Draft for legal review. This policy is a working draft and has not yet been reviewed by legal counsel. It will be updated before it is final.
1. Who we are
Recover is a product of MindBridgeXR Inc. ("we", "us", "our"). MindBridgeXR Inc. is the controller of the personal data described in this policy, which means we decide why and how it is processed.
This policy covers the Recover website, its forms (newsletter, early-access offer, contact, Reva P1 reservation), account sign-up and payments. It also explains, at a high level, how the Recover service handles the business data you connect to it.
You can reach us about privacy at [email protected].
2. What we collect and why
We only collect what we need for the purpose you would expect. You can browse the website without giving us any personal data.
| When | What we collect | Why | Basis |
|---|---|---|---|
| Newsletter sign-up | Email address, topics you choose, the time you confirmed | To send the monthly newsletter you asked for | Your consent |
| First 1,000 offer | Email address, company (optional), whether you also want the newsletter | To email your personal discount code and check it is used once | Your request; our legitimate interest in preventing misuse |
| Contact form | Name, email, company, phone (optional), team size, topic, message | To reply to you and arrange a demo if you asked for one | Your request; our legitimate interest in answering enquiries |
| Reva P1 reservation | Name, email, company, country, number of units, preferred character look, notes | To keep your place on the list and email you the price and date before asking for any payment | Your request |
| Account sign-up and trial | Name, work email, company, sign-in details | To create and secure your account and provide the service | Our contract with you |
| Any form | The page you sent it from, and how you first arrived (referring site and campaign tags, if any) | To understand which pages and campaigns are useful | Our legitimate interest in improving the website |
| Every visit | Technical data such as IP address, browser type and request logs | To deliver the website, keep it secure and stop abuse | Our legitimate interest in security |
We do not sell personal data, and we do not use it for advertising profiles.
3. Data in the Recover service
When your company uses Recover, you choose how it sees your data: by connecting a Gmail or Outlook mailbox, by uploading CSV files, or through the Windows local agent. Recover uses this data to find quotes, invoices, payments, contracts and email threads that need a follow-up, and to write drafts.
- Local agent: the agent indexes email and accounting exports on your own computer. Raw email stays on the device; only redacted records sync.
- CSV upload: Recover only sees the rows you upload.
- Drafts: drafts are written with a leading AI model provider under a business agreement, using your data and the Custom Skills you set. Every draft needs a person's approval before it is sent from your own mailbox.
- Control: you can export, delete or clear your data at any time.
For this business data, your company decides what is connected and why. Where the law treats your company as the controller of that data, we process it on your behalf to provide the service.
4. Payments
Card payments are handled by Stripe through Stripe Checkout and the Stripe customer portal. Card numbers never touch Recover's servers. We receive from Stripe what we need to run your subscription, such as a customer reference, the plan, the billing period, payment status, discount codes used and invoice history. Stripe processes your payment details under its own privacy policy.
6. Service providers
We use carefully chosen providers who process data for us under contract and only on our instructions:
- Our website hosting and security provider: website hosting, form processing, the database for sign-ups, bot protection and cookieless analytics.
- Stripe: payments, subscriptions and invoices.
- A transactional email provider: to send confirmation emails, discount codes and replies.
- Enterprise-grade cloud infrastructure and a leading AI model provider under a business agreement: to run the Recover service and write drafts.
We may also share data if the law requires it, to protect our rights or users' safety, or as part of a merger or sale of the business, in which case this policy continues to apply.
7. International transfers
Our providers may process data in countries other than yours. When we transfer personal data across borders, we rely on contractual safeguards and the protections our providers offer, as required by the laws that apply to the transfer.
8. How long we keep data
- Newsletter: until you unsubscribe. We keep a record of the unsubscribe so we don't email you again.
- Discount codes: for as long as the offer runs and the code can be redeemed, plus the time needed to prevent repeat use.
- Contact messages: for as long as needed to handle your request and any follow-up conversation.
- Reva P1 reservations: until you ask us to remove you from the list, or until we close the reservation list. Want off the list? Reply to any of our emails or use the unsubscribe link.
- Accounts and billing records: for the life of the account, and afterwards for as long as tax and accounting law requires.
- Technical logs: for a short period for security, unless needed to investigate abuse.
9. Your rights
Depending on where you live, data protection laws such as the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, for people in the European Union or the United Kingdom, the GDPR give you rights over your personal data. We aim to offer the following rights to everyone:
- Access: ask for a copy of the personal data we hold about you.
- Correction: ask us to fix data that is wrong or incomplete.
- Deletion: ask us to delete your data, unless we must keep it by law.
- Restriction and objection: ask us to limit or stop using your data, including for marketing.
- Portability: receive your data in a common, machine-readable format.
- Withdraw consent: where we rely on consent, withdraw it at any time, for example by unsubscribing.
- Complain: raise a concern with your local data protection authority.
To use any of these rights, email [email protected]. We may need to confirm your identity first. We aim to reply within 30 days. If you use Recover through your employer's account, we may refer your request to your employer as the account owner.
10. Security
All traffic is encrypted in transit (HTTPS/TLS), and the database is encrypted at rest by the cloud provider. Card payments are handled by Stripe. Admin sign-in supports single sign-on. In the product, nothing is ever sent without a person's approval, and every approval is logged. No system is perfectly secure; if we become aware of a breach that affects you, we will tell you as the law requires. Read more on our security page.
11. Marketing emails
We only send the newsletter after you confirm your subscription from the email we send you. Every newsletter has a one-click unsubscribe link. Emails about your account, your discount code or your reservation are service emails and are not marketing.
12. Children
Recover is a business service. It is not directed at children, and we do not knowingly collect data from anyone under 18.
13. Changes to this policy
We will update this policy when our practices change. We will change the date at the top, and if a change is significant we will tell account holders by email before it takes effect.
14. Contact us
MindBridgeXR Inc., for Recover. Email: [email protected]. You can also use our contact form.
See also our terms of service.