1. Who we are and how to reach us
MetaMinds decides what personal data this website collects and why, so in GDPR terms we are the controller, and in DPDP Act terms we are the Data Fiduciary. These are the details as they stand today.
| Trading name | MetaMinds |
|---|---|
| Registered legal name | NexManas Tech Pvt Ltd |
| Entity type | Private Limited Company |
| Registered office | 432, Tower C, Bhutani Technopark, Sector 127, Noida, Uttar Pradesh, 201301, India |
| Corporate Identity Number | Provided on request |
| GSTIN | Provided on request |
| Telephone | +91 93197 88556 |
| Privacy contact | help@metaminds.store |
| General contact | help@metaminds.store |
No Data Protection Officer has been appointed. Whether one is required is a question for the lawyer reviewing this draft. In the meantime every data protection question, and every request to see, correct or delete what we hold, goes to help@metaminds.store and is handled by a named person rather than a ticket queue.
No Article 27 representative in the EU or the UK has been appointed either. Article 27 of the GDPR requires a representative inside the EU for some controllers established outside it, with exemptions that turn on how occasional and how risky the processing is. Our position is [Article 27 representative pending legal review] and we are not going to assert an exemption we have not had checked.
2. What this notice covers
This notice covers the metaminds.store website: the pages you read, the enquiry form, the booking link and the on-site assistant where it is available. It describes what we do with data about you, as a visitor or a prospective client.
It does not cover data you give us inside an engagement. When you hand us documents, a corpus or access to a system, you decide what happens to that data and we act on your instructions, which makes you the controller and us the processor. That relationship is governed by the data processing addendum, not by this notice.
It also does not cover other companies whose sites you reach from here. Our product work lives on a separate domain with its own notice, and a link from this site is not an endorsement of anyone else’s data practices.
3. What we collect and when
The enquiry form
Nothing on this site collects your details in the background. There are exactly two places you are asked for them: this form, and the optional “send me this result” box on the three interactive tools, which is described below. The enquiry form collects exactly these fields, all of them required except the VAT ID:
- Your name.
- Your work email address.
- Your company.
- Your role.
- The country your entity is based in.
- Whether you are VAT registered: yes, no, or not sure. This decides how an invoice would have to be raised.
- Your VAT identification number, if you have one. Optional.
- Your free-text answer to what breaks if the AI gets it wrong. This is the field we read first, and it is the only one where you control how much you tell us.
- Which engagement is closest to what you need.
- Where you heard about us.
- The fact that you ticked the consent box, and the time you ticked it.
If you arrived from a campaign link, the form also carries the campaign parameters in the URL and the page you came from, so we can tell which work brought you here. That is the whole of our attribution: no advertising pixel, no cross-site identifier.
Please do not put confidential material in the free text
The answer you write reaches an ordinary business mailbox, not a secure enclave. Describe the failure in general terms. Do not paste case files, patient records, claim details, personal data about other people, or anything under an NDA. If the problem cannot be described without those, say so in one line and we will set up a call and a signed NDA before you send anything.
The “send me this result” box on the tools
The ROI calculator, the stack builder and the readiness assessment each end with an optional box that emails you a link back to your own result. It collects one field, your email address, plus the tick that says you want the message.
Your result is never held back for it. The answer is already on the page before the box appears and stays there whether or not you use it. The box exists so that you can keep the result, and so that we learn a real person found the tool useful.
Two messages are sent. You get a fixed message containing a link to your own result, and nothing else: no summary of your answers, and no text that anyone other than us wrote. That is deliberate, because nobody verifies that whoever typed an address owns it, so anything we echoed into that message would be text a stranger could put in front of you under our name. We get your address, which tool it was, and the same link.
It is one message, not a subscription. There is no sequence behind it, you are not added to any list, and we do not use the address to start a sales approach. If you would like the record deleted, reply to the message or write to us and we will delete it and confirm that in writing.
The link is built by our server from the tool’s own address and the answers you gave. Those answers are the same ones already visible in your address bar while you use the tool, and they are filtered before the link is built, so the message can only ever point at a page on this site.
Server logs
Every web server keeps a record of the requests it answers, and ours is no exception. A log line holds the path requested, the time, the HTTP status, the amount of data sent, the referring URL if the browser sent one, the user agent string, and a salted hash of the IP address. The next section explains the hash.
