Effective date: May 25, 2026
This Privacy Policy explains how Mint Candi, Inc. ("Mint Candi", "we") handles personal data in connection with the MintCheck service.
For personal data that our business customers submit to the Service about their workers and contacts ("Customer Data"), the customer is the controller and we act as a processor handling it on the customer's behalf. For data whose purposes we determine — such as account registration, billing, and website use — we act as the controller.
This Policy primarily addresses our role as controller; our processor obligations are set out in the Data Processing Addendum (DPA).
Account and contact data: name, email address, password, phone number, and organization details.
Billing data: card details are collected and processed directly by our payment processor, Stripe; we do not receive or store full card numbers or security codes. We keep only the cardholder name, card brand, last four digits, and expiry date for display, together with billing records such as invoices and payment history.
Service data submitted by customers: worker names and contact details, asset records and images, and location data associated with inspections, tasks, and reports.
Usage and device data: log data, IP address, device identifiers, and push notification tokens (for example, Firebase Cloud Messaging tokens).
To provide, operate, and support the Service, including inspections, tasks, reports, and notifications.
To provide AI-assisted safety and anomaly analysis and to generate related alerts for the relevant customer.
To manage accounts and billing, verify identity, respond to inquiries, ensure security, and comply with legal obligations.
We use customer data only to provide the Service to that customer, including AI-assisted safety and anomaly detection and alerts. We do not use identifiable customer data to train our own AI models.
AI outputs are decision-support tools and are subject to human review by the customer.
Where the GDPR applies, we rely on the following legal bases: performance of a contract, our legitimate interests in operating and securing the Service, compliance with legal obligations, and consent where required.
We do not sell personal data. We share it with service providers (sub-processors) that help us run the Service under appropriate contractual safeguards. Our sub-processors include Google Cloud Platform (hosting), Cloudflare (content delivery and security), Firebase Cloud Messaging (push notifications), Twilio SendGrid (email delivery), and Stripe (payment processing and billing).
To bill your subscription, we share with Stripe the information it needs to issue invoices and send payment-related notices, such as your account email address, organization name, preferred language, and country. Stripe also processes certain data as an independent controller for purposes such as fraud prevention and regulatory compliance, as described in the Stripe Privacy Policy (stripe.com/privacy).
We may disclose data where required by law or to protect rights and safety.
We are based in the United States and process data on infrastructure located in the United States and other countries. Where we transfer personal data from the EEA, the UK, or Switzerland, we use appropriate safeguards such as the Standard Contractual Clauses.
We retain personal data for as long as necessary to provide the Service and for legitimate business or legal purposes, after which we delete or anonymize it. Customer Data is retained and deleted in accordance with the customer's instructions and the DPA. When an account is terminated or a member withdraws, we keep the related personal data and Customer Data in a recoverable state for up to 90 days—to guard against accidental loss and to allow restoration—after which it is permanently deleted, except for information we are legally required to retain and for residual copies that may persist in routine backups for a limited period.
We implement technical and organizational measures appropriate to the risk, including encryption in transit and at rest, access controls, and monitoring.
Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal data, to object, and to data portability. To exercise these rights, contact privacy@mintcandi.com. Where we process your data on behalf of a customer, we will refer your request to that customer.
Our website uses cookies and similar technologies for essential functionality and analytics. You can control cookies through your browser settings.
The Service is intended for business use and is not directed to children.
We may update this Policy from time to time and will post the updated version with a new effective date.
Controller: Mint Candi, Inc., 8 The Green #21257, Dover, DE 19901, USA. Privacy contact: privacy@mintcandi.com. Privacy Officer: Kevin Lee, +1 (302) 309-4369.
We collect the items described in this Policy to provide the Service, manage members, and meet legal obligations. We retain personal information until the member withdraws or for the period required by applicable law (for example: records on contracts or withdrawal of subscription — 5 years; records on payment and supply of goods — 5 years; records on consumer complaints or dispute resolution — 3 years). When a member withdraws, we keep personal information in a recoverable state for up to 90 days—to prevent accidental loss and allow restoration—before destroying it; records we are legally required to keep, as listed above, are retained for their statutory periods.
When the retention period expires or the purpose is achieved, we destroy personal information without delay. In the case of member withdrawal, destruction occurs after the recovery retention period of up to 90 days has elapsed. Electronic files are deleted irrecoverably, and printed materials are shredded or incinerated.
Privacy Officer: Kevin Lee (privacy@mintcandi.com, +1 (302) 309-4369). Korean residents may direct privacy inquiries and complaints to this contact.
Because we operate from the United States, your personal information is transferred to and stored in the United States. Recipient: Mint Candi, Inc. (privacy@mintcandi.com); country: United States; items: as described in this Policy; purpose: providing and operating the Service; retention: as described above. You may refuse this transfer, although doing so may limit your use of the Service.
We also entrust the processing of personal information to the following processors, which involves a transfer of your personal information outside Korea.
Google Cloud Platform — Recipient: Google LLC (cloud.google.com/terms/cloud-privacy-notice); country: United States; items: as described in this Policy; purpose: hosting and data storage; timing and method: transmitted over the network when you use the Service; retention: as described above.
Cloudflare — Recipient: Cloudflare, Inc. (dpo@cloudflare.com); country: United States and other countries where Cloudflare's network operates; items: information transmitted while you use the Service, such as IP addresses and uploaded images and files; purpose: content delivery, file storage, and security; timing and method: transmitted over the network when you use the Service; retention: as described above.
Firebase Cloud Messaging — Recipient: Google LLC (firebase.google.com/support/privacy); country: United States; items: push notification tokens and notification content; purpose: sending push notifications; timing and method: transmitted over the network when a notification is sent; retention: as described above.
Twilio SendGrid — Recipient: Twilio Inc. (privacy@twilio.com); country: United States; items: email addresses and email content; purpose: sending emails; timing and method: transmitted over the network when an email is sent; retention: until the purpose of sending is fulfilled.
Stripe — Recipient: Stripe (dpo@stripe.com); country: United States; items: payment and billing information; purpose: payment processing and billing; timing and method: transmitted over the network when you register a payment method or a payment is made; retention: as described above.
If and when required under the Personal Information Protection Act (PIPA), we will designate a domestic representative in Korea and disclose its name, address, and contact details here.
You may request access to, correction or deletion of, or suspension of processing of your personal information at any time through the contact above.
We use personal information for the purposes described in this Policy, including providing and operating the Service and related support.
We entrust the handling of personal data to the sub-processors described in this Policy and supervise them appropriately. We do not provide personal data to third parties except as permitted by the Act on the Protection of Personal Information (APPI) or with your consent.
Your personal information is stored and processed in the United States and other countries whose data protection regimes may differ from those of Japan. Information about the relevant systems is available on request.
You may request disclosure, correction, suspension of use, or deletion of your retained personal data through the contact below.
Privacy inquiries and complaints: privacy@mintcandi.com.