Privacy Policy

This Privacy Policy describes how CelMind Corp., a Delaware corporation ("CelMind", "we", "us", or "our"), collects, uses, discloses, and protects personal data in connection with the Predict.ai websites, applications, APIs, SDKs, and related services (collectively, the "Services"). It also describes your rights and choices with respect to your personal data.

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Services. Capitalized terms not defined here have the meaning given in our Terms of Service.

1. Our Roles: Controller vs. Processor

We process personal data in two distinct capacities, and different terms apply to each:

• CelMind as a controller. When you visit our websites, create an account, contact us, or receive marketing from us, we determine how and why your personal data is processed. This Privacy Policy governs that processing.
• CelMind as a processor (Customer Content). When a customer uploads datasets, signals, events, time series, or other content to the platform ("Customer Content"), the customer is the controller and we process that content only on the customer's behalf and instructions, as described in our Data Processing Addendum ("DPA"). If you believe your personal data is contained in Customer Content, please direct requests to the relevant customer; we will assist them as required by law.

2. Personal Data We Collect

2.1 Data you provide to us

• Account data: name, email address, password or authentication credentials (including single sign-on identifiers), organization name, role, and workspace settings.
• Billing data: billing contact details, company information, tax identifiers, and payment information (processed by our PCI-DSS-compliant payment processors; we do not store full card numbers).
• Communications: messages you send to us through support channels, sales inquiries, feedback forms, or email, including [email protected].
• Marketplace data: if you publish or subscribe to signals on the Signal Marketplace, we collect publisher/subscriber profile information, listing descriptions, and transaction records.

2.2 Data we collect automatically

• Usage data: pages viewed, features used, API calls and endpoints invoked, model training and deployment activity, timestamps, and referring URLs.
• Device and log data: IP address, browser type, operating system, device identifiers, language settings, and crash or error logs.
• Cookies and similar technologies: as described in Section 8 below.

2.3 Data from third parties

• Identity providers (e.g., Google) when you sign in using single sign-on, limited to your name, email, and profile identifiers.
• Business and marketing partners, publicly available sources, and data-enrichment providers, used to maintain accurate business contact records.

3. How We Use Personal Data

We use personal data to:

• provide, operate, secure, and maintain the Services;
• authenticate users, manage workspaces, and enforce access controls and plan limits;
• process payments, meter usage, calculate credits, and manage billing;
• respond to support requests and communicate with you about the Services, including service announcements and security notices;
• monitor, detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service;
• analyze usage in aggregate to improve the Services, develop new features, and plan capacity;
• send marketing communications where permitted by law (you can opt out at any time); and
• comply with legal obligations and enforce our legal rights.

Model training. We never use Customer Content to train shared models, foundation models, or models made available to other customers. Models trained within your workspace on your Customer Content are used only to provide the Services to you. We may use aggregated, de-identified operational telemetry (which does not identify you or any individual) to improve platform reliability and performance, but not to train models.

4. Legal Bases for Processing (EEA/UK)

Where the EU or UK General Data Protection Regulation ("GDPR") applies, we rely on the following legal bases:

• Contract: processing necessary to provide the Services you or your organization have signed up for;
• Legitimate interests: securing the Services, preventing abuse, improving our products, and business-to-business marketing, balanced against your rights and freedoms;
• Consent: where required, for example for certain cookies or email marketing; you may withdraw consent at any time;
• Legal obligation: where processing is required to comply with applicable law.

5. How We Share Personal Data

We do not sell your personal data, and we do not share it with third parties for their own cross-context behavioral advertising. We share personal data only in the following circumstances:

• Service providers (subprocessors): vendors that host infrastructure, process payments, deliver emails, provide analytics, and supply customer-support tooling, in each case under contracts that restrict their use of your data to providing services to us.
• Within your organization: workspace administrators and members can see information about other members of the same workspace (e.g., name, email, activity within the workspace).
• Signal Marketplace: if you choose to publish a signal or dataset to the marketplace, the listing information you provide (including your publisher name and the data you publish) becomes available to subscribing customers under the marketplace terms. Publishing is always an explicit, deliberate action — nothing you keep private in your workspace is ever shared through the marketplace.
• Legal and safety: where we believe in good faith that disclosure is required by law, subpoena, or legal process, or is necessary to protect the rights, property, or safety of CelMind, our customers, or the public.
• Corporate transactions: in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case this Privacy Policy will continue to apply to your data until you are notified otherwise.
• With your direction or consent: for example, when you connect third-party integrations to your workspace.

