Clarimind Privacy Notice

1. Who is responsible for your information

Clarimind is a product of Resonant Technology Limited, trading as Restech (“Restech”, “Clarimind”, “we”, “us” or “our”). Resonant Technology Limited is registered in England and Wales under company number 16868776. Its registered office is Unit 16 Boarshurst Lane, Greenfield, Oldham, England, OL3 7ER.

Restech is the controller of personal information used to operate Clarimind, unless we have agreed a different role with an organisation in writing. Questions and privacy requests can be sent to sales@clarimind.io.

2. What this notice covers

This notice covers the Clarimind website, accounts, workspaces, canvases, recorded voice-to-canvas processing, optional Reflection processing, public canvas shares, billing, customer communications, security controls and first-party website statistics. It does not cover a third-party website or service that has its own privacy notice.

3. Information we collect

• Account and identity information: your name, email address, password hash, verification status, time zone, authentication provider identifiers and security settings.
• Workspace and collaboration information: workspace membership, roles, invitations, sharing choices and records of authorised actions.
• Canvas content: titles, nodes, relationships, descriptions, layout, text prompts, recorded-voice transcripts, attachments, generated graph changes, corrections and related history.
• Voice processing information: the audio clip submitted for transcription, its technical metadata, the resulting transcript and processing evidence. Raw recorded audio is used to obtain a transcript and is not retained as a reusable Clarimind canvas asset after that request is processed.
• Optional Reflection information: if you deliberately enable Reflection, the experiences, thoughts, feelings, beliefs, bodily responses, actions, relationships and possible patterns you choose to submit, together with tentative graph interpretations and your corrections. Depending on what you share, this may include special-category personal data such as information concerning health, religious or philosophical beliefs, sex life or sexual orientation. Reflection is not enabled until you complete its separate consent step.
• Billing and order information: package, allowance and reserve usage, Stripe customer, subscription, Checkout, invoice, payment, refund and dispute identifiers, transaction amounts, currency, status and limited billing evidence. Stripe handles full payment-card details; Clarimind does not store your full card number.
• Communications: messages you send to us, support and sales correspondence, email delivery evidence and your communication preferences.
• Technical and security information: IP address, browser and device information, session and cookie data, request timestamps, authentication events, rate-limit evidence, error reports, audit records and security events.
• Measurement information: combined public-page, campaign, broad source and device-category counts; bounded interaction, performance-band, acquisition-start, completed registration, subscription and reserve-purchase counts; and anonymous daily aggregate product-usage counts. Clarimind does not store a public visitor, session or advertising identifier for this measurement.

Please do not use Clarimind to submit payment-card details, clinical records, or information that requires sector-specific safeguards unless we have expressly agreed that use with you in writing.

4. Why we use information and our lawful bases

• To provide the service and perform our contract: create and secure your account, process text and recorded voice, generate and store canvases, support collaboration and sharing, provide purchased service, administer usage allowances and respond to service requests.
• To meet legal obligations: maintain company, accounting, payment and tax records; respond to valid legal requests; and protect data-subject and consumer rights.
• For our legitimate interests: prevent fraud and abuse, secure and troubleshoot Clarimind, keep an audit trail, understand content-free aggregate service performance, understand which public pages and campaigns are useful, enforce our terms and improve reliability. We minimise public measurement at collection, combine it immediately and provide a free opt-out. We balance these interests against your rights.
• With your consent: send optional marketing where consent is required, or process special-category personal data you deliberately submit through Reflection. For Reflection, we rely on your explicit consent under Article 9 UK GDPR where the submitted material contains special-category personal data. You can withdraw consent without affecting processing that was lawful before withdrawal.
• To establish or defend legal claims: preserve limited evidence relating to disputes, chargebacks, misuse or legal proceedings where necessary.

Where you provide information about another person, you must have authority and a lawful reason to do so and must give them any information the law requires.

5. AI transcription and graph processing

Clarimind sends the information needed for a particular AI task—such as a recorded clip, transcript, selected canvas context and instructions—to OpenAI API services. OpenAI processes that information as our service provider to return a transcript or proposed graph result.

Clarimind does not opt customer API content into provider model training. Under OpenAI’s standard API data controls, API inputs and outputs are not used to train its models unless the customer explicitly opts in. Standard abuse-monitoring logs may retain content for up to 30 days unless a longer period is required by law. Provider controls and retention may change, so we assess the applicable service terms before changing the deployed processing arrangement.

AI output is probabilistic. Transcripts and graph interpretations can be incomplete or wrong. You remain able and responsible for reviewing, correcting and deleting your content.

Reflection creates a tentative visual interpretation from material you deliberately submit. It is not used to diagnose or assess a mental-health condition, provide therapy, monitor crisis risk, infer emotion from vocal tone, or determine a hidden truth about you. Clarimind does not use Reflection to make decisions about your eligibility, employment, credit, insurance, healthcare or access to an essential service.

If you withdraw Reflection consent, Clarimind stops accepting new AI processing in Reflection mode. Existing canvases are not automatically deleted: they remain available for you to review, edit manually, export or delete. If the released Privacy Notice changes in a way that invalidates the consent identity, Reflection requires a fresh choice before new processing resumes.

