Privacy Policy – Enigma Mind

Effective July 15, 2026

Enigma Mind is an AI safety and research company working to build reliable, interpretable, and steerable AI systems.

This Privacy Policy explains how we collect, use, disclose, and process your personal data when you use our website or other Enigma Mind products and services (the “Services”).

This Privacy Policy also describes your privacy rights. More information about your rights, and how to exercise them, is set out in Section 4 (“Rights and Choices”).

1. Collection of Personal Data

We collect the following categories of personal data:

Personal data you provide to us directly

Identity and Contact Data: Enigma Mind collects identifiers, including your name, email address, and phone number when you sign up for an Enigma Mind account, or to receive information on our Services. We may also collect or generate indirect identifiers (e.g., “USER12345”).
Payment Information: We shall collect your payment information if you choose to purchase access to Enigma Mind’s Services.
Inputs and Outputs: You are able to interact with our Services in a variety of formats, including but not limited to chat, coding, agentic sessions (where Enigma Mind performs multi-step tasks or takes actions on your behalf), and connected services. The content you submit to the Services through these interactions, including via third-party applications, services, and content you choose to upload, integrate or interact with using our Services, are your “Inputs”. Inputs generate responses and actions (“Outputs”). If you include personal data or reference external content in your Inputs, we will collect that information and it may be reproduced in your Outputs. Depending on the permissions you grant Enigma Mind, some Outputs may result in actions with effects outside the Services, such as sending communications, modifying files, or interacting with third-party services on your behalf.
Feedback on your use of our Services: We appreciate feedback, including ideas and suggestions for improvement or rating an Output in response to an Input (“Feedback”). If you rate an Output in response to an Input—for example, by using the thumbs up/thumbs down icon—we may store the entire related conversation as part of your Feedback.
Study Participation Data: If you participate in Enigma Mind research studies, surveys, or interviews, we collect the responses you provide, associated account data, and related Technical Information. We may combine this data with other data from your account for aggregated analysis.
Communication Information: If you communicate with us, including via our chatbot on our Help site, we collect your name, contact information, and the contents of any messages you send.
Verification Data: In certain circumstances, we may ask you to verify your age or identity. If you choose to do so, data we will collect includes, depending on the method: an image of your government-issued identity document and the information appearing on it (such as your ID number and date of birth); your image in photo or video form, facial geometry templates (which may be considered ‘biometric data’ in some jurisdictions); and the result of the verification (for example, whether your age meets the applicable threshold).

When you provide Inputs—including by uploading files, granting Enigma Mind access to third-party services, or instructing Enigma Mind to retrieve or act on information—you are responsible for ensuring you have the necessary rights, permissions, or authority to do so.

Personal data we receive automatically from your use of the Services

When you use the Services, we also receive certain technical data automatically (described below, collectively “Technical Information”). This includes:

Device and Connection Information: Consistent with your device or browser permissions, your device or browser automatically sends us information about when and how you install, access, or use our Services. This includes information such as your device type, operating system information, browser information and web page referers, mobile network, connection information, mobile operator or internet service provider (ISP), time zone setting, IP address (including information about the location of the device derived from your IP address), identifiers (including device or advertising identifiers, probabilistic identifiers, and other unique personal or online identifiers), and device location.
Usage Information: We collect information about your use of the Services, such as the dates and times of access, browsing history, search, information about the links you click and about third-party applications, services, and content you integrate or interact with, pages you view, and other information about how you use the Services, and technology on the devices you use to access the Services.
Log and Troubleshooting Information: We collect information about how our Services are performing when you use them. This information includes log files. If you or your device experiences an error, we may collect information about the error, the time the error occurred, the feature being used, the state of the application when the error occurred, and any communications or content provided at the time the error occurred.
Cookies & Similar Technologies: We and our service providers use cookies, scripts, or similar technologies (“Cookies”) to manage the Services and to collect information about you and your use of the Services. These technologies help us to recognize you, customize or personalize your experience, market additional products or services to you, and analyze the use of our Services to make them safer and more useful to you.

