You are using MindShift Zoom Review. MindShift Zoom Review runs on the MindShift Platform, software operated by MindShift Agency, a Texas limited liability company ("MindShift", "we", "us").
The platform hosts coaching and business-development providers, each on its own website. This policy explains what we do with your personal data on any of those sites: what we collect, why, who can see it, where it is kept and what your rights are. A plain-language summary is on Your data, plainly.
1. Who is responsible for your data
MindShift holds your account, your person record and the content you create on the platform. Your account works on every site that runs on the platform, and your own content follows you from one site to another.
Each provider you work with holds a copy. When you become a client of a provider, its staff can see some of your data (section 6) and use it to work with you. How a provider uses what it sees, for example in coaching sessions or its own records, is that provider's responsibility. You can ask a provider to delete its copy (section 10).
Businesses. When someone creates a business on the platform, the business's owner decides who in the business can see its boards.
2. How to contact us
For privacy questions and requests, email support@mindshiftagency.com. Please write from the email address on your account, so we can find your data.
3. What we collect
Account information. Your email address, your password (stored only as a secure hash), your name and profile photo, the sites you belong to and your role on each, and the learning preferences you choose to give (language, locale, education level, age band).
Your person record. Your name, preferred name, email and phone, and your birth date, birth time (and whether it is estimated), birth place, its coordinates and your time zone. You can enter these yourself, and the staff of a provider you work with can enter or correct them.
Where person records come from. A person record can be created by you, by the staff of a provider you work with, or by MindShift, for example when we prepare a report. Some records are of public figures, made from publicly available birth information. If we hold a record about you that you did not create, you have the same rights over it as over any other data we hold (section 10).
Charts. The Human Design and Vedic astrology charts we calculate from your birth data. We calculate them automatically whenever your birth data is saved, on any site. You and MindShift administrators can see them; a provider's owners, admins and coaches can see them only if that provider's plan includes charts.
What you create. Journal entries and drafts; Compass beliefs, mission, vision and values; Wealth Wheel scores and notes; Desire Matrix goals, notes and tasks; learning progress and quiz answers; and what you write on boards in a business workspace, including any business figures you paste in.
Your planning tools. If MindShift Zoom Review offers them: your weekly focus (your one move, your three priorities, your energy, your wins, what you learned and whether you want help), your check-ins, your monthly game plan, your personal goals, and your private answers, such as the time quiz and the part of a quarterly review about your own life. These are yours, not the business's, even when you write them while working in a business's workspace.
Events. If MindShift Zoom Review runs an event, such as a planning event, and you are registered for it: your email address, the event and its year, your ticket level (for example VIP or General), when you claimed your place, and which of the site's team registered you. If the event has worksheets, we also keep your answers.
Advisor notes. If a business works with advisors from a provider, those advisors can write notes and homework on the business's workspace. These are about the business's work, not your private planning.
Community posts. If MindShift Zoom Review runs a community and you join it: the display name you choose, an optional short bio, whether you appear in the member directory, your posts, replies and reactions, and any reports you make, with your reason.
Sharing and consent records. Who you have shared a desire or a board with, invitations you have sent (including the invitee's email address), and a record of when you agreed to join a provider and which version of that wording you saw.
What you accepted. Which version of our Terms and this policy you accepted, and of the statements you confirm on screen (for example when you join a community or save an AI key), with the date and the site. Only you and MindShift administrators can see this record.
AI settings. If a provider or a business connects its own account with an AI service, we store that account's key encrypted. Only its last four characters are ever shown, and it is deleted when it is removed.
Records we keep to run the service safely. A record of every change made to person records and reports. A record whenever a MindShift administrator views the platform as you in order to help you. The requests MindShift administrators make with the AI drafting tool, with the chart details they used. Error reports when something breaks (section 7). The cookies that keep you signed in (see the Cookie Notice).
What we do not collect. We use no analytics or advertising trackers. We do not ask for your gender. We do not collect your location, other than the birth place you give us. If a provider takes payments through the platform, card details go to our payment processor, Stripe, and never to us.
Sensitive information
What you write in your journal, Compass or other reflections can reveal your health, beliefs, relationships or other personal matters, and Human Design and astrology can reflect spiritual or philosophical beliefs. We treat all of it as sensitive: your journal is visible only to you (apart from MindShift administrators, only to support you or keep the service secure), and we never use any of it for advertising or sell it.
