1. Who we are and how to reach us
MetaMinds decides what personal data this website collects and why, so in GDPR terms we are the controller, and in DPDP Act terms we are the Data Fiduciary. These are the details as they stand today.
| Trading name | MetaMinds |
|---|---|
| Registered legal name | NexManas Tech Pvt Ltd |
| Entity type | Private Limited Company |
| Registered office | Provided on request |
| Corporate Identity Number | Provided on request |
| GSTIN | Provided on request |
| Telephone | Email and the contact form |
| Privacy contact | privacy@metaminds.store |
| General contact | hello@metaminds.store |
Registration numbers are withheld by choice rather than missing. The corporate identity number and the GST registration number both exist, are matters of public record at the MCA and GST portals, and are sent on request. They also appear on every invoice and engagement letter, so a counterparty always has them in writing before money moves. What this page will never do is print a plausible looking number it cannot substantiate: on a site that sells regulatory work, a fabricated registration detail would be a false statement about our own legal standing. Every entry above is read from a single identity file, so nothing can drift between pages.
No Data Protection Officer has been appointed. Whether one is required is a question for the lawyer reviewing this draft. In the meantime every data protection question, and every request to see, correct or delete what we hold, goes to privacy@metaminds.store and is handled by a named person rather than a ticket queue.
No Article 27 representative in the EU or the UK has been appointed either. Article 27 of the GDPR requires a representative inside the EU for some controllers established outside it, with exemptions that turn on how occasional and how risky the processing is. Our position is [Article 27 representative pending legal review] and we are not going to assert an exemption we have not had checked.
2. What this notice covers
This notice covers the metaminds.store website: the pages you read, the enquiry form, the booking link and the on-site assistant where it is available. It describes what we do with data about you, as a visitor or a prospective client.
It does not cover data you give us inside an engagement. When you hand us documents, a corpus or access to a system, you decide what happens to that data and we act on your instructions, which makes you the controller and us the processor. That relationship is governed by the data processing addendum, not by this notice.
It also does not cover other companies whose sites you reach from here. Our product work lives on a separate domain with its own notice, and a link from this site is not an endorsement of anyone else’s data practices.
3. What we collect and when
The enquiry form
Nothing on this site collects your details in the background. There are exactly two places you are asked for them: this form, and the optional “send me this result” box on the three interactive tools, which is described below. The enquiry form collects exactly these fields, all of them required except the VAT ID:
- Your name.
- Your work email address.
- Your company.
- Your role.
- The country your entity is based in.
- Whether you are VAT registered: yes, no, or not sure. This decides how an invoice would have to be raised.
- Your VAT identification number, if you have one. Optional.
- Your free-text answer to what breaks if the AI gets it wrong. This is the field we read first, and it is the only one where you control how much you tell us.
- Which engagement is closest to what you need.
- Where you heard about us.
- The fact that you ticked the consent box, and the time you ticked it.
If you arrived from a campaign link, the form also carries the campaign parameters in the URL and the page you came from, so we can tell which work brought you here. That is the whole of our attribution: no advertising pixel, no cross-site identifier.
Please do not put confidential material in the free text
The answer you write reaches an ordinary business mailbox, not a secure enclave. Describe the failure in general terms. Do not paste case files, patient records, claim details, personal data about other people, or anything under an NDA. If the problem cannot be described without those, say so in one line and we will set up a call and a signed NDA before you send anything.
The “send me this result” box on the tools
The ROI calculator, the stack builder and the readiness assessment each end with an optional box that emails you a link back to your own result. It collects one field, your email address, plus the tick that says you want the message.
Your result is never held back for it. The answer is already on the page before the box appears and stays there whether or not you use it. The box exists so that you can keep the result, and so that we learn a real person found the tool useful.
Two messages are sent. You get a fixed message containing a link to your own result, and nothing else: no summary of your answers, and no text that anyone other than us wrote. That is deliberate, because nobody verifies that whoever typed an address owns it, so anything we echoed into that message would be text a stranger could put in front of you under our name. We get your address, which tool it was, and the same link.