2. Uses of Personal Data Permitted Under Applicable Data Protection Laws

We use your personal data for the following purposes:

To provide, maintain and facilitate any products and services offered to you with respect to your Enigma Mind account, which are governed by our Terms of Service;
To provide, maintain and facilitate optional services and features that enhance platform functionality and user experience;
To provide you with service updates, communications, and to provide tailored recommendations about our Services that may be of interest to you;
To create and administer your Enigma Mind account;
To facilitate payments for products and services provided by Enigma Mind;
To prevent and investigate fraud, abuse, and violations of our Usage Policy, unlawful or criminal activity, unauthorized access to or use of personal data or Enigma Mind systems and networks, to protect our rights and the rights of others, to protect your safety or that of any other person, and to meet legal, governmental and institutional policy obligations;
To investigate and resolve disputes;
To investigate and resolve security issues;
To debug and to identify and repair errors that impair existing functionality;
To improve the Services and conduct research, including training our models and conducting broader research on AI-related topics such as the societal impacts of AI; and
To enforce our Terms of Service and similar terms and agreements, including our Usage Policy.

We may use your Inputs and Outputs to train and improve Enigma Mind AI models, unless you opt out through your account settings. Even if you opt-out, we will use Inputs and Outputs for model improvement when: (i) your conversations are flagged for safety review to improve our ability to detect harmful content, enforce our policies, or advance AI safety research, or (ii) you’ve explicitly reported the materials to us (for example via our feedback mechanisms).

Please see Section 10 below for details of our legal bases for processing your personal data.

3. Recipients and Third-Party Data Sources

Enigma Mind will disclose personal data to, or receive personal data from, the following categories of third parties for the purposes explained in this Policy:

Affiliates & corporate partners: Enigma Mind discloses the categories of personal data described above between and among its affiliates and related entities.
Service providers & business partners: Enigma Mind may receive and disclose the categories of personal data described above with service providers and business partners for a variety of business purposes, including website and data hosting, ensuring compliance with industry standards, research, auditing, data processing, investigating and resolving safety and security issues, preventing and investigating fraud, abuse, and violations of our Usage Policy, and providing you with the Services.
Your Organization and Administrator: If you use an email address owned by your employer or another organization, your account may be linked to the organization’s enterprise account with us, as described in our Consumer Terms of Service.

Enigma Mind may also receive or disclose personal data in the following circumstances:

As part of a significant corporate event: If Enigma Mind is involved in a merger, corporate transaction, bankruptcy, or other situation involving the transfer of business assets, Enigma Mind will receive or disclose your personal data as part of these corporate transactions.
Third-Party Websites, Integrations, and Services: Our Services allow you to connect to and interact with third-party applications, services, and content (“Third-Party Services”) via the Services and through integrations you enable, such as Connectors, plugins, webhooks, and external APIs. When you connect to or interact with Third-Party Services:
- Enigma Mind may send your Inputs, Outputs, and instructions to Third-Party Services to perform actions on your behalf (such as reading files, sending messages, or retrieving information). The Third-Party Service receives this data directly and processes it according to its own privacy policy.
- Enigma Mind may retrieve content and data from Third-Party Services you interact with. This data becomes part of your Inputs.
- Some integrations or features may allow Enigma Mind to access Third-Party Services on an ongoing basis until you disable the feature or disconnect the integration in your settings.

Enigma Mind does not control, and is not responsible for, the data practices of Third-Party Services. Before enabling an integration, granting Enigma Mind access to, or instructing Enigma Mind to take actions on a Third-Party Service, you should ensure you have the authority to grant such access and that doing so complies with any applicable terms, policies, or confidentiality obligations. Before enabling an integration, you should review the third party’s privacy policy. Our Services may also link to third-party websites (such as social media); by following these links, you provide information directly to those third parties. Our linking to, or supporting an integration with, a Third-Party Service does not mean we endorse it or speak for that third party.

