Last updated: October 12, 2026
This Privacy Policy is issued by DataMine AI, LLC ("DataMine AI," "we," "us," or "our"), 4620 Post Lane, Round Rock, TX 78681, United States. It explains how we collect, use, share, and protect information when you visit dataminehq.com (the "Website"), use the DataMine AI application at app.dataminehq.com (the "Application"), subscribe to our emails, or communicate with us. The Website and the Application together are the "Service."
DataMine AI is a business-to-business service. When you use it, you do so on behalf of a company or other organization (a "Customer"). We handle information in two roles:
If you are an employee, customer, or vendor of one of our Customers and your information appears in a file or data source that Customer connected, the Customer's own privacy notice governs that information. We process it only on the Customer's behalf; please direct requests about it to that Customer, and we will assist them.
2.1 Account and team information. When you create an account we collect your email address and a password (stored only as a salted hash, never in plain text). Later, you or your team may add an account name, company website, industry, and time zone (read from your browser), and answer onboarding questions about your goals, pain points, and the kinds of data you work with. If you invite teammates, we collect their email addresses and the role you assign them (member, admin, or owner). If you enable two-factor authentication, we store the secret needed to verify your codes, encrypted. We also record the date, time, and IP address of your recent sign-ins.
2.2 Files you upload. The Application accepts CSV, XLSX, PDF, DOCX, and similar files, typically exports such as daily sales by location, monthly profit and loss statements, labor reports, and vendor purchase records. These files may contain personal information about the Customer's employees, customers, or vendors (for example, employee names on a labor report). The Customer controls what is uploaded and is responsible for it.
2.3 Data from connected sources. A Customer may connect the Application to external data sources so files sync automatically instead of being uploaded by hand. Every connection is read-only: the Application can read from the source but has no ability to create, change, share, or delete anything in it. A Customer may hold one connection per provider. Today the providers are:
https://www.googleapis.com/auth/drive.readonly scope, which Google describes as "See and download all your Google Drive files"; we do not request access to your Gmail, Calendar, Contacts, or Google profile. We read the email address and display name associated with the Drive account solely to label the connection in your settings. You choose a single folder in My Drive, in a shared drive, or one that was shared with you. About once an hour, and whenever you click "Sync now," we list the files in that folder and its subfolders and download the contents of supported files, exporting Google Sheets as .xlsx, Google Docs as Markdown, and Google Slides as plain text so they can be analyzed. Section 5 sets out in full what we access, how we use, share, protect, and delete it, and the commitments we make about Google user data.Files.Read.All, Sites.Read.All, User.Read, and offline_access. We read your name and email address solely to label the connection. You choose a single folder in OneDrive or a SharePoint site you already have access to. About once an hour we check that folder for changes and download the contents of new or modified supported files.SELECT queries against the tables you chose (capped at one million rows per table) and store the result as a snapshot in your account. We never run statements that write to, alter, or delete anything in your database. We recommend creating a dedicated read-only database role for this purpose.OAuth access tokens, refresh tokens, and Supabase credentials are stored using application-level encryption in addition to disk encryption, and are decrypted only in memory when a sync runs. When you disconnect a source, we erase the stored credentials (and, for Google, revoke the token at Google; see Section 5.6). Files already synced remain in your account until you delete them or delete the account.
2.4 Analysis and conversation data. The Application stores the questions you ask, the answers and reports it generates, the key performance indicators it defines and computes, business context you provide, the daily and weekly briefings it produces, and numeric representations of your documents ("embeddings") used for search. Embeddings are computed on our own servers and are not sent to any third party.
2.5 Billing information. Payments are processed by Stripe. When you subscribe, Stripe collects your payment details directly; full card numbers never reach our servers. We receive and store your Stripe customer and subscription identifiers, plan, billing status, invoice history, card brand, and the last four digits of the card.
2.6 Usage and log data. Our servers automatically record IP addresses, browser and device type, the pages and features you use, timestamps, request and error logs, and email delivery events such as bounces.
2.7 Website and marketing information. If you subscribe to our newsletter we collect your email address, the IP address used to subscribe, any campaign parameters in the link you arrived from, and the time you confirmed your subscription (we use double opt-in). If you email us, we keep the correspondence. The cookies the Website sets are described in Section 9.
2.8 Information we do not collect. We do not knowingly collect information from anyone under 18 (Section 13). We do not collect biometric data or precise geolocation. We do not access anything in your Google or Microsoft accounts beyond the scopes listed in Section 2.3.