It is one message, not a subscription. There is no sequence behind it, you are not added to any list, and we do not use the address to start a sales approach. If you would like the record deleted, reply to the message or write to us and we will delete it and confirm that in writing.
The link is built by our server from the tool’s own address and the answers you gave. Those answers are the same ones already visible in your address bar while you use the tool, and they are filtered before the link is built, so the message can only ever point at a page on this site.
Server logs
Every web server keeps a record of the requests it answers, and ours is no exception. A log line holds the path requested, the time, the HTTP status, the amount of data sent, the referring URL if the browser sent one, the user agent string, and a salted hash of the IP address. The next section explains the hash.
Analytics
We count page views with a cookieless analytics tool. It stores nothing on your device, sets no identifier, and does not follow you to other sites. What it produces is aggregate: how many people read a page, from which country, and which page sent them. There is no per-visitor record for us to look up, which is also why there is no cookie banner on this site.
The tool in use, and everything it does or does not store, is listed on the cookie policy. That table is generated from the same registry the site uses to decide what to load, so it cannot drift away from what actually runs. If we ever add a tool that does store something on your device, the consent banner appears at the same moment and nothing loads until you agree.
The on-site assistant
Where the assistant is available on a page, the text of your message is sent to a large language model provider to produce an answer. Nothing you type is written to any store on our side. The conversation exists in your browser and in the request; when the reply finishes, our side keeps none of it.
What we do count, we count in memory. Against the salted hash of your IP address we hold a message count, a token count and what those tokens cost, which is how we cap spend and stop abuse. Those counters live in the server process and nothing writes them down: they are gone when the process is recycled, which happens routinely and often.
There is one cache in this path and it is worth describing precisely, because the word invites the wrong assumption. We send our own instructions to the model with caching enabled, so the same unchanging block of our text does not have to be re-processed on every request. That cache holds our prompt, not your questions and not the answers you were given. There is no store of question and answer text anywhere in this system.
Do not put confidential or personal information into the assistant either. It is a way to ask about our services, not a support channel for your systems.
4. Why we hold a hash of your IP address and not the address itself
To stop someone hammering the enquiry form or running up a model bill, we need to tell one visitor apart from another. We do not need to know who they are. Those are different requirements, and storing a raw IP address answers the second one when only the first was asked.
So the address is combined with a secret salt and hashed, and only the hash is used. Two requests from the same address produce the same hash, which is all a rate limiter needs, and the hash cannot be turned back into the address without the salt, which never leaves the server.
Where it is held, stated exactly. This site has no database. Nothing about your visit is written to one, because there is not one to write to. The hash exists only in the memory of the server process that handled your request, inside a counter that is discarded when the window expires or the process restarts, whichever comes first. If an enquiry fails to send, the enquiry itself is written to our server log so we can still reply to you rather than lose your message silently; that log entry does not contain your address in any form. When a database is eventually added, the stored column will be ip_hash and there will be no ip column, and this notice will be updated on the day that ships rather than in advance of it.
The honest limits of that
A salted hash is pseudonymous, not anonymous. Because the address space is small enough to search, anyone holding the salt could confirm whether a given address produced a given hash. Under the GDPR that means the hash is still personal data and every right in this notice still applies to it. We are not going to tell you it is anonymized, because it is not.
Other parties see the address in transit. Your own network, the content delivery network in front of the site and the server’s reverse proxy all handle the real address to route the request, and they may hold it briefly in their own operational logs. What we control is our own application, and inside it the address is hashed before anything else touches it.
