MindyCart Privacy Policy

Effective Date: April 20, 2026 Last Updated: July 11, 2026

This Privacy Policy describes how Reluminate Labs LLC, a Utah limited liability company doing business as MindyCart ("MindyCart," "we," "us," or "our"), collects, uses, and shares information when you use the MindyCart website, applications, and services (the "Service").

By using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service. Our Terms of Service govern the contractual relationship between us.

1. Who We Are

MindyCart is a U.S.-based AI shopping-assistance service. Our AI assistant, Mindy, helps you plan your shopping and builds carts at third-party retailer websites on your behalf. You then complete checkout with the retailer directly. We are the controller of the personal information you provide while using the Service.

The Service is currently offered only to U.S. residents age 18 or older. If we expand to additional regions in the future, we will update this Policy.

2. Information We Collect

2.1 Information You Provide

• Account information: name, email address, password (hashed), or Google OAuth identifier.
• Profile and preferences: household size, your chosen retailer and store (e.g., a Walmart store by ZIP code), shopping preferences (such as dietary preferences, allergies, or cuisines you like or want to avoid), items to keep on hand ("staples"), and any other preferences you share with Mindy.
• Chat and session content: the messages you send Mindy, the meal plans and shopping lists generated in response, recipes Mindy writes, and shopping reports — stored as Markdown files you can view and edit in the Service.
• Support communications: information you send when you contact us.

2.2 Information Collected Automatically

• Usage data: pages viewed, features used, approximate geographic region, referring URL, device type, browser type, operating system, and timestamps.
• Technical/log data: IP address, session identifiers, and error logs.
• Cookies and similar technologies: see Section 6.

2.3 Information From Third Parties

• Authentication providers: if you sign in with Google, we receive basic profile data (name, email, profile image, Google ID) as authorized by you during OAuth consent.
• Payment processor: Stripe tells us the status of your subscription and a payment-method token, but we do not receive or store your full card number.

2.4 Information We Do Not Collect

• We do not collect, store, or transmit your retailer login credentials (for example, your Walmart username or password). Mindy builds a pre-filled cart and hands you a claim link; you log in to the retailer yourself and check out on the retailer's website.
• We do not collect or process payment for the products you buy. Payments for retailer purchases are made by you directly to the retailer at checkout.
• We do not collect children's data. The Service is not directed to anyone under 18. See Section 11.

3. How We Use Your Information

We use your information to:

• Provide the Service: authenticate you, run Mindy sessions, generate meal plans and shopping lists, build retailer cart links, deliver notifications, and remember your preferences.
• Process subscriptions and billing: through Stripe (see Section 5).
• Communicate with you: transactional messages such as cart-ready notifications, billing receipts, account and security alerts, and support responses. If you opt in, product updates and marketing.
• Improve the Service: we use aggregated and anonymized information (for example, the average number of items per cart, feature-adoption rates, error rates) to understand usage and improve the product. We do not use your personal chat content, meal plans, preferences, or shopping data to train AI models.
• Keep the Service safe: detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms.
• Comply with law: respond to lawful requests, enforce our rights, and meet legal obligations.

4. Who We Share It With (Subprocessors)

We share the minimum information necessary with trusted service providers who help us operate the Service. These providers are contractually required to protect your information and use it only for the purposes we specify.

We may add, remove, or replace subprocessors over time. Changes are reflected here and take effect when posted (Section 13).

4.1 Other Disclosures

We may also disclose information:

• In response to lawful requests (subpoenas, court orders, government demands) or to comply with legal obligations.
• To enforce our rights or the Terms of Service, or to protect the safety, rights, or property of MindyCart, our users, or others.
• In connection with a business transaction such as a merger, acquisition, financing, or sale of assets. We will notify you of a material change in controllership through the process in Section 13.

4.2 Advertising and Analytics Partners

The partners below are different from the subprocessors in the table above. They use data from our website for their own purposes as well as ours, which makes them independent "controllers" of that data rather than our service providers. Their use of it is governed by their own privacy policies, and California law may treat our use of them as "sharing" or "selling" your personal information. Section 4.4 explains how to opt out.

