Trust center

Trust built into every conversation.

How we handle your data, how our AI agents behave and how we help you operate under Latin American data protection laws.

Book a demo

Data

How we handle data

A summary of our Privacy Policy and AI Policy. If anything here differs from the policies, the policies prevail.

  • You own your data

    Customers retain ownership of their data. Data is processed solely to provide the Services.

  • No training of shared models

    We do not use customer data to train shared AI models unless explicitly agreed. Aggregated and anonymized data may be used to improve the platform.

  • We don't sell personal data

    We do not sell personal data. Service providers and the integrations you configure process data to deliver the Services.

  • Protection measures

    Encryption in transit and at rest where applicable, access controls, and monitoring and logging.

  • Retention

    Data is kept as long as necessary to provide the Services, as required by law or as defined in customer agreements, and may be anonymized or deleted when no longer needed.

  • Where data is processed

    In the United States and other regions where our infrastructure operates, with safeguards where required.

AI transparency

Responsible AI by design

  • Always disclosed as AI

    Our AI Policy calls for every deployment to clearly disclose that users are interacting with AI and never to mislead them into believing they are talking to a human.

  • Human handoff

    Agents escalate to human agents through the escalation paths you define, with the conversation context.

  • Human oversight for high-risk cases

    Financial, legal, medical and identity decisions require human oversight. MindLab does not provide fully autonomous decision-making for high-risk scenarios.

  • Measurable and auditable

    LLM-as-judge evaluation scores every interaction, and conversations are auditable, with CSAT, compliance and escalation metrics.

Security

Security practices and certifications

How we protect the data your agents handle, and where we stand on certifications. MindLab does not hold SOC 2, ISO 27001 or any equivalent certification today. We say so up front, and we go through your security review with you.

  • Access control and tenant isolation

    Least-privilege access to production systems, and multi-tenant isolation that keeps each customer's agents, knowledge bases and conversations separate. Credentials for your integrations stay limited to the permissions you grant.

  • Encryption, monitoring and guardrails

    Encryption in transit and at rest where applicable, activity logging and monitoring, rate limiting and abuse detection. Agents run with the guardrails you configure and escalate to your team through the paths you define.

  • Security reviews and DPAs

    We hold no security certification today and we do not claim one. During the demo and the pilot we answer your security questionnaire, review how data is handled, where it is processed and how long conversations are retained, and sign a data processing agreement when your review calls for one.

Latin America

Data protection in Latin America

A quick reference to the main personal data protection laws in the region. Always check the current text of each law.

  • Mexico

    LFPDPPP

    A new Federal Law on the Protection of Personal Data Held by Private Parties has been in force since March 21, 2025, replacing the 2010 law.

    How we help you comply

    Whatever the regime, you get the same building blocks: privacy notice text for the agent, a clear disclosure that the customer is talking to an AI plus the consent steps you define, configurable retention, export and deletion of conversations, a data processing agreement, and a choice of processing region where our infrastructure offers one. This is informational, not legal advice: your legal team decides what each law requires of you.

  • Colombia

    Law 1581 of 2012 · SIC External Circular 002 of 2024

    The general data protection law, complemented by the SIC's 2024 guidance on processing personal data in AI systems, which includes privacy impact assessments.

    How we help you comply

    Whatever the regime, you get the same building blocks: privacy notice text for the agent, a clear disclosure that the customer is talking to an AI plus the consent steps you define, configurable retention, export and deletion of conversations, a data processing agreement, and a choice of processing region where our infrastructure offers one. This is informational, not legal advice: your legal team decides what each law requires of you.

  • Chile

    Law 21.719

    The new personal data protection law takes effect on December 1, 2026 and creates a new Personal Data Protection Agency.

    How we help you comply

    Whatever the regime, you get the same building blocks: privacy notice text for the agent, a clear disclosure that the customer is talking to an AI plus the consent steps you define, configurable retention, export and deletion of conversations, a data processing agreement, and a choice of processing region where our infrastructure offers one. This is informational, not legal advice: your legal team decides what each law requires of you.

  • Peru

    Law 29733 · Supreme Decree 016-2024-JUS

    The new regulation, in force since March 2025, introduces a mandatory data protection officer (DPO) and 48-hour breach notification.

    How we help you comply

    Whatever the regime, you get the same building blocks: privacy notice text for the agent, a clear disclosure that the customer is talking to an AI plus the consent steps you define, configurable retention, export and deletion of conversations, a data processing agreement, and a choice of processing region where our infrastructure offers one. This is informational, not legal advice: your legal team decides what each law requires of you.

  • Ecuador

    LOPDP

    The Organic Law on Personal Data Protection, published in 2021, regulates the processing of personal data and the rights of data subjects.

    How we help you comply

    Whatever the regime, you get the same building blocks: privacy notice text for the agent, a clear disclosure that the customer is talking to an AI plus the consent steps you define, configurable retention, export and deletion of conversations, a data processing agreement, and a choice of processing region where our infrastructure offers one. This is informational, not legal advice: your legal team decides what each law requires of you.

  • Argentina

    Law 25.326

    The Personal Data Protection Law, enforced by the Agency for Access to Public Information (AAIP).

    How we help you comply

    Whatever the regime, you get the same building blocks: privacy notice text for the agent, a clear disclosure that the customer is talking to an AI plus the consent steps you define, configurable retention, export and deletion of conversations, a data processing agreement, and a choice of processing region where our infrastructure offers one. This is informational, not legal advice: your legal team decides what each law requires of you.

  • Brazil

    LGPD · Law 13.709/2018

    The General Data Protection Law, in force since 2020 and enforced by the National Data Protection Authority (ANPD).

    How we help you comply

    Whatever the regime, you get the same building blocks: privacy notice text for the agent, a clear disclosure that the customer is talking to an AI plus the consent steps you define, configurable retention, export and deletion of conversations, a data processing agreement, and a choice of processing region where our infrastructure offers one. This is informational, not legal advice: your legal team decides what each law requires of you.

This page is for information only and does not constitute legal advice. Consult your legal counsel about your specific obligations.

Policies

Our policies

The full documents that govern how we handle data and AI.

Next step

Questions about data and compliance?

Book a call with our team, or ask our AI agent how MindLab handles data and AI.

Book a demo