6. International Transfers & Data Residency

Global, multi-region infrastructure. We operate the Services on infrastructure located in multiple regions around the world, including the United States and the European Union. Each workspace is assigned a home region, and Customer Content in that workspace is stored and processed at rest in data centers located in that region.

How your region is determined. The home region is set when a workspace is created, based on (in order): (a) a region you explicitly select; (b) a region configured for your organization; or (c) automatic assignment based on your location, as indicated by the country on your profile or the geolocation of the IP address and network information associated with your request. Customers located in the European Union (and, under the same mechanism, the wider EEA, the United Kingdom, and Switzerland) are assigned to our EU region by default, so their Customer Content is stored and processed at rest within the European Union. Customers located elsewhere are assigned to another region, such as the United States. Automatic geolocation is a best-effort determination; if region assignment matters to you, select your region explicitly or contact us.

Cross-region movement. Customer Content is not moved out of a workspace's home region except (a) on the customer's instruction or configuration, (b) where you publish a signal to the Signal Marketplace — published signals may be accessed by subscribers from other regions, or (c) where required by law.

Limited account, billing, and support metadata (for example, your login email and subscription records) may be processed in the United States and other countries where we or our subprocessors operate, regardless of your home region, because such data is needed to administer your relationship with us globally.

Where personal data subject to the GDPR, UK GDPR, or Swiss FADP is transferred outside the EEA, UK, or Switzerland, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK Addendum), adequacy decisions, and supplementary technical measures such as encryption in transit and at rest. A copy of the relevant safeguards is available on request.

7. Data Retention

We retain personal data for as long as needed to provide the Services and for legitimate business purposes, such as complying with legal obligations, resolving disputes, and enforcing agreements. In general:

• account data is retained for the life of the account and deleted or de-identified within 90 days after account closure, except where longer retention is required by law;
• Customer Content is retained according to the customer's instructions and deleted following termination as described in the DPA;
• billing records are retained as required by tax and accounting law; and
• security logs are retained for a limited period appropriate to detect and investigate incidents.

8. Cookies & Similar Technologies

We use cookies and similar technologies that are strictly necessary to operate the Services (such as session and authentication cookies), and — with your consent where required — analytics cookies that help us understand how the Services are used. We do not use third-party advertising cookies. You can control cookies through your browser settings; disabling strictly necessary cookies may prevent the Services from functioning.

9. Security

We maintain administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit (TLS) and at rest, network isolation, role-based access controls, audit logging, and regular security reviews. See our Security page for more detail. No system is perfectly secure, and we cannot guarantee absolute security; you are responsible for safeguarding your account credentials.

10. Your Rights & Choices

Depending on where you live, you may have the right to: access the personal data we hold about you; correct inaccurate data; delete your data; receive a portable copy; restrict or object to certain processing; withdraw consent; and lodge a complaint with a supervisory authority (in the EEA, your local data protection authority; in the UK, the ICO).

California residents: the California Consumer Privacy Act (CCPA/CPRA) gives you rights to know, delete, correct, and opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use or disclose sensitive personal information for purposes requiring an opt-out right. We will not discriminate against you for exercising your rights.

To exercise any right, email [email protected] with the subject line "Privacy Request". We will verify your identity and respond within the timeframe required by applicable law. You may use an authorized agent where permitted.

11. Children

The Services are business tools and are not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.

12. Third-Party Sites and Services

The Services may link to third-party websites or allow you to connect third-party integrations. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. Review their policies before providing them data.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Services before the changes take effect. The "Effective date" above indicates when this Policy was last revised. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

14. Contact Us

CelMind Corp. is the entity responsible for your personal data under this Privacy Policy.

CelMind Corp.
A Delaware corporation
Email: [email protected]

For individuals in the EEA or UK, you may also contact our EU representative or data protection contact via [email protected].