Mindtrip

The Privacy Policy explicitly states that Mindtrip does not use identifiable personal data to train or fine-tune AI models, and third-party AI providers are contractually prohibited from training on user data. The Terms of Service grants a license for AI enhancement but clarifies this applies to 'Mindtrip's owned algorithms' and excludes other LLMs like ChatGPT. This is enterprise-friendly protection.

“[Privacy] 'We do not use identifiable personal data to train or fine-tune AI models. Our third-party AI providers are contractually prohibited from training or fine-tuning models on your data.'”

The Terms of Service grants Mindtrip a perpetual, irrevocable, worldwide, sublicensable license to use User Content for operation, promotion, advertising, marketing, and AI enhancement. The license is explicitly transferable and survives account termination. This is highly unfavorable to the user/company.

“[ToS] 'You hereby grant Mindtrip, its affiliates, and its and their customers, agents, representatives, successors and assigns a non-exclusive, worldwide, royalty-free, fully paid-up, transferable, sublicensable (directly and indirectly through multiple tiers), perpetual, and irrevocable license to copy, display, upload, perform, distribute, store, modify, and otherwise use User Content...'”

The Privacy Policy discloses sharing with service providers, travel partners, and AI technology providers under contractual restrictions. However, the language regarding Partners is vague—'anonymized conversation history' is shared but the scope and controls are not fully detailed. Sub-processor lists are not published, creating moderate concern.

“[Privacy] 'If you access the Service through an embedded solution on a Partner's website, Mindtrip may share anonymized conversation history with that Partner. This information does not include personally identifiable information but may include general insights about chats...'”

The Privacy Policy states data is retained 'only for as long as is necessary' but provides no specific retention periods. It notes usage data is retained for 'shorter periods' except when used for security or functionality improvements, and acknowledges residual data may remain on backups. This vague language creates moderate concern.

“[Privacy] 'Mindtrip will retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy...residual data may remain on backup media or for other reasons, such as a legitimate business reason.'”

The Terms of Service explicitly grants Mindtrip ownership rights to 'enhancement and derivative data (including without limitation metadata)' derived from User Content, which Mindtrip may use to enhance its AI and create new products. This gives the vendor substantial IP claims over outputs and derivatives.

“[ToS] 'Mindtrip owns the rights to any enhancement and derivative data (including without limitation metadata) which it may use to enhance its Artificial Intelligence and improve and optimize its products, services and tools, and/or create new products or insights derived therefrom.'”

The Privacy Policy mentions GDPR compliance, EU AI Act compliance, and Standard Contractual Clauses for international transfers, but does not reference SOC 2, ISO 27001, HIPAA, or other formal certifications. No security trust page or detailed security documentation is referenced. Compliance is claimed but not formally certified.

“[Privacy] 'When we transfer personal data outside of the E.U. are safeguarded by data processing agreements ("DPAs") incorporating Standard Contractual Clauses' and 'we provide AI transparency disclosures and safeguards in accordance with the European Union's Artificial Intelligence Act'”