Pursuant to regulatory or legal requirements, safety, rights of others, and to enforce our rights or our terms: We may share personal data with government authorities, law enforcement, or other third parties where, based on the information available to us, we have a good-faith belief that disclosure is reasonably necessary to (i) comply with applicable law, regulation or legal process, including for legal, tax or accounting purposes, or in response to an enforceable governmental request; (ii) prevent serious harm to any person or to property; (iii) detect, prevent, or otherwise address fraud or other illegal activity; or (iv) enforce our terms, or protect the rights, property, security, or safety of Enigma Mind, our users, or others.
Research publications: We may publish aggregated, de-identified, or anonymized findings from our research, including research into how our Services are used and AI safety research.
With an individual’s consent: Enigma Mind will otherwise disclose personal data when an individual gives us permission or directs us to disclose this information, including as a part of our Services.

You can find information about the third parties Enigma Mind engages to help us process personal data on Enigma Mind’s subprocessors page.

4. Rights and Choices

Depending on where you live and the laws that apply in your country of residence, you may enjoy certain rights regarding your personal data, as described further below. However, please be aware that these rights are limited, and that the processes by which we may need to action your requests regarding our training dataset are complex. We may also decline a request if we have a lawful reason for doing so. That said, we strive to prioritize the protection of personal data, and comply with all applicable privacy laws.

To exercise your rights, you or an authorized agent may submit a request by contacting us. After we receive your request, we may verify it by requesting information sufficient to confirm your identity (e.g. email address, billing details). Where a third party representative submits a request on behalf of a data subject, we require evidence of authorization to act on behalf of the data subject.

We will respond to your request within the period required by the data protection law that applies to you. For example, where the EU GDPR or UK GDPR applies, we will respond within one calendar month of receiving a verifiable request, and where your request is complex or you have made a number of requests within a short timeframe, we may extend that period by up to a further two months. Where another law applies to you and sets a different period, we will respond within that period. You may also have the right to appeal requests that we deny by emailing privacy@enigmamind.com. Enigma Mind will not discriminate based on the exercising of privacy rights you may have. Set out below is a summary of the rights which you may enjoy, depending on the laws that apply in your country of residence.

Right to know: the right to know what personal data Enigma Mind processes about you, including the categories of personal data, the categories of sources from which it is collected, the business or commercial purposes for collection, and the categories of third parties to whom we disclose it.
Access & data portability: the right to request a copy of the personal data Enigma Mind processes about you, subject to certain exceptions and conditions. In certain cases and subject to applicable law, you have the right to port your information.
Deletion: the right to request that we delete personal data collected from you when you use our Services, subject to certain exceptions. You also are able to delete individual conversations, which will be removed immediately from your conversation history and automatically deleted from our back-end within 30 days.
Correction: the right to request that we correct inaccurate personal data Enigma Mind retains about you, subject to certain exceptions. Please note that we cannot guarantee the factual accuracy of Outputs. If Outputs contain factually inaccurate personal data relating to you, you can submit a correction request and we will make a reasonable effort to correct this information—but due to the technical complexity of our large language models, it may not always be possible for us to do so.
Objection: the right to object to processing of your personal data, including profiling conducted on grounds of public or legitimate interest. In places where such a right applies, we will no longer process the personal data in case of such objection unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise or defense of legal claims. If we use your information for direct marketing, you can object and opt out of future direct marketing messages using the unsubscribe link in such communications.
Restriction: the right to restrict our processing of your personal data in certain circumstances.
Withdrawal of consent: Where Enigma Mind’s processing of your personal data is based on consent, you have the right to withdraw your consent. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
Automated decision-making: Enigma Mind does not engage in decision making based solely on automated processing or profiling in a manner which produces a legal effect (i.e., impacts your legal rights) or significantly affects you in a similar way (e.g., significantly affects your financial circumstances or ability to access essential goods or services).
Sale & targeted Enigma Mind marketing of its products and services: Enigma Mind does not “sell” your personal data as that term is defined by applicable laws and regulations. You can opt-out of sharing your personal data for targeted advertising to promote our products and services, and we will honor global privacy controls.

Enigma Mind gives you access to a variety of tools to help you manage your data. You can access these in your Privacy Settings.

