Data Processing

Last updated: October 7, 2026

This page describes how personal data is handled when an organization uses MindForge for its members. For individual users, see the Privacy Policy.

Roles

For members' learning records, assessments and enrolment data held on behalf of an organization, the organization decides why and how the data is used and MindForge processes it on the organization's behalf. For account, security and billing data, MindForge determines the purposes.

Data Processed

Member account details, course progress, assessment and proctoring records, batch messages, wiki and project content, and content members create, as listed in the Privacy Policy.

Sub-processors

  • Neon: Primary database. Data: All account and content data. Location: Singapore.
  • Render: API hosting and application logs. Data: API traffic, IP addresses, logs. Location: Singapore.
  • Vercel: Web app hosting. Data: Requests, IP addresses, cookies. Location: Singapore and global edge.
  • Backblaze B2: File storage. Data: Screenshots, PDFs and other files you upload. Location: United States.
  • Anthropic / Google (Gemini): AI features (hints, feedback, diary and journal analysis, capture reading), only when enabled. Data: The text or image you submit to an AI feature. Location: United States.
  • Brevo: Transactional email. Data: Email address, name, message body. Location: European Union.
  • Razorpay / Stripe: Payments. Data: Name, email, amount; card and UPI details go directly to the processor. Location: India / United States.
  • Google, GitHub: Social sign-in, when you choose it. Data: Email and basic profile. Location: United States.
  • GitLab: Ticket linking and code review, when your organization connects it. Data: Connection tokens (encrypted), merge request and issue content. Location: Your GitLab instance.
  • Your AI assistant (Claude, ChatGPT): AI Connector, only if you connect it. Data: The diary, journal, calendar, habit and course data the scopes you approve allow. Location: United States.

Security and Deletion

Security measures are described on the Security page. When a member deletes their account, personal data is deleted or anonymized as described in the Privacy Policy.

Requesting a Signed Agreement

A contact for data processing agreements is not configured on this deployment. Raise a request through the in-app support ticket system.