4. Why we use it
| Purpose | What we use | Legal basis (GDPR) |
|---|---|---|
| Create and run your account, sign you in and keep it secure | Account information, security records | Performing our contract with you; our legitimate interest in security |
| Provide the tools you use: journal, charts, goals, boards, learning | Your person record and your content | Performing our contract with you |
| Calculate your charts | Your birth data | Performing our contract with you |
| Show your data to the providers you work with and to the people you share with | See section 6 | Performing our contract with you, and your agreement when you join a provider |
| Connect your data across your tools to personalise your experience (section 5) | Your own content | Performing our contract with you, or our legitimate interest in a service that works together; you can object |
| Run a provider's community | Community profile, posts and reports | Performing our contract with you; our legitimate interest in keeping the community safe |
| Send service emails: sign-in links, password resets, invitations and notices | Your email address and name | Performing our contract with you |
| Fix errors and keep the service reliable; keep records of changes | Error reports, change records | Our legitimate interest in a secure, accountable service |
| Take payments, where a provider charges through the platform | Email, business name, purchase records | Performing our contract with you; our legal obligations for tax records |
| Meet legal obligations and defend legal claims | What is needed | Legal obligation; our legitimate interest |
We do not sell your personal data, share it for advertising, or use it to train AI models. We do not make decisions about you by automated means alone that have legal or similarly significant effects.
5. Connecting your data across your tools
The platform is built so your tools can work together: for example, suggesting journal prompts from goals you set on a board. When we connect your data this way:
- It only ever uses what the person seeing the result is already allowed to see. Something made for you uses only your own data and what has been shared with you; it never shows a coach, a teammate or another provider anything you have not shared with them.
- It happens inside the platform and does not send your data to anyone new.
- When your charts are used to tailor what you see, a provider whose plan doesn't include charts still doesn't see them.
- You can ask us to stop by emailing support@mindshiftagency.com.
6. Who can see your data
| Who | What they can see |
|---|---|
| You | Everything that is yours, on every site that runs on the platform. |
| A provider you are a client of (its owners, admins and coaches, and analysts where relevant) | Your person record, including birth data, and, if that provider's plan includes charts, your charts; the Compass and Wealth Wheel entries you create on that provider's site (if the provider keeps these tools private, as it can choose to, only once you share them with it, and only while you're linked to it); reports about you from that provider; anything you share with that provider. Not your journal, not your planning tools unless you share them, and not entries you made at other providers. |
| Another provider you join | Only after you agree on its "Join" screen, which lists what is shared: your person record (name, contact details and birth data), and, if their plan includes charts, the charts made from it. |
| People you share with | Only the desire or board you share, at the level you choose (view or edit), until you stop sharing. Personal goals are shared view only. |
| Your planning tools | Only you, unless you share them. Your weekly focus has two separate switches: one shares that week with the members of the business who can see its plan, the other with the business's advisors at MindShift Zoom Review. Your personal goals can be shared, view only, with a named member of a business, all its members, or a provider's team. Your check-ins and your private answers are never shared. |
| Members of your business | The business's boards and records in the parts of its workspace that their access level allows, and anything shared with them. |
| The provider a business chooses | The boards the business's owner shares with that provider's staff. Its coaches can add notes that only their team and MindShift see. Staff the business gives an access level (its advisors) can see and work in the parts of the business's workspace that level allows, and can write notes that only their own team and MindShift see, not the business or its members, and homework that the business's members who can see that part of the workspace see. |
| An event you are registered for | Your registration (email, ticket level and when you claimed your place) is seen by you and MindShift Zoom Review's owners and admins. Your worksheet answers are seen only by you. |
| Members of a community you join | Your display name, your posts and replies, and your reactions (a reaction shows who reacted); your directory entry and bio only if you turn the directory on. Posting or reacting makes you visible to members even if you are not in the directory. |
| Community moderators (MindShift Zoom Review's owners and admins, and MindShift) | Everything in the community, including reports and who made them, and posts their authors have deleted. The author of a reported post is not told who reported it; if you make a report, you can see its status and any note the moderators add when they resolve it. |
| MindShift administrators | The data needed to run and support the service, including event registrations, except what they cannot see: your planning tools, including your private answers; your event worksheet answers; if MindShift Zoom Review offers business finances, your personal budget and the files you upload to import a profit and loss statement; and the AI keys a provider or business saves. They use it to support you, keep the service secure, and run and fix it. When an administrator views the platform as you, it is recorded. |
| Our service providers (section 7) | Only what each needs for its job, under contract with us. |
| Authorities | Only where the law requires it. |
Profile photos are public. Anyone who has the web address of your photo can open it, so do not upload one you want kept private.