5. Data Transfers

Enigma Mind is a global company, and when you access our Services, your personal data is transferred to our servers in the US, or to other countries outside the European Economic Area (“EEA”) and the UK for the purposes outlined in Section 2 of this Privacy Policy, for example to provide you with the Service, or to train our models, or to conduct research. This may be a direct provision of your personal data to us, or a transfer that we or a third party make.

Where Enigma Mind transfers information outside the EEA or the UK, we ensure it benefits from an adequate level of data protection by relying on:

Adequacy decisions: These are decisions from the European Commission under Article 45 GDPR (or equivalent decisions under other laws) where they recognize that a country outside of the EEA offers an adequate level of data protection. We transfer your information as described in “Collection of Personal Data” to some countries with adequacy decisions.
Standard contractual clauses: The European Commission has approved contractual clauses under Article 46 GDPR that allows companies in the EEA to transfer data outside the EEA. These (and their approved equivalent for the UK and Switzerland) are called standard contractual clauses. We rely on standard contractual clauses to transfer information as described in “Collection of Personal Data” to certain affiliates and third parties in countries without an adequacy decision.

In certain situations, we rely on derogations provided for under applicable data protection law to transfer information to a third country. If you have questions about international transfers, or the safeguards we apply, you can contact us.

6. Data Retention, Data Lifecycle, and Security Controls

Enigma Mind retains your personal data for as long as reasonably necessary for the purposes and criteria outlined in this Privacy Policy.

When the personal data collected is no longer required by us, we and our service providers will perform the necessary procedures for destroying, deleting, erasing, or converting it into an anonymous form as permitted or required under applicable laws.

Aggregated or De-Identified Information

We apply aggregation and de-identification techniques where appropriate as part of our data minimization practices. For example, we may process personal data in an aggregated or de-identified form to analyze and improve the effectiveness of our Services including to conduct analytics, conduct research, study user behavior, and train our AI models as permitted under applicable laws. For instance:

When you submit Feedback, we disassociate Inputs and Outputs from your user ID to use them for training and improving our models.
If our systems flag Inputs or Outputs for harmful content or for potentially violating our policies, we disassociate the content from your user ID to train our trust and safety internal classification and generative models. However, we may re-identify the Inputs or Outputs to enforce our Terms of Service or Usage Policy with the responsible user if necessary.
To improve user experience, we may analyze and aggregate general user behavior and usage data. This information does not identify individual users.

Where data is de-identified, Enigma Mind will maintain and use this information in its de-identified form, and will not attempt to re-identify such information, except as permitted by law.

Security Controls Relating to our Processing of Personal Data

We implement appropriate technical and organizational security measures designed to protect personal data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction.

7. Children

Our Services are not directed towards, and we do not knowingly collect, use, disclose, sell, or share any information from children under the age of 18. We have measures in place to detect and remove children from our Services. If you become aware that a child under the age of 18 has provided any personal data to us while using our Services, please email us at privacy@enigmamind.com and we will investigate the matter and, if appropriate, delete the personal data.

8. Changes to Our Privacy Policy

Enigma Mind may update this Privacy Policy from time to time. We will notify you of any material changes to this Privacy Policy, as appropriate, and update the Effective Date at the top of enigmamind.com/legal/privacy. You can view a summary of privacy policy changes and previous versions in our Privacy Center.

9. Contact Information

If you live in the European Economic Area (EEA), UK or Switzerland (the “European Region”), the data controller responsible for your personal data is SCL Holdco Inc. If you live outside the European Region, the data controller responsible for your personal data is SCL Holdco Inc.

If you have any questions about this Privacy Policy, or have any questions, complaints or requests regarding your personal data, you can email us at privacy@enigmamind.com and contact our Data Protection Officer at dpo@enigmamind.com.

