How we handle your data.

Information you provide directly. When you complete the AI Transformation Flywheel Diagnostic, download our whitepaper, submit a contact form, or otherwise interact with our site, we may collect:

• Name, email address, job title, and role level
• Organization name, industry, size, and revenue range
• Diagnostic survey responses (your answers to assessment questions about your organization’s AI readiness)
• Free-text comments or messages submitted through forms

Information collected automatically. When you visit our site, we automatically collect:

• Device and browser information (type, operating system, screen resolution)
• IP address and approximate geographic location
• Pages visited, time spent, referral source, and interaction patterns
• Cookies and similar technologies (see Section 7 below)

Information we obtain from other sources. After you give us your name and email address, we use automated web research to find publicly available professional information about you. This is described in full in Section 5. The information we obtain this way may include:

• Your professional title and seniority level
• Your employer’s name, website, industry, and approximate size
• A public LinkedIn profile URL, where one is found
• A short professional biography written by an AI model from public search results, together with the source web addresses it drew on and a confidence rating

We use the information we collect to:

• Generate your personalized diagnostic results, archetype classification, and action plan
• Send you your diagnostic results, access codes, and requested materials (e.g., whitepaper delivery)
• Respond to inquiries submitted through our contact form
• Research your professional background and your organization’s profile, so that we understand who we are speaking with and can make our communications relevant (see Section 5)
• Improve our diagnostic methodology, research, and services
• Analyze site usage and performance to improve the user experience
• Comply with legal obligations and protect against fraud or misuse

We may anonymize and aggregate diagnostic responses and other data so that it no longer identifies you or your organization. This anonymous, aggregated data may be used for:

• Research and analysis on organizational AI readiness trends
• Benchmarking studies and published reports (no individual or organization is identifiable)
• Improving our diagnostic instruments, scoring models, and advisory methodologies
• Marketing materials that reference aggregate statistics (e.g., “73% of respondents scored below 3.0 on governance readiness”)

Once data has been anonymized and aggregated, it is no longer considered personal information and may be used for any business purpose consistent with this policy and applicable law.

Your diagnostic responses are processed by an AI model (currently Anthropic’s Claude) to generate a personalized executive narrative. This analysis runs on demand when you complete the diagnostic, and under our agreement with the provider your data is not used to train their models.

The information sent to the AI provider for this analysis is your name, job title, organization name, industry, organization size, email address, your survey scores, the maturity tier, value-ceiling and strategic-orientation classifications derived from them, your archetype classification, the gap between your self-assessment and your derived scores, the barriers you selected, and your generated action plan.

What we do. When you give us your name and email address through a form on this site, we run an automated research process to build a professional profile of you. We do this so we know who we are speaking with before we reply, and so our communications are relevant rather than generic. This is profiling for business development purposes.

We skip it where we have nothing to anchor the search to. If you use a personal email address (Gmail, Outlook and similar) and do not tell us your organization, no research is performed.

How it works. An automated job sends your name, email address, email domain, and any organization name you gave us to a commercial AI provider — currently Google’s Gemini. That model runs public web searches on your name and organization using Google Search, reads the results, and returns structured information about you. Our system can be configured to use Anthropic or OpenAI for the same purpose instead. The process runs on a schedule rather than at the moment you submit a form, so it typically happens within a day of your first contact with us.

What we store. The results are saved to our customer records and may include your professional title, an inferred seniority level, your employer’s name, website, industry and approximate size, a public LinkedIn profile URL, and a short professional biography written by the AI model. We also store the web addresses the model drew on, its stated reasoning, and a confidence rating of high, medium or low.

Automated inferences, and the limits of this process. Some of what we store is inferred rather than stated: seniority level is derived from job title, organization size is an estimate, and the biography is written by a model summarizing search results. These inferences can be wrong, and they can attach the wrong person’s public profile to your record. We do not use them to make any decision that produces a legal or similarly significant effect on you. They inform how we prioritize and word our outreach.

What human review does and does not cover. Where the model rates its own result as medium or low confidence, we still store its confidence rating, sources, reasoning and the biography it wrote. What we hold back is the proposed structured data — title, seniority, LinkedIn URL and organization details — which is not written to your main record until a person reviews and approves it.

Where a person at Mindspan Labs has corrected your title, seniority level or LinkedIn URL by hand, our scheduled enrichment will not overwrite those three fields. Other fields, including the AI-written biography and the supporting sources, may be refreshed by a later run.