Analytics
We count page views with a cookieless analytics tool. It stores nothing on your device, sets no identifier, and does not follow you to other sites. What it produces is aggregate: how many people read a page, from which country, and which page sent them. There is no per-visitor record for us to look up, which is also why there is no cookie banner on this site.
The tool in use, and everything it does or does not store, is listed on the cookie policy. That table is generated from the same registry the site uses to decide what to load, so it cannot drift away from what actually runs. If we ever add a tool that does store something on your device, the consent banner appears at the same moment and nothing loads until you agree.
The on-site assistant
Where the assistant is available on a page, the text of your message is sent to a large language model provider to produce an answer. Nothing you type is written to any store on our side. The conversation exists in your browser and in the request; when the reply finishes, our side keeps none of it.
What we do count, we count in memory. Against the salted hash of your IP address we hold a message count, a token count and what those tokens cost, which is how we cap spend and stop abuse. Those counters live in the server process and nothing writes them down: they are gone when the process is recycled, which happens routinely and often.
There is one cache in this path and it is worth describing precisely, because the word invites the wrong assumption. We send our own instructions to the model with caching enabled, so the same unchanging block of our text does not have to be re-processed on every request. That cache holds our prompt, not your questions and not the answers you were given. There is no store of question and answer text anywhere in this system.
Do not put confidential or personal information into the assistant either. It is a way to ask about our services, not a support channel for your systems.
4. Why we hold a hash of your IP address and not the address itself
To stop someone hammering the enquiry form or running up a model bill, we need to tell one visitor apart from another. We do not need to know who they are. Those are different requirements, and storing a raw IP address answers the second one when only the first was asked.
So the address is combined with a secret salt and hashed, and only the hash is used. Two requests from the same address produce the same hash, which is all a rate limiter needs, and the hash cannot be turned back into the address without the salt, which never leaves the server.
Where it is held, stated exactly. No database holds what you send us. The one database this site runs is its own page-view counter, which records that a page was loaded and stores no address and no cookie, so it holds counts rather than anything about you. The hash exists only in the memory of the server process that handled your request, inside a counter that is discarded when the window expires or the process restarts, whichever comes first. If an enquiry fails to send, the enquiry itself is written to our server log so we can still reply to you rather than lose your message silently; that log entry does not contain your address in any form. When a database is eventually added, the stored column will be ip_hash and there will be no ip column, and this notice will be updated on the day that ships rather than in advance of it.
The honest limits of that
A salted hash is pseudonymous, not anonymous. Because the address space is small enough to search, anyone holding the salt could confirm whether a given address produced a given hash. Under the GDPR that means the hash is still personal data and every right in this notice still applies to it. We are not going to tell you it is anonymized, because it is not.
Other parties see the address in transit. Your own network and the reverse proxy in front of our server both handle the real address to route the request, and they may hold it briefly in their own operational logs. What we control is our own application, and inside it the address is hashed before anything else touches it.
5. Why we are allowed to process it
Under the GDPR every purpose needs a lawful basis, and the basis determines which rights you have. Ours are set out one purpose at a time. Retention for each is in section 7.
| Purpose | Data | Lawful basis |
|---|---|---|
| Reading your enquiry and replying to it | Every field on the enquiry form | Legitimate interests, Article 6(1)(f): answering a business enquiry that you chose to send us. Where it becomes a discussion about engaging us, Article 6(1)(b), steps taken at your request before entering a contract. The tick box on the form records that you were shown this notice; it is not the basis for the processing. You can object at any time under Article 21 and we delete the record. |
| Selling and delivering a Tier 1 product, and keeping the download working | Your order and what you paid, the billing address, the download entitlement, and a one-way hash of the address each download came from | Contract, Article 6(1)(b): we cannot deliver a file you have bought without recording what you bought and where to send it. The download hash is legitimate interests, Article 6(1)(f), for keeping a paid link from being shared without limit; it is a hash rather than an address, and the retention table above says how long each row lives. |
| Keeping the site up, and stopping abuse of the form and the assistant | Server logs, ip_hash, assistant session counts | Legitimate interests, Article 6(1)(f): running a website that stays available and is not used to attack other people. |
| Counting how many people read which page | Aggregate page view counts, no per-visitor record | Legitimate interests, Article 6(1)(f), and no consent is required for storage on your device because nothing is stored on it. |
| Invoicing, tax records and defending a legal claim | Contact details, VAT status, engagement correspondence | Legal obligation, Article 6(1)(c), and legitimate interests, Article 6(1)(f), for the part that is not a statutory record. |
The legitimate interests balance, stated rather than assumed. For security logging the interest is keeping the service working. The impact on you is limited because the identifier is hashed, the data never leaves operational use, it is not combined with anything else, and it is deleted on a short cycle. You can object to it under Article 21, and section 8 says how.