4.3 What We Do Not Do

• We do not sell your personal information for money.
• We do not share your chat content, meal plans, recipes, shopping lists, or preferences with advertising partners. The advertising and analytics partners in Section 4.2 receive interaction and identifier data, never the contents of your account.
• We do not use your personal chat content, meal plans, preferences, or shopping data to train AI models, and our AI subprocessors are contractually barred from doing so. (Microsoft may use non-personal data derived from Clarity's measurement of our public pages for its own product development, including machine-learning purposes. This does not include anything from inside your account.)

4.4 Your Opt-Out Choices

• Global Privacy Control (GPC). We honor the GPC browser signal. When your browser sends it, we do not load the Meta Pixel or Microsoft Clarity for your visit, so neither advertising partner in Section 4.2 receives any data about you. (Error monitoring via Sentry still runs — it is necessary to operate the Service, it is not used for advertising, and its recordings are masked.)
• Microsoft Clarity can also be opted out of via the Digital Advertising Alliance opt-out page.
• Meta ad personalization can be adjusted in your Facebook ad preferences.
• You may also email us at support@reluminatelabs.com to request that we stop sharing your information, as described in Section 9.

5. Payment Information

Payments are processed by Stripe, Inc. Stripe receives your payment method and billing information directly; MindyCart does not see or store your full card number. Stripe's handling of your information is governed by Stripe's own privacy policy at stripe.com/privacy.

6. Cookies and Analytics

We use a small number of first-party cookies required to keep you signed in and to remember your session.

To understand and improve the Service, we use:

• Vercel Analytics — privacy-friendly page analytics. No cross-site advertising cookies.
• Sentry — error monitoring, plus masked session diagnostics. All text and input in those recordings is masked in your browser before it is sent (see Section 4).
• Microsoft Clarity — heatmaps and session replays of our public pages only, using first-party cookies. Clarity does not run inside your signed-in account. See Section 4.2.

To measure our advertising, we use the Meta Pixel, which sets cookies and collects device and browser identifiers. See Section 4.2.

Your choices:

• We honor the Global Privacy Control (GPC) browser signal. When your browser sends it, we do not load the Meta Pixel or Microsoft Clarity for your visit.
• Additional opt-outs for each partner are listed in Section 4.4.
• Most browsers let you refuse or delete cookies; disabling essential cookies will prevent you from signing in.

If we add analytics or advertising tools beyond these, we will update this Policy (Section 13) and, where required by law, seek your consent or provide an opt-out.

7. Data Retention

7.1 Active Accounts

We retain your information for as long as your account is active and as needed to provide the Service.

7.2 Account Deletion

You can delete your account at any time from Settings → Delete account. You will be asked to type DELETE to confirm. When you confirm:

• Your active subscription (if any) is immediately canceled at Stripe; you will not be billed again.
• Your profile, preferences, chat history, meal plans, shopping lists, recipes, sessions, and shopping reports are permanently deleted from our database and file storage at the time of deletion. There is no grace period.
• Your authentication record is deleted. The same email address may sign up again as a new account.

We retain a small deletion audit record containing your former user identifier, email address, deletion timestamp, and a flag for each step that completed. This record exists for fraud protection, chargeback handling, and App Store / regulatory compliance evidence. Access is restricted to Reluminate Labs administrative roles. The audit record is automatically purged seven (7) years after the deletion date.

We also retain at Stripe the customer object and historical invoice records associated with any past subscription. Stripe's retention is governed by Stripe's own policy and is required for tax and financial-records purposes. Those records contain only the billing information you previously provided (name, email, billing address, transaction amounts) — never your full payment card number.

7.3 Legally-Required Records

In addition to the Stripe records above, we retain any minimal set of billing or tax records required by applicable law, typically up to seven (7) years.

7.4 Backups

Residual copies in encrypted system backups are overwritten on the normal backup rotation.

