Legal
Effective Date: March 1, 2026 · Last Updated: April 1, 2026
Aureliq Inc., doing business as MindBacklog ("we," "our," or "us"), operates the MindBacklog platform, a product intelligence tool that uses artificial intelligence to help product managers collect, analyze, and prioritize feature requests and feedback.
This Privacy Policy explains what information we collect, how we use it, how we protect it, and what choices you have. It applies to all users of our website (mindbacklog.com) and platform services.
By using MindBacklog, you agree to the practices described in this policy. If you do not agree, please do not use our services.
Account Information
When you create an account, we collect your name, email address, and password (or OAuth credentials if you sign in with Google or Microsoft). If you subscribe to a paid plan, we collect billing information processed securely through Stripe (via Stripe Managed Payments), our Merchant of Record — we never store your payment details.
Product & Workspace Data
When you create a product workspace, you may provide product documentation, URLs, descriptions, vision documents, and answers to clarifying questions. This information is used to build your product context within the MIND intelligence system.
Feedback & Source Data
When you connect external sources, the platform ingests data from those sources on your behalf:
Feedback Widget End Users
When your organization embeds the MindBacklog feedback widget on your website or application, we may collect data from your end users including feedback text, email (if voluntarily provided), page URL, and browser metadata. This data is processed as Customer Data within your Workspace and is subject to the same protections described in this policy. Your organization is responsible for providing appropriate notice to your end users about data collection through the widget.
Usage Data
We automatically collect standard usage information including IP address, browser type, device information, pages visited, features used, and timestamps. This helps us improve the platform and diagnose issues.
| Data Type | Purpose |
|---|---|
| Account info | Authentication, billing, account management, customer support, and transactional communications |
| Product context | Powering the MIND intelligence system — AI recommendations, feature scoring, and story generation specific to your product |
| Feedback data | AI clustering, sentiment analysis, pattern identification, and feature extraction within your workspace |
| Jira / DevOps data | Velocity tracking, Gantt chart projections, and two-way sync of features and user stories |
| Usage data | Platform analytics, performance monitoring, bug diagnosis, and product improvement |
We do not use your product data, feedback, or workspace content to train AI models. Your data is processed to provide services to you and is never used to improve models for other customers.
MindBacklog uses artificial intelligence to provide core platform features including feedback clustering, feature scoring, user story generation, and product context analysis.
How AI processes your data:
What AI does not do:
We use third-party AI model providers to process certain requests. When data is sent to these providers, it is transmitted securely and subject to their data processing agreements, which prohibit the use of customer data for model training. We select providers whose data handling practices meet our security requirements.
MindBacklog integrates with and uses the following categories of third-party services:
| Category | Services | Data Shared |
|---|---|---|
| Hosting | Railway App | All platform data (encrypted at rest) |
| Payments | Stripe (Merchant of Record via Stripe Managed Payments) | Billing info, email, plan details |
| Authentication | Google OAuth, Microsoft OAuth | Email, name, profile ID |
| AI Processing | Google Gemini, Groq | Product context and feedback text (per-request, not retained by provider) |
| AWS SES | Email address, notification content | |
| CDN & Security | Cloudflare | Request metadata, cached static assets |
| Analytics | Microsoft Clarity, Google Analytics | Microsoft Clarity: session recordings, heatmaps, click/scroll behavior (authenticated users only — no passwords or sensitive fields captured). Google Analytics: page views, traffic sources, device type, geographic region, and engagement metrics (marketing site and authenticated pages) |
| Team Communication | Slack (Slack Technologies, LLC) | Message text from designated channels (via user-initiated shortcuts or commands), sender display name, sender email (if available). OAuth bot token stored encrypted (AES-256). You control which channels are connected. |
| Project Management | Jira (Atlassian), Azure DevOps (Microsoft) | Features, stories, comments, estimates (as configured by you). OAuth tokens stored encrypted. |
Each third-party service is bound by their own privacy policies. We encourage you to review them. We select services that meet our security and privacy requirements and maintain data processing agreements where applicable.
MindBacklog allows you to connect third-party services to enhance your product management workflow. When you connect an integration, you authorize MindBacklog to access specific data from that service on your behalf.
Slack
When you connect your Slack workspace, MindBacklog accesses message content only from channels you explicitly designate and only when a team member actively sends feedback using the /mb slash command or the "Send to MindBacklog" message shortcut. We do not passively monitor, read, or store messages from your Slack workspace. We access sender profile information (display name and email) via Slack's API to attribute feedback. Your Slack bot token is stored encrypted using AES-256. You can disconnect Slack at any time from Product Settings, which immediately revokes access and deletes the stored token. Historical feedback data collected before disconnection is preserved in your workspace.
