Privacy Policy

The data controller for the Lotus Mind AI Hub is Lotus Mind Ltd (Lotus Mind Limited), Company No. 826314, incorporated on 18 September 2026 in Ireland. Our registered office is 10 Aderrig Manor, Adamstown, Lucan, Dublin K78 A4T8, Ireland.

Contact for data-protection matters: privacy@lotusmind.one

This Privacy Policy applies to the Lotus Mind AI Hub web application (the "Hub"), accessible at lotusmind.one and on designated preview ports during development.

Important — prototype status: The Hub is currently a prototype / beta product. Member profiles, tool-run history, and rate-limiting records are stored server-side on Lotus Mind Limited’s servers (Hetzner, Germany). Your browser’s localStorage holds only your session token and UI preferences. Tool inputs submitted to AI-powered tools are answered by Lotus Mind's self-hosted AI model (no third-party provider) per request — see §8a.

In the current prototype, the following categories of data are involved:

The Hub sets one strictly necessary cookie, lm_session, which keeps you signed in for up to 7 days. It needs no consent under the ePrivacy rules because it is essential to the service you ask for. No third-party analytics, advertising trackers, or session-recording tools are integrated. Browser-local data uses localStorage, which remains on your device. Server-stored categories (see table above) are kept only for the purposes stated and are never shared or sold.

Language & region counts (opt-in). If you switch on “Count my language & region” in Settings or on a tool page (it is off by default), viewing or running a tool adds one count for your browser language and — only if you set a country in your profile — that country, per tool per day. We store totals only: no name, account, IP address, session, device or text, and we never join these counts with your profile. Totals under 5 are hidden. Daily totals are kept for 400 days, then rolled up into all-time totals. Switch off at any time in Settings — counting stops immediately.

Where GDPR applies, our legal basis for any processing described above is:

• Consent (Article 6(1)(a)) — where you have actively provided data or enabled functionality.
• Legitimate interests (Article 6(1)(f)) — improving the prototype product and detecting abuse.
• Performance of a contract (Article 6(1)(b)) — once a service agreement is in place (post-prototype).

Lotus Mind Limited acts as data controller for all personal data processed by the Hub. This includes server-side data (member profiles, tool-run history, rate-limiting records) and browser-side data (localStorage session tokens, UI preferences). For profiling/personalisation data, we process on the basis of your explicit consent (Art. 6(1)(a)), which you may withdraw at any time via Settings → Privacy or by emailing privacy@lotusmind.one.

The Hub uses two storage mechanisms: (1) server-side flat files (member profiles, tool-run history, rate-limiting records) stored on Lotus Mind’s servers in Germany (Hetzner), and (2) browser localStorage for session tokens and UI preferences stored on your device.

You can clear localStorage at any time via your browser privacy settings (Settings → Privacy → Clear browsing data → Local storage / Site data). Clearing localStorage removes your session token and UI state but does not delete server-side data. To request deletion of server-side data, email privacy@lotusmind.one.

The only cookie the Hub sets is strictly necessary (see our Cookie Policy), so no consent is required under the EU ePrivacy Directive. If this changes — for example when analytics is added — this Policy will be updated and a cookie-consent prompt will be implemented before the change takes effect.

Under the General Data Protection Regulation (GDPR) and applicable Irish data-protection law, you have the following rights in relation to any personal data we process:

• Right of access (Article 15) — to obtain confirmation of whether we process your data and to receive a copy.
• Right to rectification (Article 16) — to have inaccurate data corrected.
• Right to erasure (Article 17) — to have data deleted where processing is no longer justified ("right to be forgotten").
• Right to restriction of processing (Article 18) — to restrict how we use your data in certain circumstances.
• Right to data portability (Article 20) — to receive your data in a machine-readable format.
• Right to object (Article 21) — to object to processing based on legitimate interests.
• Right not to be subject to automated decision-making (Article 22) — where applicable.

We store on our servers the data listed in the table in this notice — including your account and profile, tool-run history, 2FA secrets, and any waitlist e-mail or affiliate application you submit. You can exercise all rights below at any time by contacting privacy@lotusmind.one.