We use the information described above to:
We do not use Customer Data to train or fine-tune artificial intelligence or machine learning models, whether our own or anyone else's, and we do not permit our providers to do so. We do not sell Customer Data or personal information.
The Application generates answers, KPIs, and briefings using large language models operated by third-party providers. To do this, we send the relevant portions of Customer Data, which may include document contents, extracted tables, computed figures, the business context you provided, and the question you asked, to the provider's API, and we receive the generated text back.
Our current default model provider is Google (Gemini API). We also maintain the ability to use models from Anthropic and OpenAI, and we may change providers or models to improve quality, cost, or reliability. The providers in use are always listed in Section 7.
Each provider's API terms prohibit it from using the content we send to train its models. Providers may retain API inputs and outputs for a limited period to monitor for abuse and to comply with law, as described in their own policies. We do not currently operate under a zero-retention arrangement with any provider.
Web search context. Google Search grounding is enabled for most requests we send to Gemini. To add outside context such as weather, supply-chain news, or local events, the model can generate a web search query derived from the content of your question or data and send it to Google Search. Do not include information in a question that you would not want reflected in a search query.
Document embeddings used for search are computed on our own infrastructure and never leave it. AI-generated output is produced automatically and may be inaccurate; see our Terms of Service for the disclaimers that apply.
DataMine AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
This section covers everything the Application obtains through the Google Drive API ("Google user data"): file and folder metadata, file contents (including Google Docs, Google Sheets, and Google Slides files stored in Drive), the email address and display name of the connected Google account, and the OAuth tokens Google issues to us. DataMine AI uses Google only as an optional, read-only data-source connector that an account owner or admin sets up in the Application's settings. There is no "Sign in with Google"; you sign in to DataMine AI with an email address and password. We request no email, profile, or openid scope from Google.
We request one OAuth scope. Here is what it permits and what we actually read.
https://www.googleapis.com/auth/drive.readonlyWe use Google user data only to provide the connector feature you set up, which you can see working in the Application:
The abstract, column descriptions, answers, and briefings are produced by sending the relevant data to the AI model providers listed in Section 5.3 for processing at the time of each request. That is inference, not training.
We do not use Google user data for advertising. We do not sell it. We do not use it to profile you. We do not use it for any purpose other than the connector feature described here. We do not use Google Workspace APIs, or data obtained through them, to develop, improve, or train non-personalized artificial intelligence or machine learning models. We do not train any model on it at all, and our model providers' API terms prohibit them from doing so (Sections 3 and 4).
Google user data reaches only the following recipients, each for the stated purpose:
Beyond these recipients, we transfer Google user data to another party only with your consent, as necessary for security or to investigate abuse, to comply with applicable law, or as part of a merger or acquisition with prior notice to you, on the terms in Section 7. No analytics, error-tracking, or advertising service receives Google user data; we run none. Stripe never receives it. We do not transfer it to any other app. We never sell it or give it to data brokers.
If we learn of a breach of security affecting Google user data, we will notify you without undue delay and in any event as required by applicable law.
Microsoft. Information obtained under the Microsoft Graph scopes listed in Section 2.3 is used only to sync the folder or site you selected and to label the connection. Disconnecting in the Application erases our stored tokens. You can also remove DataMine AI's access from your Microsoft account's app permissions or, for a work account, through your organization's Microsoft 365 admin center. Microsoft's own terms and privacy statement govern the Microsoft services.
Supabase. The connection string and database password you provide are encrypted at rest and used only for the scheduled read-only snapshots described in Section 2.3. Disconnecting erases them. Because you shared these credentials with us, we recommend using a dedicated read-only database role and rotating its password if you disconnect. Supabase's own terms govern the Supabase service; Supabase is your vendor, not ours.
For both providers, copies of files or tables that were already synced remain in your account until you delete them or delete the account.
We protect information with technical and organizational measures appropriate to its sensitivity, including:
A SOC 2 Type I examination is on our compliance roadmap; we do not currently hold a SOC 2 report or other third-party certification. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a breach of security affecting your personal information, we will notify you without undue delay and in any event as required by applicable law.
While your account exists. We keep Customer Data and account information for as long as the account exists. This includes periods when the account is frozen because a trial ended, a subscription was cancelled, or payment failed. A frozen account is read-only, and nothing in it is deleted.