5. Why we are allowed to process it
Under the GDPR every purpose needs a lawful basis, and the basis determines which rights you have. Ours are set out one purpose at a time. Retention for each is in section 7.
| Purpose | Data | Lawful basis |
|---|---|---|
| Reading your enquiry and replying to it | Every field on the enquiry form | Legitimate interests, Article 6(1)(f): answering a business enquiry that you chose to send us. Where it becomes a discussion about engaging us, Article 6(1)(b), steps taken at your request before entering a contract. The tick box on the form records that you were shown this notice; it is not the basis for the processing. You can object at any time under Article 21 and we delete the record. |
| Keeping the site up, and stopping abuse of the form and the assistant | Server logs, ip_hash, assistant session counts | Legitimate interests, Article 6(1)(f): running a website that stays available and is not used to attack other people. |
| Counting how many people read which page | Aggregate page view counts, no per-visitor record | Legitimate interests, Article 6(1)(f), and no consent is required for storage on your device because nothing is stored on it. |
| Invoicing, tax records and defending a legal claim | Contact details, VAT status, engagement correspondence | Legal obligation, Article 6(1)(c), and legitimate interests, Article 6(1)(f), for the part that is not a statutory record. |
The legitimate interests balance, stated rather than assumed. For security logging the interest is keeping the service working. The impact on you is limited because the identifier is hashed, the data never leaves operational use, it is not combined with anything else, and it is deleted on a short cycle. You can object to it under Article 21, and section 8 says how.
Under India’s DPDP Act 2023 you gave us these details yourself so that we would reply, which the Act treats under its certain legitimate uses in section 7(a) rather than as consent. Ask and we delete the record, exactly as under the GDPR. Confirmation of that reading is [DPDP basis for the enquiry form pending legal review]. The Act recognizes a narrower set of non-consent grounds than the GDPR does, so how security logging is justified under it is [DPDP basis for security logging pending legal review]. Where the two laws differ we intend to apply whichever is stricter for the person concerned.
6. Where your data goes, and the transfer question we have not answered
The pages you are reading are static files served from a global content delivery network, so they reach you from wherever is nearest. The part that matters is where an enquiry lands. There is no application server and no database of ours in that path. The form posts to a serverless function, which validates it and hands it straight to our email provider; the message then sits in an ordinary business mailbox. Processing therefore happens wherever those two providers run, which is named for each of them on our subprocessors page, and the hosting region for the function itself is [data processing region pending].
If you are in the EU, the EEA or the UK, read this before you send the form
Submitting the form sends your personal data to a country outside the EEA. As at the date on this draft there is no European Commission adequacy decision for India, so a transfer like that needs its own lawful mechanism: in practice the Standard Contractual Clauses the Commission adopted in 2021, module two, plus a transfer impact assessment, and the UK Addendum where UK GDPR applies.
We have not executed those clauses and we have not completed a transfer impact assessment. The mechanism is [transfer mechanism pending legal review]. We are telling you that instead of printing the letters SCC and letting you assume something is signed, because a firm that sells assurance cannot be the firm that overstated its own paperwork.
If that is a problem for your organization, do not use the form. Email or a call under your own agreement works just as well, and for engagement work we support a deployment that runs entirely inside your own infrastructure and your own region, where the question does not arise at all.
This section is updated the moment the position changes, and the change will be dated.
7. How long we keep it
Real durations, not “as long as necessary”. Where a period depends on something we have not settled yet, it says so.
Almost everything below is short, and the reason is structural rather than virtuous: this site has no database, so for most of these there is no store for a long retention period to apply to. An enquiry becomes an email and lives in a mailbox. That is the whole of it.