If a provider leaves the platform, your record stays with MindShift and that provider's access ends.
7. The services we use
| Service | What it does for us | What it receives |
|---|---|---|
| Supabase | Database, sign-in and file storage (United States) | The data described in this policy |
| Vercel | Website hosting (United States) | Your requests to the site |
| Fly.io | Chart calculation (United States) | Birth date, time, time zone offset and coordinates, without your name |
| Mailgun | Sending invitations and notices (United States) | The recipient's address and the message |
| Zoom | Embedded live sessions, where a provider connects Zoom (United States; meeting traffic may pass through Zoom's data centres in other countries) | Your IP address and browser information when a session page opens; when you join, your display name and the audio, video, screen shares and chat you send in the meeting |
| Sentry | Error reports | Your user id, the page address with sign-in codes removed, your browser type and the technical error; no cookies, form contents or other personal details |
| OpenStreetMap Foundation (Nominatim) | Finding a birth place as you type it | The place text you type, or a birth place's coordinates |
| OpenCage | Finding a birth place's coordinates | The birth place text |
| TimezoneDB and timezoneapi.io | Finding the time zone in force at a birth date and place | A time zone name and the birth date |
| PDFShift | Creating report PDFs | The report's content, which includes the person's name and chart |
| OpenAI | AI-assisted drafting, used by MindShift administrators when preparing reports | The request and the chart details it uses; a person's name and birth details only if the administrator includes them |
| Stripe | Payments, where a provider charges through the platform | Your email address and the business's name |
Sign-in emails (links, password resets, email changes) are sent by Supabase's authentication service.
AI accounts that are not ours. If a provider or a business connects its own account with an AI service (Anthropic or OpenAI), the AI features it offers run on that account: the data those features need is sent to that AI service under the provider's or business's own agreement with it. If a business has not connected an account, those features stay off; we never fall back to ours.
Lesson videos. Some lessons embed videos from YouTube or Vimeo. They load in privacy-enhanced modes (see the Cookie Notice); YouTube and Vimeo receive your IP address when a video loads, under their own privacy policies.
Zoom live sessions, when enabled. Opening an embedded session loads software from Zoom, which receives your IP address and browser information. When you choose to join, Zoom receives your display name (the full name on your profile, or "Guest" if you haven't set one; never your email address), audio and video you enable, screen shares and meeting chat under the host's Zoom settings. The host controls meeting permissions and any recording in Zoom. Our platform does not copy meeting recordings or chat history in this release. A Zoom login is not required for guests in supported sessions; your site account is still required.
Connected Zoom hosts. If a provider connects Zoom, we keep the host's Zoom user and account IDs, the name and email address on their Zoom profile, which of the site's admins connected it, and the meetings chosen for the site. OAuth credentials and imported passcodes are encrypted in server-only storage. Disconnecting removes that site's meeting bindings; the last active connection removes the saved credentials. Connection metadata remains for reconnection until Zoom deauthorization or account erasure removes it. Unfinished authorizations expire after 10 minutes; their records are removed about a day later, and one-way codes we keep to recognise a host who removed our app in Zoom are removed after 30 days. A host can connect the same Zoom account to more than one site, and disconnecting one site leaves the others connected. If an admin on one site starts reconnecting that Zoom account and doesn't finish, every site using it may need to reconnect.