Under India’s DPDP Act 2023 you gave us these details yourself so that we would reply, which the Act treats under its certain legitimate uses in section 7(a) rather than as consent. Ask and we delete the record, exactly as under the GDPR. Confirmation of that reading is [DPDP basis for the enquiry form pending legal review]. The Act recognizes a narrower set of non-consent grounds than the GDPR does, so how security logging is justified under it is [DPDP basis for security logging pending legal review]. Where the two laws differ we intend to apply whichever is stricter for the person concerned.
6. Where your data goes, and the transfer question we have not answered
The pages you are reading are prerendered files served from a single server we run ourselves, behind nginx. The part that matters is where an enquiry lands. The form posts to one route on that same server, which validates it and hands it straight to our email provider; no database of ours is in that path, and the message then sits in an ordinary business mailbox. Processing therefore happens where that server runs and wherever our email provider runs, which is named for each of them on our subprocessors page, and the region for the server itself is Germany (eu-central).
If you are in the EU, the EEA or the UK, read this before you send the form
Submitting the form sends your personal data to a country outside the EEA. As at the date on this draft there is no European Commission adequacy decision for India, so a transfer like that needs its own lawful mechanism: in practice the Standard Contractual Clauses the Commission adopted in 2021, module two, plus a transfer impact assessment, and the UK Addendum where UK GDPR applies.
We have not executed those clauses and we have not completed a transfer impact assessment. The mechanism is [transfer mechanism pending legal review]. We are telling you that instead of printing the letters SCC and letting you assume something is signed, because a firm that sells assurance cannot be the firm that overstated its own paperwork.
If that is a problem for your organization, do not use the form. Email or a call under your own agreement works just as well, and for engagement work we support a deployment that runs entirely inside your own infrastructure and your own region, where the question does not arise at all.
This section is updated the moment the position changes, and the change will be dated.
7. How long we keep it
Real durations, not “as long as necessary”. Where a period depends on something we have not settled yet, it says so.
Most of what follows is short, and the reason is structural rather than virtuous: an enquiry becomes an email and lives in a mailbox, with no row in any database. That was true of everything on this site until 3 October 2026, and it is still true of enquiries, of tool results, and of your visit itself.
It is not true of a purchase. Buying a Tier 1 product writes a record: the order, the download entitlement behind it, each download taken against that entitlement, and the invoice. Those rows hold the email address you bought with and a one-way hash of the address you downloaded from. The last four rows of the table below describe them, and the honest part of those rows is the last column.
| What | How long | Then |
|---|---|---|
| An enquiry that does not become an engagement | 12 months from your last message | Deleted from the mailbox |
| A “send me this result” request from one of the tools | 12 months from the request, the same as an enquiry, because it lands in the same mailbox and there is no separate store for it | Deleted from the mailbox |
| An enquiry that becomes an engagement | The engagement, then 6 years, which is the period in which a contract claim can realistically be brought. Confirm against the limitation period once the governing law is chosen: [limitation period pending] | Deleted |
| Email correspondence in the mailbox | 24 months from the last message in the thread | Deleted |
| Hosting platform logs, which may contain the raw address our own code never stores | Set by the hosting provider, not by us | Expire on the provider’s cycle. Named on our subprocessors page |
| Rate limiting counters, holding the salted hash and a count | Until the counting window ends or the server process is recycled, whichever comes first. Both are short | Discarded. They are held in memory and never written down |
| Assistant conversations | Not retained by us at all. Your messages are sent to the model provider to produce a reply and are not written to any store on our side | Nothing to delete |
| Assistant question and answer cache | Does not exist. It is designed and not built, and this row will carry a real duration on the day it ships | Nothing to delete |
| Analytics | Indefinitely, as aggregate counts only | Nothing to delete: there is no record of you in it |
| Your order: what you bought, what you paid, the address you bought with | Kept while the invoice behind it must be kept, which is as long as tax law requires | No automatic deletion exists yet. Ask and it is done by hand, except where tax law requires the invoice to be kept |
| Your download link | 30 days from purchase, or 20 downloads, whichever comes first. Enforced in the database rather than by a reminder | Stops working. The row stays, linked to the order above, until the order is deleted |
| A one-way hash of the address each download came from | As long as the order, for the same reason | Deleted with the order. It is a salted hash, not an address: we cannot turn it back into one |
| Invoices and tax records | As long as tax law requires. We began issuing invoices on 3 October 2026 | Deleted at the end of that period |
Backups. We run none. There is no store of what you send us to back up: the only durable copy of anything you send is the email in the mailbox, and that is covered by the mailbox row above. The page-view counter’s own file is not backed up either, and it holds counts rather than anything about you. This paragraph previously described nightly encrypted database backups held for 30 days; that described a system that has never been built, and it is recorded here rather than quietly deleted because a privacy notice that silently drops a commitment is as untrustworthy as one that invents it. When a database ships, this paragraph returns with the real policy.