6. Who receives information

We disclose only what is reasonably needed to operate Clarimind to:

• OpenAI for transcription and AI graph processing;
• Stripe for Checkout, subscriptions, payments, refunds and disputes;
• Microsoft and Google where you choose their sign-in services, and Microsoft for transactional email delivery;
• Cloudflare for human-verification and related security functions;
• infrastructure, hosting, backup, monitoring, security and professional advisers that are subject to appropriate confidentiality and data-protection obligations;
• regulators, courts, law enforcement or another party where disclosure is legally required or necessary to protect legal rights; and
• a buyer or successor if our business or relevant assets are reorganised or transferred, subject to appropriate safeguards.

We do not sell your personal information.

7. Public shares and workspace access

Workspace members can access content according to their role. If an authorised member creates a public canvas link, anyone who obtains that link may view the shared canvas without signing in. Public links should not be used for confidential or sensitive material. An authorised member can revoke the link from the canvas sharing controls.

Reflection canvases are private by default but use the same deliberate sharing controls as other canvases. Because a public link can be forwarded or copied, do not create one for sensitive reflective material. You are also responsible for having an appropriate basis before including another person’s private information in a Reflection canvas.

8. Cookies and Clarimind statistics

Clarimind uses necessary cookies and browser storage for authentication, security, preferences, sessions and core service operation. These are required for the service you request.

Clarimind Insights is our first-party public-site measurement system. It is on by default and immediately adds activity to minute-level combined counters. Those counters may include a fixed page name, event category, performance band, broad device category, broad arrival-source category and a campaign code shared by everyone who uses the same campaign link. They do not contain a name, account, visitor ID, session ID, unique campaign token, IP address, user-agent string, raw URL, referrer, canvas/share identifier or submitted content. The service does not create an individual journey, advertising profile, heatmap or session replay, and the data is not sent to Google Analytics or another third-party analytics provider.

If you enter through a Clarimind /go/ campaign link, a first-party cookie may remember only that common campaign code for up to 30 days so later combined counts can be attributed to the campaign. It is not unique to you. When you begin a Stripe Checkout during that period, Clarimind may temporarily copy the common code and its expiry time onto its own Checkout-attempt record. The code is not sent in Stripe metadata. After a signature-verified subscription or reserve purchase is counted, or when the attribution period expires, Clarimind removes that temporary copy. The permanent Insights result is only a combined minute-level count for the common campaign and broad outcome category; it does not identify the account, workspace, order or payment.

The footer on public pages provides a free “Anonymous statistics” control. Disabling statistics stops new Insights counts and removes the campaign cookie; one first-party preference cookie remains so Clarimind can respect that choice. Public Insights aggregates are retained for up to 400 days.

Authenticated product measurement, where enabled, consists of anonymous daily aggregate counts and broad active-session duration milestones. It does not contain user, workspace, canvas, transcript, URL, IP address, user-agent or stable pseudonymous identifiers. Account holders can opt out in their profile. The aggregate data is retained for up to 400 days.

9. International processing

Some providers may process information outside the United Kingdom. Where data-protection law requires a transfer safeguard, we use an applicable adequacy decision or approved contractual safeguards and assess the provider and transfer arrangement.

10. How long we keep information

• Account, workspace and active canvas information is kept while needed to provide Clarimind and until it is deleted or the account relationship ends.
• A deleted canvas is normally recoverable for 30 days and is then permanently purged from the active service. Limited copies may remain in protected backups until the backup rotation expires.
• Recorded-voice transcripts form part of the canvas history. The raw uploaded clip is not retained as a reusable Clarimind asset after transcription, although temporary provider processing is subject to the provider controls described above.
• Billing, refund, dispute, audit and security records are kept for as long as reasonably necessary to meet legal, accounting, fraud prevention, dispute and evidential requirements.
• Consent records are kept long enough to respect and demonstrate your current choice. Reflection consent evidence records only the consent and Privacy Notice identity, confirmation that the adult-only requirement was accepted, and consent or withdrawal timestamps; it does not duplicate the reflective narrative.
• Public Clarimind Insights counters and authenticated aggregate product statistics are retained for up to 400 days. The temporary shared campaign-code cookie lasts up to 30 days unless statistics are disabled sooner. Any temporary campaign code copied onto a Clarimind Checkout-attempt record is removed after its first verified outcome is counted or after that same attribution period expires.

We may retain a restricted record for longer where litigation, a legal hold or a valid authority request requires it.

11. Security

We use access controls, tenant and workspace authorisation, encryption for protected fields, audit trails, rate limits, multi-factor controls for privileged administration, provider verification and operational monitoring. No internet service can guarantee absolute security. Keep your credentials private, use a strong password and tell us promptly if you suspect unauthorised access.

12. Your rights

Depending on the circumstances, UK data-protection law gives you rights to be informed, obtain a copy of your information, correct it, erase it, restrict its use, receive portable data, object to certain processing and withdraw consent. You may also have rights concerning solely automated decisions with legal or similarly significant effects. Clarimind does not use canvas interpretation to make such decisions about you.

Contact sales@clarimind.io to make a request. We may need to verify your identity and authority. You can also complain to the UK Information Commissioner’s Office at ico.org.uk. If you are outside the UK, you may also have the right to contact your local data-protection authority.

13. Children

Clarimind is intended for people aged 18 or over and is not directed at children. Contact us if you believe a child has provided personal information to Clarimind.

14. Changes to this notice

We may update this notice when Clarimind, its providers or legal requirements change. The version and effective date identify the notice currently in force. If a change materially affects how we use existing information, we will provide an appropriate notice before the change takes effect.