Jira (Atlassian)
When you connect Jira, MindBacklog syncs feature data, issue details, comments, and estimates between platforms as configured by you. OAuth tokens are stored encrypted. You can disconnect Jira at any time from Product Settings.
Email (IMAP)
When you connect an email source, MindBacklog accesses emails at the address you configure via the IMAP protocol. Credentials are stored encrypted. Only emails sent to or received at the connected address are ingested.
Revoking Access
You can disconnect any integration at any time from your Product Settings page. Disconnecting an integration immediately stops data collection and deletes stored authentication credentials. Data previously collected through the integration remains in your workspace unless you explicitly delete it.
We maintain a list of sub-processors who process Customer Data on our behalf. The third-party services table above reflects our current sub-processors.
We will notify customers by email at least 30 days before adding a new sub-processor that handles Customer Data. If you object to a new sub-processor, you may terminate your subscription before the change takes effect and receive a prorated refund for prepaid but unused service.
A signed Data Processing Addendum is available upon request for customers who require one for GDPR, CCPA, or other regulatory compliance. Contact [email protected] to request a DPA.
We take the security of your data seriously and implement industry-standard measures to protect it:
While we implement robust security measures, no system is 100% secure. In the unlikely event of a data breach, we will notify affected users within 72 hours of discovery as required by applicable law.
Active accounts: We retain your data for as long as your account is active and as needed to provide services.
Cancelled accounts: When you cancel your subscription, your account and workspace data are retained for 30 days in case you wish to reactivate. After 30 days, workspace data (product context, feedback, features, AI-generated content) is permanently deleted.
Account deletion: You may request complete account deletion at any time by contacting us. Upon request, all personal data, product data, and workspace content will be permanently deleted within 30 days. Some data may be retained in encrypted backups for up to 90 days before being purged.
Billing records: Transaction records are retained for 7 years as required by financial regulations.
Anonymized data: We may retain anonymized, aggregated data that cannot identify you for analytics and product improvement purposes indefinitely.
Depending on your jurisdiction, you may have the following rights regarding your personal data:
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
California residents (CCPA): You have the right to know what personal information we collect, request deletion, and opt out of any sale of personal information. We do not sell personal information.
European residents (GDPR): Our legal bases for processing personal data are detailed below:
| Processing Purpose | Legal Basis |
|---|---|
| Providing the platform and its core features | Contract performance |
| Payment processing via Stripe | Contract performance |
| AI processing of your product data | Contract performance |
| Sending transactional emails (e.g., password resets) | Contract performance |
| Platform security and fraud prevention | Legitimate interest |
| Usage analytics and product improvement | Legitimate interest |
| Processing feedback widget end-user data | Legitimate interest of our customer (your organization) |
| Marketing communications | Consent |
You have the right to lodge a complaint with your local data protection authority.
We use cookies and similar technologies for the following purposes:
| Type | Purpose | Required |
|---|---|---|
| Essential | Authentication, session management, security | Yes |
| Functional | Remembering preferences, workspace settings | Yes |
| Analytics | Understanding platform usage, feature adoption, and performance. Includes Microsoft Clarity for anonymous session replay and heatmap analysis (authenticated pages only — sensitive fields auto-masked), and Google Analytics for page views, traffic sources, and engagement metrics across marketing and authenticated pages. | No |
We do not use advertising cookies or tracking pixels. We do not share cookie data with third-party advertisers. You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent the platform from functioning properly.
MindBacklog is a business-to-business product designed for professional use. We do not knowingly collect personal information from anyone under the age of 16. If we learn that we have collected data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at [email protected].
MindBacklog integrates with products and services owned by third parties. All third-party product names, logos, and brands mentioned in this policy, on our website, or within our platform are the property of their respective owners:
MindBacklog is not affiliated with, endorsed by, or sponsored by any of these companies. Use of their trademarks is solely for identification and reference purposes.
MindBacklog may process and store data in locations outside your country of residence. When we transfer data internationally, we implement appropriate safeguards including standard contractual clauses and data processing agreements to ensure your data remains protected in accordance with this policy and applicable law.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email and update the "Last Updated" date at the top of this page.
We will not retroactively reduce your rights under this policy without your explicit consent. We encourage you to review this page periodically.
If you have questions, concerns, or requests related to your privacy or this policy, you can reach us at:
Aureliq Inc.
doing business as MindBacklog
Privacy inquiries: [email protected]
General contact: [email protected]
We aim to respond to all privacy-related requests within 30 days.