Last updated September 24, 2026
Privacy Policy
What MindMap collects, why, who helps us run it, and what you can ask of us. Written to be read, not skimmed past.
Who we are
MindMap (mindmap.diil.ai) is run by Diil OÜ, a company in Estonia. We decide how and why your personal data is used, which makes us the controller under the EU General Data Protection Regulation (GDPR). For anything about your data, write to privacy@diil.ai.
What we collect
Your account
- Your name and email address.
- Your password, stored only as a salted scrypt hash. We cannot read it and never store it in plain text.
- If you sign in with Google: your Google account ID, name, email address and profile picture link, which Google shares when you choose to sign in that way.
What you make
- The plans and prompts you type, and the boards, cards and projects you create or edit.
- How many AI prompts you have used this month, so we can apply your plan's allowance.
Your subscription
- Your Stripe customer ID, plan, billing interval and renewal date. Card details go straight to Stripe; we never see or store them.
Technical data
- When you use the site, our hosting provider records technical data such as your IP address, browser type and the pages requested, to deliver the site and keep it secure.
We do not use analytics, advertising or tracking tools, and we do not sell your data.
Why we use it, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Running your account and your boards | Account, what you make | Contract, Art. 6(1)(b) |
| Turning your text into boards with AI | Prompts and board content | Contract, Art. 6(1)(b) |
| Plans, billing and prompt allowances | Subscription, usage | Contract, Art. 6(1)(b) |
| Keeping accounting records | Subscription records | Legal obligation, Art. 6(1)(c) |
| Security, preventing abuse, fixing faults | Technical data, account | Legitimate interests, Art. 6(1)(f) |
AI processing
To build or refine a board, we send your prompt, and for refinements the current board's cards, to Google's Gemini API, and store the board it returns. No one at MindMap reads your boards in the normal course of running the service.
MindMap currently uses Google's free Gemini API tier. Under Google's terms for that tier, Google may use the content sent to it to provide, improve and develop its products, and people at Google may review it. Please do not put sensitive personal data, such as health information or other people's private details, into your prompts. We will update this section when we move to a paid tier.
Who processes data for us
We use a small number of providers to run MindMap. They may only use your data to provide their service to us, except where noted.
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting the website and app, server logs | United States |
| Neon (Databricks, Inc.) | The database that stores accounts and boards | United States (AWS us-east-1) |
| Google LLC | Gemini API for AI boards; Sign in with Google | United States and elsewhere |
| Stripe | Payments and subscriptions. Stripe acts as the seller of record for MindMap Pro, handles VAT and uses your payment details under its own privacy policy. | EU, United States |
International transfers
Some of these providers process data in the United States. Where they do, the transfer relies on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
How long we keep it
- Your account, boards and projects: until you delete them or your account.
- When you delete your account (Settings, then Delete account) we cancel any subscription and remove your account, boards and projects from our database straight away.
- Records we are legally required to keep for accounting are kept for as long as the law requires, in Estonia up to seven years.
- Server logs are kept by our hosting provider for a short period, typically days.
Your rights
Under the GDPR you can ask us to:
- give you a copy of your personal data (access and portability);
- correct it (you can change your name and password yourself in Settings);
- delete it (you can delete your account yourself in Settings);
- restrict or object to how we use it.
Write to privacy@diil.ai and we will reply within one month. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the authority where you live.
Cookies
MindMap uses only the cookies it needs to work, such as the one that keeps you signed in. See the Cookie Policy for the full list.
Children
MindMap is not meant for children under 13, and we do not knowingly collect their data. If you think a child has given us personal data, write to privacy@diil.ai and we will delete it.
Changes
If we change how we handle your data, we will update this page and the date at the top. For significant changes we will also let account holders know in the app.