7.5 Aggregated Data

Aggregated or anonymized data that can no longer reasonably identify you may be retained indefinitely for product analytics.

8. Security

We use commercially reasonable administrative, technical, and physical safeguards to protect your information, including:

• Encryption in transit (HTTPS/TLS) and at rest for databases and file storage
• Row-level access controls on user data in our database
• Scoped API keys and least-privilege access for subprocessors
• Hashing of passwords (we never store plaintext passwords)
• Regular dependency updates and monitoring

No system is 100% secure. If we become aware of a data breach affecting your information, we will notify you in accordance with applicable law.

9. Your Privacy Rights

We extend the following privacy rights to all U.S. residents, regardless of which state you live in, even when we are not legally required to. If your state grants additional rights, those additional rights also apply.

You have the right to:

• Know / Access: request a copy of the personal information we hold about you.
• Correct: ask us to correct inaccurate information.
• Delete: ask us to delete your account and associated personal information, subject to limited retention for legal purposes.
• Port: receive your information in a portable, machine-readable format.
• Opt out of sale or sharing: opt out of the advertising and analytics data sharing described in Section 4.2, using the Global Privacy Control signal, the partner opt-outs in Section 4.4, or by emailing us.
• Limit use of sensitive information: where applicable.
• Non-discrimination: we will not deny service, charge different prices, or provide a lower quality of service because you exercised your rights.

9.1 How to Exercise Your Rights

Send a request to support@reluminatelabs.com from the email address on your account, or use the in-app controls in your account settings (where available). We will verify your request by confirming ownership of the account. We will respond within the timeframes required by applicable law (typically 45 days under California law, with one 45-day extension where reasonably necessary).

You may designate an authorized agent to make a request on your behalf. We may require the agent to provide written authorization and may verify your identity directly.

9.2 Appeals

If we deny your request, you may appeal by replying to our response. We will review and respond within 45 days.

9.3 California "Shine the Light"

California residents may request a list of the categories of personal information (if any) we have disclosed to third parties for the third parties' direct marketing purposes. The advertising and analytics partners described in Section 4.2 receive data that they may use for their own advertising purposes; you can opt out as described in Section 4.4.

10. Communications

• Transactional emails (cart-ready notifications, billing receipts, password resets, account and security alerts) are a necessary part of the Service and are sent without separate consent.
• Product updates and marketing emails are only sent if you opt in. You can unsubscribe at any time using the link in any such email or by updating your account preferences.
• SMS is not currently offered. If we add SMS in the future, it will require separate, TCPA-compliant opt-in.

11. Children

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact support@reluminatelabs.com and we will delete it promptly.

12. International Users

The Service is currently offered only to U.S. residents, and our servers and subprocessors are primarily located in the United States. If you access the Service from outside the U.S., you understand that your information will be transferred to and processed in the United States, which may have different data protection laws than your country.

If we begin offering the Service to residents of other regions (including the European Economic Area, the United Kingdom, or Switzerland), we will update this Policy to describe the applicable legal bases, transfer mechanisms, and local rights.

13. Changes to This Policy

We may update this Policy from time to time.

• Changes take effect when posted. We will revise the "Last Updated" date at the top of this page. Your continued use of the Service after that date constitutes acceptance of the updated Policy.
• Routine changes take effect on posting, without separate notice. These include adding, removing, or replacing subprocessors, and adding or changing analytics or advertising tools that operate on our public pages.
• We will notify you — by email to your account address or by an in-app notice — before a change takes effect if it materially expands how we use or share the personal information inside your account (your chat content, meal plans, recipes, shopping lists, preferences, orders, or profile), or if control of the Service changes hands.
• We will not apply materially different uses to personal information we have already collected from you without your consent, where consent is required by applicable law.

If you do not agree to a change, you must stop using the Service and may exercise your right to delete your account (Section 7.2).

We encourage you to review this Policy periodically.

14. Contact Us

Questions, requests, or concerns about your privacy or this Policy?

Reluminate Labs LLC (d/b/a MindyCart) Utah, United States support@reluminatelabs.com