If you believe your data-protection rights have been violated, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC):

Data Protection Commission Ireland
21 Fitzwilliam Square South, Dublin 2, D02 RD28
Phone: +353 1 765 0100
Web: dataprotection.ie — Online complaint form

localStorage data (preferences, tool state, 2FA enablement flag) is held on your device until you clear browser data.

Server-side data is retained as follows:

• Waitlist emails — retained until we contact you at launch or you request deletion (email: privacy@lotusmind.one).
• Affiliate application details — retained for up to 12 months for application review, then deleted unless an affiliate relationship is formed.
• Lotus Pond activity — day records for up to 400 days, at most one record per pond game, league weekly records (including league-game play seconds) and league week lists for 2 weeks (the current and the previous week); request counters for at most 24 hours; all deleted with your account, or with an unverified sign-up after 7 days. Included in your data export.
• 2FA verification secret — retained until you disable 2FA or request deletion. Not linked to your identity in the prototype.

When a full production backend is introduced, we will publish a comprehensive retention schedule and data-subject request process.

Server-stored data (waitlist emails, affiliate details, 2FA secrets) is hosted on our prototype server located in the European Union (Germany). It is not transferred outside the EEA.

If bot-protection (Cloudflare Turnstile) is enabled in future, your CAPTCHA solution data will be processed by Cloudflare as a processor on our behalf, under Cloudflare's privacy policy and our instructions. This will be disclosed clearly on the affected forms when activated.

When infrastructure is introduced, we intend to host all EU-user data within the European Economic Area (EEA). Any transfer outside the EEA will be subject to appropriate safeguards (e.g., Standard Contractual Clauses) as required by GDPR Chapter V.

Certain Lotus Mind tools use a large language model (LLM) to generate responses. These requests are answered by Lotus Mind's own self-hosted AI model (MiniMax M2.7), running on servers we operate and reached over a private encrypted link. No third-party AI provider, AI routing service or non-EEA sub-processor receives your words for these tool interactions. (Updated 2026-09-30: retention times corrected to match our servers' actual behaviour.)

• Data sent: Your tool input text for that specific request only; the model keeps no memory between requests.
• Retention: You can retrieve a run's content for 30 minutes; after that it is no longer accessible, and on most tools the stored text is scrubbed from storage within 30 minutes. On all tools it is permanently deleted from our servers within 30 days. Run metadata (the time of the request, a hashed IP address and the tool used) is kept for 30 days for quality and abuse review, then deleted. Inputs and outputs are never used to train models.
• Legal basis: Performance of a contract / legitimate interest (Art. 6(1)(b) and 6(1)(f) GDPR) — you explicitly chose to use an AI-powered feature. Where health or other special-category data is included in your input, you provide explicit consent for that request (Art. 9(2)(a)).
• Safety: Crisis indicators are detected before any model call and answered with a static support card — such inputs never reach the model.

Lotus Mind is for adults only. Every Lotus Mind service is for people aged 18 and over. To create an account you must confirm that you are 18 or over and verify your e-mail address. We do not offer accounts to anyone under 18 and we do not knowingly collect or process personal data about anyone under 18.

If we learn an account belongs to someone under 18. We close the account and permanently delete its data. If you believe someone under 18 has provided data through the Hub, contact us at privacy@lotusmind.one and we will act promptly, including deletion.

Absolute protections: Any data relating to a person under 18 that reaches us is never sold to any third party and is never used for advertising purposes, including targeted advertising, behavioural profiling, or any form of ad-tech processing. These protections apply unconditionally and without time limit, including following any acquisition or change of control of Lotus Mind Limited, and mirror Section 12.7 of the Terms of Service.

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of the page and, where changes are material, we will provide notice within the Hub. Continued use of the Hub after changes take effect constitutes acceptance of the revised Policy.

For all data-protection enquiries, please contact:

Governing law: the laws of Ireland, subject to applicable EU data-protection legislation.