| What | How long | Then |
|---|---|---|
| An enquiry that does not become an engagement | 12 months from your last message | Deleted from the mailbox |
| A “send me this result” request from one of the tools | 12 months from the request, the same as an enquiry, because it lands in the same mailbox and there is no separate store for it | Deleted from the mailbox |
| An enquiry that becomes an engagement | The engagement, then 6 years, which is the period in which a contract claim can realistically be brought. Confirm against the limitation period once the governing law is chosen: [limitation period pending] | Deleted |
| Email correspondence in the mailbox | 24 months from the last message in the thread | Deleted |
| Hosting platform logs, which may contain the raw address our own code never stores | Set by the hosting provider, not by us | Expire on the provider’s cycle. Named on our subprocessors page |
| Rate limiting counters, holding the salted hash and a count | Until the counting window ends or the server process is recycled, whichever comes first. Both are short | Discarded. They are held in memory and never written down |
| Assistant conversations | Not retained by us at all. Your messages are sent to the model provider to produce a reply and are not written to any store on our side | Nothing to delete |
| Assistant question and answer cache | Does not exist. It is designed and not built, and this row will carry a real duration on the day it ships | Nothing to delete |
| Invoices and tax records | As long as tax law requires, once we are invoicing | Deleted at the end of that period |
| Analytics | Indefinitely, as aggregate counts only | Nothing to delete: there is no record of you in it |
Backups. We run none, because there is no database to back up. The only durable copy of anything you send is the email in the mailbox, and that is covered by the mailbox row above. This paragraph previously described nightly encrypted database backups held for 30 days; that described a system that has never been built, and it is recorded here rather than quietly deleted because a privacy notice that silently drops a commitment is as untrustworthy as one that invents it. When a database ships, this paragraph returns with the real policy.
8. Your rights under the GDPR
If the GDPR or the UK GDPR applies to you, you have all of the following. They are free to use, and using one is never held against you.
- Access. A copy of the personal data we hold about you, with what we do with it and who else sees it.
- Rectification. Anything wrong corrected, and anything incomplete completed.
- Erasure. Deletion, which for an enquiry we hold on consent means immediate deletion on request, with no reason needed.
- Restriction. Processing paused while a dispute about accuracy or lawfulness is worked out.
- Portability. The data you gave us, in a structured, machine readable file, or sent straight to someone else where that is technically possible.
- Objection. To anything we do on legitimate interests, including security logging. We stop unless we can show grounds that override yours, and we will show you the reasoning rather than assert it.
- Withdrawal of consent. At any time, as easily as it was given. It does not affect anything done before you withdrew.
- Complaint to a supervisory authority. In the EU that is the authority where you live, where you work, or where the problem happened. In the UK it is the Information Commissioner’s Office. You can go to them directly; you do not have to come to us first.
To use any of them, email privacy@metaminds.store. We reply within one month, and if a request is genuinely complex we may extend by up to two further months, in which case we tell you inside the first month and say why. We may ask for enough information to be sure the request is really from you, and nothing beyond that. No fee, unless a request is manifestly unfounded or repetitive, in which case we will explain the charge before applying it.
9. Your rights under India's DPDP Act 2023
The Digital Personal Data Protection Act 2023 gives a Data Principal, which means you, a separate set of rights against us as Data Fiduciary. They overlap with the GDPR but they are not identical.
- Right to access information. A summary of the personal data we hold about you and what we are doing with it, plus the identities of anyone we have shared it with and what they got.
- Right to correction and erasure. Correction of inaccurate data, completion of incomplete data, updating, and erasure of anything we no longer need for the purpose you gave it for.
- Right of grievance redressal. A route to complain to us directly that we have to answer. Under the Act you use this route before going to the regulator.
- Right to nominate. You may name another person to exercise these rights on your behalf if you die or become incapable of exercising them yourself. Tell us in writing who it is and we will record it against your data.
Grievances go to [grievance officer name pending] at privacy@metaminds.store. We acknowledge within 3 working days and answer within 30 days. If you are not satisfied with our answer you can complain to the Data Protection Board of India.
Several timings and the exact form of the grievance mechanism are set by rules made under the Act rather than by the Act itself, so the precise commitments here are [DPDP rule-driven timelines pending confirmation]. The 3 and 30 day figures above are our own commitment and we will tighten them if the rules require it.
10. Who else handles the data
We keep the list short on purpose. These are the categories of service provider in use today, what each one is for, and nothing is added without this page changing first.
| Category | What it handles |
|---|---|
| Website hosting and content delivery | Serving these pages, and the request logs that come with it |
| Application and database hosting | Our own server and database, holding enquiries, in [data processing region pending] |
| Transactional email delivery | Sending our reply to you, and the confirmation of an enquiry |
| Calendar booking | Your name, email and chosen slot when you book a call |
| Large language model API | The text of a message you send to the on-site assistant |
| Cookieless website analytics | Aggregate page counts, with no per-visitor record |
A current list naming each provider, what it processes and in which region, is available on request from privacy@metaminds.store, and we give it to a client before contract rather than after. If a provider changes during an engagement, you are told before the change takes effect.