How to see it, correct it, or stop it. You can ask us for a copy of the enriched profile we hold about you, ask us to correct it, or ask us to delete it and stop enriching your record entirely. Email hello@mindspanlabs.ai.

We do not sell your personal information. We may share information with:

• Service providers who help us operate our site and deliver services. These are: email delivery via Resend; hosting, analytics and performance measurement via Vercel; database storage via Supabase; AI analysis of diagnostic responses via Anthropic; AI contact research and web search via Google; site analytics via Google Analytics; web font delivery via Google Fonts, which your browser requests directly from Google on every page; bot protection on our forms via Cloudflare Turnstile; and customer record sync via Notion, which receives your name, email address and organization whenever we create or update your contact record. That includes any of our forms — the diagnostic, the whitepaper download, the contact form and a team assessment — as well as when you change your email preferences and when our email provider reports a delivery event for a message we sent you. Under our agreements, these providers are obligated to protect your data and use it only for the services they provide to us, and your data is not used to train their AI models.
• Legal compliance — when required by law, regulation, legal process, or enforceable governmental request.
• Business transfers — in connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We use the following types of cookies and analytics:

• Essential cookies — required for site functionality, including diagnostic results access authentication (httpOnly session cookies). These are always active.
• Google Analytics — sets cookies and reports your activity on this site to Google. It does not load at all unless you accept the cookie banner.
• Vercel Analytics and Speed Insights — measure page views and loading performance. These load for all visitors regardless of your cookie choice. They set no cookies, do not use device fingerprinting, and do not track you across other websites.

We do not use advertising cookies, and we do not share analytics data for cross-context behavioral advertising.

Changing your choice. Use the Cookie Settings link in the footer of any page. It reopens the banner, shows your current choice, and lets you switch. Withdrawing after you accepted also clears the Google Analytics cookies already on your device. You can block cookies entirely through your browser settings as well.

We implement appropriate technical and organizational measures to protect your information, including:

• Encryption in transit (TLS/HTTPS on all connections)
• Encrypted database storage with access controls
• Access code protection for diagnostic results pages
• Rate limiting on authentication endpoints

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

We retain your personal information for as long as necessary to provide our services and fulfill the purposes described in this policy. Diagnostic results are retained indefinitely to allow return access via your access code. Enriched profile data is retained for as long as your contact record exists. You may request deletion at any time (see Section 10).

Anonymous, aggregated data is retained indefinitely as it does not constitute personal information.

Depending on your location, you may have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you
• Correction — request correction of inaccurate information
• Deletion — request deletion of your personal information
• Opt-out — unsubscribe from marketing emails at any time via the unsubscribe link in any email
• Do Not Sell / Do Not Share — we do not sell or share personal information for cross-context behavioral advertising
• Object to enrichment — ask us to delete the researched profile described in Section 5 and to stop enriching your record. We will honor this without also deleting the rest of your account, unless you ask us to.

To exercise any of these rights, contact us at hello@mindspanlabs.ai. We will respond within 30 days.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.

Categories of personal information we collect. Identifiers (name, email address, IP address); professional or employment-related information (job title, employer, seniority); internet activity (pages visited, interaction data); geolocation inferred from IP address; and inferences drawn from the above — a profile of your professional role and organization as described in Section 5, and the archetype, maturity tier and scores the diagnostic assigns you.

We collect identifiers and employment information both directly from you and from public web sources via automated research. We do not ask for sensitive personal information as CPRA defines it, and we do not use it for any purpose; our forms include free-text fields, so we cannot prevent you from entering it voluntarily.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on: (a) your consent, (b) our legitimate interests in operating and improving our services and in understanding who is contacting us, or (c) the necessity of processing for contractual performance. You have the right to withdraw consent, access your data, request portability, object to processing carried out on the basis of our legitimate interests, and lodge a complaint with your local data protection authority.

Data we obtain from sources other than you. The enrichment process in Section 5 obtains personal data about you from publicly accessible web pages rather than from you directly. The categories of data, the sources, the purpose, and our legal basis (legitimate interests in business-to-business contact research) are set out in Section 5. We retain it for as long as your contact record exists, and you may object to it at any time by emailing hello@mindspanlabs.ai.

Transfers outside your region. Our service providers, including Anthropic, Google, Vercel, Supabase, and Resend, process data in the United States.

Our services are not directed to individuals under 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child under 18, we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised effective date. Your continued use of our site after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, contact us at:

DGT Global, LLC dba Mindspan Labs
Email: hello@mindspanlabs.ai
Web: mindspanlabs.ai/contact