When you delete. An account owner can delete the account at any time from the Application's settings, or by emailing [email protected] from the owner's email address. Deletion is immediate and permanent: database records and stored files are destroyed with no grace period, and we confirm completion by email. Individual files, conversations, and data connections can also be deleted at any time. A file removed from a connected source is flagged in your account rather than deleted automatically; you choose whether to keep or delete our copy (Section 5.5). Deleting the account also revokes our access to a connected Google Drive (Section 5.6).
Inactive frozen accounts. We may delete an account that has been frozen for 90 days or more, after giving the account owner at least 14 days' notice by email.
Exceptions. Some information is kept longer where the law or our legitimate interests require it: billing and tax records for up to seven years; server and security logs for up to 90 days; copies held by our AI model providers for the abuse-monitoring periods described in their policies; and email delivery logs held by Amazon Simple Email Service. Newsletter subscription records are kept until you unsubscribe or ask us to delete them.
Access, correction, deletion, and export. You may ask us to access, correct, delete, or provide a copy of personal information we hold about you by emailing [email protected]. We verify requests by corresponding with the email address on the account. We respond within 30 days, or within 45 days where California law allows, and will tell you if we need more time. Account owners can delete the account themselves as described in Section 10. Answers and reports can be downloaded from within the Application; a complete copy of your files and data is available on request while the account exists.
Connected sources. You can disconnect Google Drive, Microsoft, or Supabase at any time in the Application's settings. You can also revoke access directly at Google or Microsoft, or rotate the Supabase database password you shared. Deleting your account revokes our Google access as well (Section 5.6).
Email. Every marketing email has an unsubscribe link, or you can email [email protected]. While you hold an account we will still send transactional messages such as invitations, receipts, and security notices. Daily briefing recipients are managed by your account's admins.
People in a Customer's data. If your information appears in files or sources a Customer brought into the Service, please contact that Customer; we will help them respond.
California residents. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, you have the right to know what personal information we collect, use, and disclose; to request deletion or correction; and not to be discriminated against for exercising these rights. In the past twelve months we have collected the categories described in Section 2: identifiers (name, email, IP address), commercial information (subscription and payment records), internet activity (usage and Website data), professional information (company, industry, role), and inferences drawn from analysis output. We collect this information directly from you, from your devices, and from the sources you connect, for the purposes in Section 3, and disclose it to the service providers in Section 7. We do not sell or share personal information as those terms are defined in California law, and we do not use or disclose sensitive personal information for purposes other than providing the Service. You may submit a request, or authorize an agent to submit one for you, by emailing [email protected]. Note that most Customer Data is handled by us as a service provider on behalf of a business, in which case we will refer your request to that business.
Residents of other U.S. states. If you live in Texas, Virginia, Colorado, Connecticut, Utah, Oregon, or another state with a comprehensive privacy law, you have comparable rights to access, correct, delete, and obtain a copy of your personal information, and to opt out of targeted advertising, sales, and certain profiling, none of which we engage in. To exercise these rights, email [email protected]. If we deny a request, you may appeal by replying to our decision, and we will respond to the appeal within the time your state's law requires.
DataMine AI is built for businesses in the United States, and all information is stored and processed in the United States. If you use the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.
If the General Data Protection Regulation or the UK GDPR applies to you, our legal bases for processing are: performance of our contract with you (providing the Service); our legitimate interests (securing and improving the Service, and business-to-business marketing), balanced against your rights; your consent, where required, for the newsletter, which you may withdraw at any time; and compliance with legal obligations. Where we transfer personal data out of the European Economic Area, Switzerland, or the United Kingdom, we rely on Standard Contractual Clauses or another lawful transfer mechanism. You have the rights to access, rectify, erase, restrict, and port your personal data, to object to processing, to withdraw consent, and to lodge a complaint with your local supervisory authority. A Data Processing Addendum incorporating the Standard Contractual Clauses is available to Customers on request at [email protected]. We have not appointed a representative in the European Union or United Kingdom.
The Service is intended for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, email [email protected] and we will delete it.
We may update this policy from time to time. When we do, we will post the new version here and update the "Last updated" date. If a change materially reduces your rights or materially changes how we use Customer Data, we will email account owners at least 14 days before the change takes effect. Your continued use of the Service after that date means you accept the updated policy.
Questions, requests, or concerns about this policy or your information:
DataMine AI, LLC
4620 Post Lane
Round Rock, TX 78681
United States
Privacy, deletion, data processing addenda, and legal requests: [email protected]
Everything else: [email protected]