Privacy policy
Last updated: 28 August 2026
Glencorse Ltd, a company registered in England and Wales (company number 10222791, registered office 20-22 Wenlock Road, London, England, N1 7GU), trading as mnd8t, is the controller of the personal data described here. "We", "us" and "mnd8t" mean Glencorse Ltd.
This policy covers mnd8t.com, the mnd8t dashboard and the mnd8t API.
The short version
mnd8t is an authority-decision and evidence service. It decides whether a proposed financial action is within a mandate you defined, and records what it decided. It never holds your money, your payment credentials or your private keys — that is an architectural property of the system, not a promise about our conduct. Your data is processed in the United Kingdom, is never sent to any AI or machine-learning provider, and is never used to train models.
What we collect
Account data. Your email address, and — where you sign in with Google or GitHub — the display name, avatar URL and provider subject identifier those services return. If you use email and password sign-in, we store a hash of your password, never the password itself.
Organisation data. Your organisation's name, jurisdiction fields, the members of your organisation and their roles.
Service data. The material you or your agents send us in order to get a decision: agents, mandates and their policy terms, counterparty identifiers, financial account references, proposed actions (amount, currency, asset, destination reference, counterparty reference, purpose), the decisions we returned and the rule traces behind them, approval records, evidence receipts, API key metadata, webhook endpoints and delivery logs.
Technical data. Server logs including IP address, user agent, request path and timing. Authorisation headers and cookies are redacted at the logger.
What we never receive
We do not receive, request or store payment credentials, bank credentials, wallet private keys, card numbers, or any secret capable of moving money. Your executor holds those and uses them outside our systems. We hold exactly one key of our own — an Ed25519 key used to sign evidence receipts — which has no relationship to any account, chain or provider.
We do not perform identity verification, KYC, sanctions or AML screening, and we do not collect the special-category data those processes involve.
How we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing the service: evaluating authority, returning decisions, issuing receipts | Performance of a contract |
| Authenticating you and keeping your account secure | Performance of a contract |
| Keeping an audit trail of decisions and approvals | Legitimate interests, and your own compliance needs |
| Diagnosing faults, preventing abuse, maintaining availability | Legitimate interests in operating a reliable service |
| Product analytics and improvement | Legitimate interests, limited to aggregate operational metrics |
| Sending you service and marketing email, where offered | Consent, withdrawable at any time |
We do not sell personal data, and we do not use it for automated decision-making about you. The decisions mnd8t makes are about proposed financial actions against rules you wrote, not about individuals.
No AI processing
There is no large language model anywhere in the decision path, and your data is not transmitted to any AI or machine-learning provider for any purpose, including model training or evaluation. This is a design constraint of the product, and it is testable: decisions are deterministic and reproducible from the recorded policy version and inputs.
Where your data is processed
In Google Cloud Platform's europe-west2 region (London, United Kingdom).
Static assets are served through Firebase Hosting's global edge network. See
the sub-processors page for the full list and for how
we notify you of changes.
Cookies
We set one cookie, __session, which holds your dashboard session. It is
strictly necessary, HTTP-only, and it is the only cookie we set. We use no
analytics, advertising, or tracking cookies, and no third-party tags of any
kind.
How long we keep it
Account and organisation data is retained while your account is open and for [RETENTION PERIOD] afterwards, then deleted.
Evidence receipts are different, and you should understand why before you rely on the service. Receipts are hash-chained: each references the one before it. Deleting a receipt breaks the chain and destroys the verifiability of every receipt after it — which is the property the whole product exists to provide. We therefore retain receipts for the life of your contract and for [RECEIPT RETENTION PERIOD] afterwards, after which the chain is destroyed in full rather than in part. If you need earlier erasure, we can delete an entire organisation's chain, but not selected entries within it.
Server logs are retained for [LOG RETENTION PERIOD].
Your rights
Under the UK GDPR you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time.
Write to privacy@mnd8t.com. We will respond within one month. The erasure constraint described above applies to receipts, and we will explain it if it affects your request.
You may complain to the Information Commissioner's Office (ico.org.uk) if you believe we have handled your data unlawfully. We would prefer you raise it with us first.
Security
Read the responsible disclosure page for how to report a vulnerability, and the published security documentation for how the execution boundary protects you architecturally.
Changes
We will post material changes here and, where the change is significant, tell account holders directly before it takes effect.
Contact
Glencorse Ltd, 20-22 Wenlock Road, London, England, N1 7GU — privacy@mnd8t.com