8. Your rights under the GDPR
If the GDPR or the UK GDPR applies to you, you have all of the following. They are free to use, and using one is never held against you.
- Access. A copy of the personal data we hold about you, with what we do with it and who else sees it.
- Rectification. Anything wrong corrected, and anything incomplete completed.
- Erasure. Deletion on request. For an enquiry, which we hold under legitimate interests rather than consent, object under Article 21 and the record is deleted; no reason is needed and the practical outcome is immediate deletion either way.
- Restriction. Processing paused while a dispute about accuracy or lawfulness is worked out.
- Portability. The data you gave us, in a structured, machine readable file, or sent straight to someone else where that is technically possible.
- Objection. To anything we do on legitimate interests, including security logging. We stop unless we can show grounds that override yours, and we will show you the reasoning rather than assert it.
- Withdrawing a choice you made. Where you have saved a cookie preference, you can change or clear it at any time from the same panel, as easily as it was given, and it does not affect anything done before you changed it.
- Complaint to a supervisory authority. In the EU that is the authority where you live, where you work, or where the problem happened. In the UK it is the Information Commissioner’s Office. You can go to them directly; you do not have to come to us first.
To use any of them, email help@metaminds.store. We reply within one month, and if a request is genuinely complex we may extend by up to two further months, in which case we tell you inside the first month and say why. We may ask for enough information to be sure the request is really from you, and nothing beyond that. No fee, unless a request is manifestly unfounded or repetitive, in which case we will explain the charge before applying it.
9. Your rights under India's DPDP Act 2023
The Digital Personal Data Protection Act 2023 gives a Data Principal, which means you, a separate set of rights against us as Data Fiduciary. They overlap with the GDPR but they are not identical.
- Right to access information. A summary of the personal data we hold about you and what we are doing with it, plus the identities of anyone we have shared it with and what they got.
- Right to correction and erasure. Correction of inaccurate data, completion of incomplete data, updating, and erasure of anything we no longer need for the purpose you gave it for.
- Right of grievance redressal. A route to complain to us directly that we have to answer. Under the Act you use this route before going to the regulator.
- Right to nominate. You may name another person to exercise these rights on your behalf if you die or become incapable of exercising them yourself. Tell us in writing who it is and we will record it against your data.
Grievances go to [grievance officer name pending] at help@metaminds.store. We acknowledge within 48 hours and answer within one month. If you are not satisfied with our answer you can complain to the Data Protection Board of India.
The Rules made under the Act were notified on 13 November 2025, and the commitments above are ours rather than the statutory minimum: 48 hours to acknowledge and one month to answer are both shorter than the period those Rules allow. The Data Protection Board of India route above stays open to you regardless of what we commit to here. The 48 hour and one month figures are the periods Rule 4(5) of the Consumer Protection (E-Commerce) Rules 2020 sets for a consumer complaint, and we apply them here rather than publishing two clocks. Until 5 October 2026 this paragraph promised 3 working days and 30 days and said in terms that those were our own choice. The slower of two published promises is the one that would have been quoted back to us on any complaint the stricter rule covered. The grievance page carries the named officer, the address and the same commitment.
10. Who else handles the data
We keep the list short on purpose. These are the categories of service provider in use today, what each one is for, and nothing is added without this page changing first.
| Category | What it handles |
|---|---|
| Website hosting and content delivery | Serving these pages, and the request logs that come with it |
| Application hosting | The same server, running the routes that receive a form submission and a payment confirmation. An enquiry becomes an email and lives in a mailbox, with no row in any database. A purchase does write rows: the order, its download entitlement and the invoice, on the same server. The retention table above describes both. Processing happens in Germany (eu-central) |
| Transactional email delivery | Sending our reply to you, and the confirmation of an enquiry |
| Calendar booking | Your name, email and chosen slot when you book a call |
| Large language model API | The text of a message you send to the on-site assistant |
| Cookieless website analytics | Aggregate page counts, with no per-visitor record |
A current list naming each provider, what it processes and in which region, is available on request from help@metaminds.store, and we give it to a client before contract rather than after. If a provider changes during an engagement, you are told before the change takes effect.
