Privacy Policy

Everything in this policy falls into one of two categories. They're governed differently, and the difference matters more here than at most companies.

1. Information we collect about you. Your email address, your account details, your consent choices, the technical records our systems need to run and stay secure. We decide what happens to this, so we're accountable for it, and the rest of this policy — what we collect, why, how long, your rights — is about this category.
2. What's in your brain. The records, documents, files and connections you or your AI session put there. This is yours. We hold it for you; we don't own it and we don't decide what happens to it. You do. We process it only to run the service you asked us to run, on your instructions.

In legal terms, we're the controller of the first category and merely a processor of the second. In plain terms: the first is our information about you, and the second is your information that happens to live on our machines.

What that means in practice:

Our staff do not access the contents of your brain for support. Not to troubleshoot, not to help you find something, not on request through a support channel. We maintain the system; we don't read what you keep in it. Access is restricted at the database itself, so the wall doesn't depend on our good behavior alone. If you want an Alexandria Mind specialist working inside your brain, that's separate work you commission, with access you grant and can revoke — never something support does on its own initiative.

Because we don't look, we can't confirm or validate what's in your brain — not its accuracy, not its completeness, not whether something you expected to be there actually is. That's yours to verify. The same is true of backups: we hold encrypted copies, and we still can't tell you what's inside one.

You don't have to ask us for your brain contents. Exporting or deleting them isn't a request you file with a company — it's a function of the product, and after beta you can take the whole thing and run it yourself. The rights section below is about category one, because category two was never ours to give back.

We do not train models on your brain's contents. Ever. And when you connect your own AI assistant, what you share with it goes to that provider under their terms — please make sure their training setting is off.

If your employer provides your brain, your employer is the owner of its records, and your own judgment and experience remain yours.

We protect your information with the standard measures you'd expect, and we'd rather describe them plainly than claim more than we do. Traffic to and from this site is encrypted. Your information is stored with Supabase and Vercel, who encrypt data at rest. Access to the database is restricted by the database itself, not just by our application, and only people who need access have it. Our off-site backups are encrypted with a key we hold ourselves.

No system is perfectly secure, and we won't pretend otherwise.

If we discover a breach affecting your personal information, we'll investigate immediately and tell you what happened, what was affected, and what we're doing about it — without undue delay, and within the timeframes the law requires. Where a breach must be reported to a data protection authority, we report it within 72 hours of becoming aware, as EU and UK law require.

We'd rather tell you early and imperfectly than late and neatly.

Your email address: your consent, which you can withdraw at any time by emailing us. Withdrawing it doesn't affect anything we did while it was valid.

The user-agent string our form collects to block automated spam: our legitimate interest in keeping the site from being flooded by bots. It isn't used for anything else.

We're based in the United States and your information is stored there. If you're in the EU or UK, submitting your email means it's transferred to the US.

When you ask us to delete your information, we remove it from our live systems right away.

Backups are a separate thing, and we'd rather explain than gloss over it. We keep encrypted backups for up to 30 days so we can recover from a disaster. A backup is a sealed snapshot — it can't be edited without destroying the thing that makes it a valid backup — so your information may sit inside one until it expires. Those backups are never read, searched, or used for anything except restoring the system. And if we ever do restore one, we re-apply every deletion request before the system serves anyone again, so anything you asked us to delete stays deleted.

If you're in the EU or UK, you have the right to access your data, correct it, delete it, restrict or object to how we use it, receive a copy in a portable form, and withdraw consent at any time. You can also complain to your local data protection authority — in the UK, the Information Commissioner's Office.

If you're in California, you have the right to know what we collect, to delete it, to correct it, and not to be treated differently for exercising those rights. We do not sell or share personal information, as those terms are defined under California law, and we never have.

Everyone, regardless of location, gets all of the above. Email admin@alexandriamind.ai. No forms, no conditions, no account required. We'll respond within 30 days.

This site isn't intended for anyone under 16, and we don't knowingly collect information from them. If you believe a child has given us their information, email us and we'll delete it.