Plain-language summary. We collect the information needed to run your account, process your subscription, keep the service secure, and understand how the product is used. We do not sell your personal information. This English text is the operative version; a Chinese translation is provided for convenience where available. 本英文版本为准，中文翻译仅供参考。
Effective date: 25 July 2026. This Privacy Policy explains how Mastermind ("Mastermind", "we", "us") handles personal information when you use mastermind-x.com, the Mastermind Terminal at app.mastermind-x.com, and related services (together, the "Service").
Information we collect
We collect the following categories of personal information, and only what the Service needs to function:
- Account information. Your email address, a password (stored only in hashed form by our authentication provider — we never see or store your plaintext password), an optional display name, your account identifier, and your email-verification status.
- Subscription and billing information. Your subscription tier and status, billing period, and a payment-processor customer identifier. Payment card details are collected and processed directly by our payment processor (Stripe); Mastermind never receives or stores full card numbers.
- Usage and analytics information. Pages and features you view, symbols or tickers you search and open, time spent on a page, scroll depth, the referring page, a session identifier, a persistent visitor identifier stored in a cookie, a device/browser fingerprint, your IP address, your browser user-agent, and approximate location derived from your IP (country, region, city) together with network metadata (network operator and VPN/proxy/hosting indicators) that we use for security and abuse prevention.
- AI assistant information. The questions, messages, and any images you submit to the Mastermind AI assistant, and the resulting conversation threads. These inputs are processed by third-party AI providers (see "How we share information").
- Cookies and local storage. A first-party visitor cookie, your authentication session cookie, a security (anti-CSRF) cookie, and preferences stored locally in your browser such as language and light/dark theme. See "Cookies".
We do not intentionally collect special-category data (such as health, biometric, or precise geolocation data), and you should not submit such data to the AI assistant.
How we use information
- To provide, operate, and maintain the Service and your account.
- To authenticate you and keep your session secure.
- To process and manage your subscription and payments.
- To personalize the product to your market and language preferences.
- To measure and improve product performance and content through first-party analytics.
- To detect, prevent, and investigate fraud, abuse, and security incidents.
- To send you service and transactional messages (for example, verification, billing, and security notices).
- To comply with legal obligations and enforce our Terms.
Legal bases (EEA/UK)
Where the EU or UK GDPR applies, we rely on: performance of a contract (to provide your account and subscription); legitimate interests (to secure the Service, prevent abuse, and improve the product, balanced against your rights); consent (for non-essential cookies and any optional marketing, which you may withdraw at any time); and legal obligation (for example, tax and accounting records).
How we share information
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only with service providers that process it on our behalf under contract, and only as needed to run the Service:
- Authentication and database — to manage accounts and store your data.
- Payment processing — to process subscriptions and payments.
- AI providers — to generate responses from the prompts you submit to the AI assistant.
- Cloud storage and content delivery (CDN) — to store and deliver data and site assets. When your browser loads the site, our CDN and asset hosts necessarily receive your IP address to deliver the requested content.
- Mapping and tile providers — to render map features where used.
We may also disclose information if required by law, to respond to lawful requests, to protect the rights, safety, and property of Mastermind or others, or in connection with a merger, acquisition, or sale of assets (with notice where required).
International data transfers
Mastermind operates globally. Your information may be processed and stored in the United States, the European Union, and other countries whose data-protection laws may differ from those of your own country, including processing outside your country of residence. Where required, we use appropriate safeguards such as standard contractual clauses for cross-border transfers.
Data retention
We keep account information for as long as your account is active and as needed to provide the Service, then for any period required to meet legal, tax, accounting, or dispute-resolution obligations. Analytics information is retained for a limited period and, where practical, in aggregated or de-identified form. You can ask us to delete your account and associated personal information as described below.
Your privacy rights
Depending on where you live, you may have some or all of the following rights:
- EEA/UK (GDPR): access, rectification, erasure, restriction of processing, data portability, objection to processing, and the right to withdraw consent. You may also lodge a complaint with your local data-protection authority.
- California (CCPA/CPRA): the right to know what we collect and how we use and disclose it, to access and delete your information, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined, and we will not discriminate against you for exercising your rights.
To exercise any of these rights, email privacy@mastermind-x.com. We will verify your request and respond within the time required by applicable law. You may also access and update much of your account information directly in your account settings.
Cookies
We use a small number of cookies. Essential cookies keep you signed in and protect against cross-site request forgery; the Service cannot function without them. Analytics and preference cookies help us understand product usage and remember your language and theme. You can control cookies through your browser settings; blocking essential cookies will prevent you from signing in.
How we protect information
We encrypt traffic in transit (HTTPS with HSTS), enforce per-user, row-level access controls on stored data, keep credentials and third-party keys server-side, and restrict administrative access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to respond promptly to any incident.
Children
The Service is intended for adults and is not directed to children. We do not knowingly collect personal information from anyone under 16 (or the age of majority in your jurisdiction). If you believe a child has provided us personal information, contact us and we will delete it.
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" above and, for material changes, provide additional notice through the Service. Your continued use of the Service after an update means you accept the revised policy.
Contact us
For privacy questions or to exercise your rights, contact privacy@mastermind-x.com.