Buying a Tier 1 product involves a payment processor, which is named on the subprocessor page with everything else that touches data from this site. Your card never reaches us: payment happens on the processor’s own hosted page, so no card number, expiry or CVV touches this server, these logs or this codebase.
We do not sell personal data, we do not share it with advertising networks, and there is no cross-site tracking on this site. We disclose data to a government or law enforcement body only where a valid legal order requires it, and we will tell you it happened unless we are legally barred from doing so.
11. Your data is never used to train models
The commitment, without qualifiers
No client content, no enquiry text and no document you give us is used to train or fine-tune any model, ours or a provider’s, and none of it goes into a shared evaluation set.
That includes the free-text answer on the enquiry form and anything you type into the on-site assistant. Where a model provider sits in the path, the account is configured so that submitted content is not retained for training.
We also do not publish findings from an engagement, reuse them as case material, or name a client without written permission. That is the reason this site names no clients and shows no logos.
12. Cookies and what this site stores on your device
No analytics cookie, no advertising cookie and no cross-site identifier is set on this site. The analytics is cookieless by design: it counts a page view without setting an identifier and without following you anywhere else. That is why you are not being asked to agree to anything in order to read this.
The authoritative list is the cookie policy, and it is worth knowing why. That table is generated from the same registry the site uses to decide which tools to load, so a tool cannot be switched on without a row appearing. A cookie policy maintained by hand is wrong within a month, and a policy that contradicts what the site actually loads is worse than none.
These are the only things that can ever be written to your device:
- A record of a consent choice. If a tool that needs consent is ever enabled, a banner appears and your answer is kept in your browser’s local storage, on your device. It is deliberately not a cookie, so it is never transmitted to our server, and the mechanism that records your consent does not itself need consent.
- A shopping cart. If we add checkout, the items you choose are held in local storage so they survive a refresh. Strictly necessary, and it appears in the cookie policy before it ships.
- A hosting cookie. A hosting provider can set a strictly necessary cookie for load balancing or for preview builds. If ours does, it is named in the cookie policy with its purpose and lifetime once we have confirmed it against the provider’s current documentation.
Nothing that requires consent loads before you give it, and declining leaves the site completely usable.
13. How the data is protected
Traffic runs over TLS 1.3 on every hop. Data at rest, including backups, is encrypted with AES-256. Access is by named, least-privilege credentials: no shared accounts, and every credential a client issues to us is one they can revoke without calling us first. The full posture table, including the questions where the answer is unflattering, is on the security page.
How these measures are verified
These are commitments MetaMinds makes and keeps, and a client can test them. Every credential you issue is one you can revoke without calling us, and the data processing addendum gives you an audit right with an auditor of your choosing. Where your procurement process gates on a specific attestation report, say so on the first call and you will have a straight answer the same day about whether that is workable, rather than finding out at diligence.
14. Children
This site sells engineering services to businesses. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. The DPDP Act sets specific obligations for children’s data, including verifiable parental consent and a bar on tracking and behavioral advertising directed at children; we run neither tracking nor behavioral advertising on anybody. If you believe a child has sent us something through this site, email help@metaminds.store and we will delete it.
15. Automated decision making
We do not make decisions about you by automated means, and we do not profile you. Every enquiry is read by a person, and the reply comes from the engineer who would do the work. Nothing about whether we take on an engagement is decided by a model.
16. Changes to this notice
When this notice changes, the new version is published here with a new date, and the version line at the top of the page moves with it. If a change materially affects someone whose enquiry we still hold, we email them rather than relying on them to reread the page. Old versions are kept and we will send you one on request.
17. Complaints
Start with help@metaminds.store, or write to us at 432, Tower C, Bhutani Technopark, Sector 127, Noida, Uttar Pradesh, 201301, India. You will get an answer from a person, not a template.
You are not obliged to come to us first if the GDPR applies to you: you can complain directly to the supervisory authority in your country. If the DPDP Act applies, use our grievance route in section 9 first, then the Data Protection Board of India.