Please note that under many countries’ laws, you have the right to lodge a complaint with the supervisory authority in the place in which you live or work. A full list of EU supervisory authorities’ contact details is available via the European Data Protection Board. If you live or work in the UK, you have the right to lodge a complaint with the UK Information Commissioner’s Office. If you live in Brazil, you have the right to lodge a complaint with the Brazilian Data Protection Authority (ANPD). If you live in Australia, you have the right to lodge a complaint with the Office of the Australian Information Commissioner.

10. Legal Bases for Processing

Purpose	Type of Data	Legal Basis
To provide, maintain and facilitate any products and services offered to you with respect to your Enigma Mind account, which are governed by our Terms of Service	Identity and Contact Data; Payment Information; Feedback; Inputs and Outputs; Technical Information	Contract
To provide, maintain and facilitate optional services and features that enhance platform functionality and user experience	Identity and Contact Data; Feedback; Study Participation Data; Inputs and Outputs; Technical Information	Consent (for example for precise device location or for health app integrations); Legitimate interests — it is in our and our users’ legitimate interests to expand our product features and deliver additional services that enhance platform functionality and user experience.
To provide you with service updates, communications, and to provide tailored recommendations about our Services that may be of interest to you	Identity and Contact Data; Communication Information; Technical Information; Study Participation Data	Necessary to perform a contract with you (e.g., technical announcements); Your consent where we ask for it (e.g., certain marketing communications); Legitimate interests — it is in our legitimate interests to promote our Services, including sending direct marketing.
To create and administer your Enigma Mind account	Identity and Contact Data; Payment Information; Feedback; Verification Data	Contract
To facilitate payments for products and services provided by Enigma Mind	Identity and Contact Data; Payment Information	Contract
To prevent and investigate fraud, abuse, and violations of our Usage Policy, unlawful or criminal activity, unauthorized access to or use of personal data or Enigma Mind systems and networks, to protect our rights and the rights of others, to protect your safety or that of any other person, and to meet legal, governmental and institutional policy obligations	Identity and Contact Data; Payment Information; Inputs and Outputs; Technical Information; Verification Data; Study Participation Data	Consent (e.g., biometric verification); Legitimate interests; Legal obligation; Vital Interests — it is in our legitimate interests to protect our business, employees and users from illegal activities, and we have a duty to cooperate with authorities.
To investigate and resolve disputes	Identity and Contact Data; Payment Information; Inputs and Outputs; Feedback; Technical Information; Study Participation Data; Communication Information	Legitimate interests; Legal obligation — it is in our legitimate interests to understand and resolve customer complaints to improve user satisfaction; we also have a legal obligation in some cases.
To investigate and resolve security issues	Identity and Contact Data; Payment Information; Feedback; Technical Information; Inputs and Outputs; Study Participation Data; Communication Information; Verification Data	Legal obligation; Legitimate interests — it is in our legitimate interests to protect user data and our systems from intrusion or compromise; we also have a legal obligation to provide adequate security safeguards.
To debug and to identify and repair errors that impair existing functionality	Identity and Contact Data; Feedback; Technical Information; Inputs and Outputs	Legitimate interests — it is in our legitimate interests to maintain continuous functioning of our services and rapid correction of problems.
To improve the Services and conduct research (excluding model training)	Identity and Contact Data; Feedback; Study Participation Data; Technical Information; Inputs and Outputs	Scientific Research; Legitimate interests — it is in our and our users’ legitimate interests to evaluate the use of the Services and inform development of future features; our research also benefits the AI industry and society.
To improve the Services and conduct research (including model training). See the Non-User Privacy Policy for more details.	Feedback; Study Participation Data; Inputs and Outputs; Data provided through the Development Partner Program	Scientific Research; Consent; Legitimate interests — it is in our and our users’ legitimate interests to evaluate the use of the Services and inform future development; our research also benefits the AI industry and society.
To enforce our Terms of Service and similar terms and agreements, including our Usage Policy	Identity and Contact Data; Inputs and Outputs; Technical Information; Study Participation Data; Verification Data	Contract; Legitimate interests — in certain circumstances outside performance of our contract with you, it is in our legitimate interests to enforce the rules and policies governing use of our services.

Table: Use of personal data and corresponding legal bases for processing.