.
• Operational and security logs: up to 90 days.

• Encryption of data in transit (TLS) and at rest.
• Least-privilege access controls, enforced via Google Cloud IAM.
• Regular review of access, secrets, and dependencies.
• Responsible disclosure: please report any suspected vulnerability to sales@mindoralabs.io.

Subject to applicable law, you may request to access, correct, delete, or export your personal data, and to object to or restrict certain processing. You can also revoke Google permissions at any time via your Google Account permissions page.

To exercise any of these rights, email sales@mindoralabs.io. We will respond within 30 days. If you are not satisfied with our response, you may refer the matter to the Personal Data Protection Commission of Singapore.

MindoraLabs is headquartered in Singapore. Personal data may be processed in Singapore and in other jurisdictions where our sub-processors operate. Where required, we rely on appropriate safeguards, including standard contractual clauses, to protect transferred data.

Our services are intended for businesses and for individuals who are at least 18 years of age. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact sales@mindoralabs.io so we can take appropriate action.

We may update this privacy policy from time to time. When we make material changes, we will notify affected users by email, or by a prominent notice on our website, at least 14 days before the changes take effect. The effective date at the top of this page reflects the latest version.

Privacy enquiries and requests: sales@mindoralabs.io.

Postal: MindoraLabs Pte. Ltd., 3 Phillip Street, #19-02, Royal Group Building, Singapore 048693.