8. Where your data is processed
We and our core hosting providers are in the United States, so if you use the platform from the EU, the UK or elsewhere, your data is processed in the United States. Some of the other services listed above process data in the UK or the EU. Where the law requires a safeguard for these transfers, we rely on those offered in our providers' terms, such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
9. How long we keep it
| Data | How long |
|---|---|
| Your person record, birth data and charts | Until you ask us to delete them. Closing your account or ending a subscription deletes nothing, so your charts and history are there if you come back, and the providers you work with keep their records of you. |
| Your content (journal, Compass, Wealth Wheel, desires, learning, boards) | Until you delete it or ask us to delete it. |
| Your planning tools and event worksheet answers | Until you delete them or ask us to delete everything. They stay yours if you leave a business, and you can still see them. |
| Event registrations | Until you ask us to delete everything. |
| A connected Zoom host's IDs, name and email | Until the host removes our app in Zoom, or the site admin who connected it asks us to delete everything. Disconnecting a site removes its meetings and, once no site is connected, the saved Zoom sign-in, but not these details. |
| Records of unfinished Zoom connections, and the one-way codes for hosts who removed our app | About a day after the connection attempt ends, and 30 days. |
| What you contributed to a business's company records in its workspace (such as its strategy, values, goals, plans and client records) | As long as the business keeps them. They belong to the business: if you leave it, or ask us to delete everything, they stay and keep showing your name. |
| Board history | The last 50 saved versions of each board section. |
| Invitations | An invitation stops working after 7 days or when it is revoked. The record, including the invitee's email address, is deleted 90 days after the invitation ends. |
| Community posts you delete, and reports | A deleted post or reply disappears for members at once; moderators can still see it. 90 days later we permanently wipe it: its words and your name are removed, and replies other members wrote stay. A report is deleted 12 months after it is resolved or dismissed. |
| Records of changes to person records and reports | Until the record itself is deleted (we remove them within a day of that), and never more than two years. |
| Requests made with the AI drafting tool by MindShift administrators, with the chart details they used | 12 months. |
| Error reports and server logs | For a limited period set by each service provider, then deleted. |
| Payment and tax records | As long as tax law requires. |
We don't delete accounts; we suspend access. If MindShift suspends you, you can't sign in on any site; if a provider suspends you, you lose access to that provider's site and its linked businesses only. Either way your data is kept, and the suspension can be lifted. Apart from content you delete yourself, a provider's copy you ask that provider to remove, and a business's records its owner asks us to delete, your data is deleted only when you ask us to delete everything.
Asking us to delete everything
- Email support@mindshiftagency.com from the address on your account. If you have no account, tell us who you are so we can find your record.
- Within one month, we permanently delete everything personal to you on every site: your person record, birth data and charts, your links to providers, reports, everything in your personal tools (such as your journal, Compass, Wealth Wheel, desires, personal goals and planning tools), your event registrations and worksheet answers, the boards you own in the Boards tool and the Money records you own in a business, the records of changes to them, and your login.
- Company records stay with the company. If you work in a business's workspace on MindShift Zoom Review, what you contributed to its company records (the records that make up its workspace, such as its strategy, values, goals, plans and client records) belongs to that business. We keep it so the business keeps its own history, and it goes on showing your name as its author, but not your email address or other contact details. Only the business's owner can ask us to delete the business's own records. For now this doesn't cover boards you own in the Boards tool or Money records you own; those are deleted with everything personal to you.
- Payment records we must keep for tax purposes are also kept, without your name or email, and only for as long as tax law requires.
- We also keep a note that an erasure happened: the date, which of our administrators carried it out, and a scrambled (hashed) form of your email address, so your data is not re-imported by mistake. It cannot be turned back into your address.
- We tell the providers who could see your data that it has been deleted.
- Copies in our backups are removed as those backups expire on our hosting provider's schedule, and are not used in the meantime.
- An erasure request always wins, including for public-figure records and records a provider created about you.
10. Your rights
Wherever you live, you can ask us to:
- show you the data we hold about you and give you a copy, in a portable format;
- correct it (you can change most of it yourself in Settings);
- delete it (section 9);
- stop using it for a purpose based on our legitimate interests, including connecting it across your tools (section 5);
- restrict how we use it while a concern is being resolved;
- remove a provider's copy: the provider's access to your record and the reports and notes its staff made about you, while your MindShift record stays.
Where we rely on your agreement, you can withdraw it at any time; that does not affect what happened before. To make any of these requests, email support@mindshiftagency.com from the address on your account. We may ask you to confirm it's you, and we reply within one month.
You can also complain to a data protection authority, such as the one in the country where you live.
11. Security
Access rules are enforced inside the database, so each person and each provider sees only what they are allowed to. Connections are encrypted, secrets are kept in a password vault, our error reports strip personal details, and automated checks run on every change to the code. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.
12. Age
The platform is for people aged 18 and over. We do not knowingly hold data about anyone younger who has an account; if you believe a minor has one, email us and we will delete it.
13. Changes to this policy
When we make a material change, we will tell you in the app or by email before it takes effect. The "Last updated" date at the top shows the current version.