When checkout goes live, a payment processor and possibly a merchant of record will join that list, and this page changes before the first payment is taken, not after.
We do not sell personal data, we do not share it with advertising networks, and there is no cross-site tracking on this site. We disclose data to a government or law enforcement body only where a valid legal order requires it, and we will tell you it happened unless we are legally barred from doing so.
11. Your data is never used to train models
The commitment, without qualifiers
No client content, no enquiry text and no document you give us is used to train or fine-tune any model, ours or a provider’s, and none of it goes into a shared evaluation set.
That includes the free-text answer on the enquiry form and anything you type into the on-site assistant. Where a model provider sits in the path, the account is configured so that submitted content is not retained for training.
We also do not publish findings from an engagement, reuse them as case material, or name a client without written permission. That is the reason this site names no clients and shows no logos.
12. Cookies and what this site stores on your device
No analytics cookie, no advertising cookie and no cross-site identifier is set on this site. The analytics is cookieless by design: it counts a page view without setting an identifier and without following you anywhere else. That is why you are not being asked to agree to anything in order to read this.
The authoritative list is the cookie policy, and it is worth knowing why. That table is generated from the same registry the site uses to decide which tools to load, so a tool cannot be switched on without a row appearing. A cookie policy maintained by hand is wrong within a month, and a policy that contradicts what the site actually loads is worse than none.
These are the only things that can ever be written to your device:
- A record of a consent choice. If a tool that needs consent is ever enabled, a banner appears and your answer is kept in your browser’s local storage, on your device. It is deliberately not a cookie, so it is never transmitted to our server, and the mechanism that records your consent does not itself need consent.
- A shopping cart. If we add checkout, the items you choose are held in local storage so they survive a refresh. Strictly necessary, and it appears in the cookie policy before it ships.
- A hosting cookie. A hosting provider can set a strictly necessary cookie for load balancing or for preview builds. If ours does, it is named in the cookie policy with its purpose and lifetime once we have confirmed it against the provider’s current documentation.
Nothing that requires consent loads before you give it, and declining leaves the site completely usable.
13. How the data is protected
Traffic runs over TLS 1.3 on every hop. Data at rest, including backups, is encrypted with AES-256. Access is by named, least-privilege credentials: no shared accounts, and every credential a client issues to us is one they can revoke without calling us first. The full posture table, including the questions where the answer is unflattering, is on the security page.
What we do not hold
MetaMinds does not hold a SOC 2 Type II attestation, and MetaMinds is not certified to ISO/IEC 42001 or ISO/IEC 27001. The measures above are commitments we make and keep, not controls that an external auditor has tested. If your procurement process gates on an attestation report, tell us on the first call and we will say plainly whether that is workable rather than letting you find out at diligence.
14. Children
This site sells engineering services to businesses. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. The DPDP Act sets specific obligations for children’s data, including verifiable parental consent and a bar on tracking and behavioral advertising directed at children; we run neither tracking nor behavioral advertising on anybody. If you believe a child has sent us something through this site, email privacy@metaminds.store and we will delete it.
15. Automated decision making
We do not make decisions about you by automated means, and we do not profile you. Every enquiry is read by a person, and the reply comes from the engineer who would do the work. Nothing about whether we take on an engagement is decided by a model.
16. Changes to this notice
When this notice changes, the new version is published here with a new date, and the version line at the top of the page moves with it. If a change materially affects someone whose enquiry we still hold, we email them rather than relying on them to reread the page. Old versions are kept and we will send you one on request.
17. Complaints
Start with privacy@metaminds.store, or write to us at Provided on request. You will get an answer from a person, not a template.
You are not obliged to come to us first if the GDPR applies to you: you can complain directly to the supervisory authority in your country. If the DPDP Act applies, use our grievance route in section 9 first, then the Data Protection Board of India.