Who is responsible for your data

Minteller is the data controller for the personal data described here. We are registered in the United Kingdom and UK GDPR and the Data Protection Act 2018 apply.

For anything to do with your data, including any of the rights below, contact privacy@minteller.com.

Where a client organisation uploads material about its own staff or customers into a workspace, that organisation is the controller of that material and we process it on their behalf.

What we collect

Account details. Your name, email address, and whether you joined as a contractor or a client. If you sign in with Google or LinkedIn, where we have switched those on, we receive your name and email from them, never your password.

Contractor profile. Everything you choose to put on your profile: headline, discipline, sectors, software, accreditations, languages, location, timezone, rates, availability and profile photo. This is deliberately visible to signed-in client organisations, because being found is the point of having one. Your profile photo is stored so that it can be shown without signing in, so do not upload an image you would not want to be public.

Organisation details. For client accounts: organisation name, type, website, your role in it, and who else is a member.

Things you create. Messages you send, files and drawings you upload, comments, tasks, site scans and measurements, and the workspaces these live in.

Video calls. We use Twilio to carry video and audio. Calls are not recorded and their content does not reach our servers; we store only that a call happened, between whom, and for how long. Twilio receives your IP address in order to route the call.

Security and session records. When you sign in we record the time, your IP address, and your browser's user agent, so you can review your own active sessions and so we can detect account takeover. We also record failed sign-in attempts to lock out brute-force attacks.

Agreement records. When you agree to our terms or this policy we record which version you agreed to, a fingerprint of its exact text, the time, your IP address and your user agent. This exists so that we can demonstrate what you agreed to and when.

Payment details. For client organisations: billing address, VAT number where given, and a record of invoices. Card numbers go directly to Stripe and never reach our servers.

Support correspondence. What you tell us when you contact us.

Reviews. After working together in a workspace, a client organisation may review a contractor and a contractor may review a client: a star rating, a few chosen words from a fixed list, and an optional short comment. We keep what was written, who wrote it, and which workspace it came from.

Feedback and pilot records. If you send feedback through the app we keep what you wrote, any screenshot you attach, and a small amount of context about where you were in the app: the page, the app version and the kind of browser. We never attach the contents of your messages or files. If you take part in the pilot we also keep a record of how you joined it and, if you tell us, whether a contact made through Minteller led to work.

We do not use third-party analytics or advertising trackers, and we do not build behavioural profiles of you. During the pilot we record a small set of product events of our own, described under The pilot below.

Why we use it, and our lawful basis

To provide the service you have asked for, including your profile, messaging, workspaces and files — because it is necessary to perform our contract with you.

To take payment and manage subscriptions for client organisations — necessary to perform our contract, and to comply with tax law.

To keep accounts secure: session records, lockouts, and multi-factor authentication — our legitimate interest in protecting users, and yours in not being compromised.

To keep a record of agreement to our terms — our legitimate interest in being able to demonstrate the contract that governs the service. This is why IP addresses are stored against acceptance records. We do not use them for any other purpose.

To send service messages you cannot opt out of while you have an account, such as verification codes, security alerts, and notices that your payment has failed — necessary to perform our contract.

To send notification emails about activity in your workspaces — our legitimate interest in a service that works, and you can turn these off in settings.

To meet legal obligations, including accounting records and responding to lawful requests.

Who we share it with

We do not sell your personal data, and we never will.

We use the following providers, who process data on our instructions:

Amazon Web Services — hosting, databases, file storage, malware scanning of uploads and email delivery, in its Ireland region.

Stripe — payment processing for client subscriptions. Stripe is a controller in its own right for fraud prevention.

Twilio — carrying video and audio during calls.

logo.dev — fetching a company's logo from its website domain, so organisation pages look right. Your browser requests the image directly; we send the domain, not anything about you personally.

Google and LinkedIn — only if you choose to sign in with them, and only where we have switched that on.

Microsoft — only if you connect an Outlook calendar so that your availability reflects it.

Reviews are shown as follows. A client's review of a contractor is shown to signed-in client organisations on that contractor's profile and in search results, with the reviewing organisation's name and never the individual reviewer's, and only once the contractor has three or more reviews. A contractor's review of a client is, during the pilot, seen only by the Minteller team. A review can be hidden by us on request or where it breaks the acceptable use policy, and the person reviewed can reply once.

We also share data where we are legally required to, and we would share it with a buyer if the business were sold — in which case we would tell you first.

Where your data is held

Your data is held in Ireland, in the European Economic Area. Some of our providers are US companies, and where data reaches them it is covered by the UK International Data Transfer Addendum or the equivalent standard contractual clauses.

How long we keep it

Your account and its content, for as long as your account exists.

When you ask us to close your account, we delete or anonymise your personal data within 30 days, except where we must keep it longer. Content you contributed to a shared workspace may remain visible to that workspace's other members, because it is part of their record of the work.

Invoices and accounting records: six years, as tax law requires.

Session and security records: 12 months.

Product events and feedback from the pilot: six months, after which they are deleted or reduced to counts that identify nobody.

Agreement records: for as long as your account exists and six years afterwards, because their whole purpose is to evidence a contract that could be disputed within the limitation period.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or send it to another provider. You can object to processing we do on the basis of legitimate interests, and you can withdraw consent where we relied on it.

Much of this you can do yourself in the app: edit your profile, download your files, delete content, and end your active sessions. A review you wrote can be changed or removed by you for 14 days. If you have been reviewed, you can reply once, and you can ask us to check a review you believe is unfair or untrue.

Ask us at privacy@minteller.com and we will respond within one month.

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Security

Passwords are never stored in a form we can read. Sessions ride in HttpOnly cookies that scripts cannot reach. Two-step verification is available and we encourage it. Everything between your browser and Minteller travels over an encrypted connection. Files and the database are encrypted at rest on Amazon Web Services; this is encryption on the server, not end-to-end encryption, so Minteller can read files in order to show them to you. Every workspace file and message attachment is scanned for known malware after upload by AWS GuardDuty; site scans and profile photos are not. Access to a workspace file is checked on every request rather than relying on the secrecy of a link. Changes to who can see a file, uploads, downloads, deletions, scan results, billing changes and administrator actions are recorded in an audit trail that cannot be edited.

No system is perfectly secure. If you find a vulnerability, please report it to security@minteller.com rather than disclosing it publicly, and we will work with you.

The pilot

Minteller is running a limited pilot with a small number of organisations and specialists. If you take part, three extra things apply.

We record product events so that we can tell whether the pilot is working: for example that a search was run and how many results it returned, that a profile was viewed, that a conversation was started, or that a workspace was created. These events carry which features were used and simple counts. They never contain what you typed into a search, the contents of a message, or the contents of a file. We rely on our legitimate interest in evaluating the pilot, and we keep them for six months.

You can send us feedback from inside the app. We keep what you write and the context described above so that we can act on it, and we may reply to you about it.

You may be offered two optional choices: to be contacted about research into how you use Minteller, and to receive product updates. Both are off unless you turn them on, you can turn them off at any time in your account settings, and neither affects your access in any way.

Children

Minteller is for professional use and not intended for anyone under 18. We do not knowingly collect data about children.

Changes

We will publish a new version here when this changes, with a new effective date. Where a change materially affects you, we will tell you and ask you to agree to the new version.