Privacy Policy.

§ 01

Introduction.

mindsight-galaxy CO., LTD. operates a financial-risk reasoning platform for institutional clients — sovereign wealth funds, family offices, quantitative hedge desks, and corporate treasury teams. This policy explains how we process data when institutions evaluate or use the platform. It applies to the project website and to all platform deployments under our control. This policy does not address personal consumer products. We do not offer any.

§ 02

What we collect.

Four categories of data only.

• Account data. Business name, work email, institutional role, jurisdiction, and procurement contact for those who request a briefing or open an account.
• Usage logs. Inference requests, query identifiers, throughput, latency, error codes, and authenticated session IDs. Held for audit reconstruction.
• Cookies and analytics. Session cookies (essential), language preference (functional), and de-identified page analytics. No third-party advertising cookies. No cross-site tracking.
• Communications. Emails, briefing notes, NDAs, and procurement records exchanged with our institutional relations desk.

§ 03

How we use it.

Four uses. No more.

• Service operation. Authentication, inference routing, billing reconciliation, and SLA monitoring.
• Compliance and audit. Regulatory recordkeeping, sanctions screening, and KYB reviews aligned with Taiwan FSC, FINRA, FCA, and SFC requirements.
• Security. Threat detection, abuse mitigation, incident response, and integrity verification of model outputs.
• Service improvement. Latency tuning, regression testing, and aggregated platform health reviews. Client portfolio data is never used to train models.

§ 04

Legal basis (GDPR).

For European-resident representatives of institutional clients, we rely on the following bases.

• Contract. To deliver the platform under a Master Services Agreement or signed Statement of Work.
• Legitimate interest. Security, fraud prevention, network integrity, and improving our own platform — balanced against client expectations.
• Consent. Where required by law, including for non-essential cookies and marketing communications. Withdrawable at any time.
• Legal obligation. Recordkeeping, tax, sanctions, and regulator-mandated audit trails.

§ 05

Data sharing.

We do not sell data. Not now. Not ever. We share narrowly with vetted processors who operate under written data-processing agreements aligned with GDPR Article 28 and PDPA-Taiwan.

• Cloud infrastructure providers — single-tenant deployments only.
• Observability and monitoring vendors — de-identified telemetry.
• Payment and accounting providers — invoicing only.
• External legal and audit counsel — under privilege.

A current list of sub-processors is available under NDA via our Trust Center.

§ 06

International transfers.

Our primary operations sit in Taipei. Transfers to processors outside the European Economic Area or Taiwan use Standard Contractual Clauses (2021/914/EU) and supplementary technical measures — encryption in transit and at rest, key separation, and access logging. We document every cross-border transfer under our Records of Processing Activities.

§ 07

Retention.

Institutional financial records are retained for seven years, aligned with Taiwan FSC and SEC recordkeeping requirements. Authentication logs are retained for thirteen months. Browser analytics are retained for ninety days. Once retention lapses, data is irreversibly deleted or de-identified under our standard data-destruction procedure.

§ 08

Your rights.

Where applicable law grants you these rights, you may exercise them at any time.

• Access — request a copy of your personal data we hold.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion where retention has lapsed and no legal obligation applies.
• Restriction — limit processing during a dispute or correction.
• Portability — receive your data in a structured, machine-readable format.
• Object — to processing based on legitimate interest.
• Complaint — to a supervisory authority. In Taiwan, this is the National Development Council. In the EU, your local Data Protection Authority.
• Withdraw consent — without affecting prior lawful processing.

Verified requests are answered within thirty days. No fee for the first request in a twelve-month period.

§ 09

Security.

Encryption at rest and in transit, network isolation for single-tenant deployments, role-based access, and quarterly third-party penetration testing. Full security posture is documented in our Trust Center.

§ 10

Cookies.

We use three cookie classes. Strictly necessary cookies — authentication and session integrity. Functional cookies — language preference and accessibility settings. Analytics cookies — de-identified, aggregated only, no advertising. We do not deploy third-party advertising or social-tracking pixels. You may disable non-essential cookies in your browser without losing service.

§ 11

Children's privacy.

mindsight-galaxy serves institutions only. Not individuals. Not minors. We do not knowingly collect data from anyone under eighteen. If we discover such collection, we delete the record and notify the relevant institutional contact.

§ 12

Changes.

We update this policy when our practice changes. Material changes — new categories of processing, new sub-processors, new cross-border transfers — are notified by email to the institutional contact on record at least thirty days before they take effect. Non-material edits are reflected in the "last updated" line at the top of this page.

§ 13

Contact the DPO.

For privacy questions, rights requests, or breach notifications, contact our Data Protection Officer at horizon.lin722@taiwan-culture.com. We acknowledge within two business days and respond substantively within thirty.

mindsight-galaxy CO., LTD. · Taipei, Taiwan · Tax ID 90206518