Privacy Policy

We respect your privacy. We also believe clarity builds trust — so we’ve written this policy in a way that’s meant to be readable, not intimidating.

This Policy explains how Framed Minds, LLC (“Framed Minds,” “we,” “us,” or “our”) handles information when you:

• Visit our website
• Create or manage an account
• Use courses, assessments, reflections, and community features
• Register for events (virtual or local)
• Interact with Echo
• Contact us for support or other questions

The short version, in plain words, is on one page: What happens to what you tell us. This Policy is the full version. If the two ever seem to differ, this Policy controls, and please tell us so we can fix the page.

Please read this Policy carefully. If you do not agree with it, please do not use our Services. This Policy is part of, and governed by, our Terms of Use.

1. Who we are and how to contact us

Framed Minds, LLC
11816 Inwood Rd #1555
Dallas, TX 75244
Email: [email protected]

If you have questions about this Policy or your personal data, email us. If you’re making a privacy request (like access or deletion), please include “Privacy Request” in the subject line so we can route it quickly.

2. Information we collect

We collect information in three main ways: (1) information you provide, (2) information collected automatically, and (3) information we receive from third parties that help us run the platform.

a. Information you provide directly

• Account information – name, email address, and other details you choose to provide. Your login password is processed and stored in hashed (encrypted, non-readable) form by our platform software; we do not store or have access to your password in readable form.
• Age details – your date of birth and your confirmation that you are at least 18 years of age, collected at sign-up or checkout. We do not knowingly create or maintain accounts for anyone under 18.
• Profile information – preferences, interests, and other details you add to your profile
• Community content – posts, comments, and messages you choose to share within the community. Content you share in community spaces may be visible to other members.
• The Pact – When a post first asks you to accept the Pact, we note the date and where it was asked (for example, the app), so we know the ask reached you; this is deleted with your account.
• Private reflections and journals – reflections you record through our Reflections features are private by default and are not visible to other members.
• Assessment responses and results – answers, reflections, and notes you enter during assessments, together with the scores and AI-generated summaries those assessments produce
• Echo conversations – the messages you send to Echo and the responses Echo returns
• Framed Origin Map – if you use it, your birth date, birth time and birth place
• Event registrations – registration details needed to manage attendance and event communication
• Purchases and billing – purchase confirmations and limited billing details (payment is processed by our payment processor, Stripe; we do not collect or store full credit card numbers)
• Support and communications – emails, forms, survey responses, and other messages you send us

b. Information collected automatically

When you use the Services, we (and our service providers) may automatically collect:

• Device and browser information (device type, operating system, browser type)
• IP address and approximate location (derived from IP)
• Log and usage data (pages viewed, time spent, navigation paths, errors)
• Feature activity (which features you use, clicks, and interactions needed to run the platform)
• Invitations and referrals (if you arrive through a member’s invite link, a cookie remembers that member for 30 days; if you join, they may be told your display name and that you joined or became a paying member, because they may earn rewards for it)
• Cookies, pixels, and similar technologies (to keep you logged in, remember preferences, support analytics, and, where permitted and subject to your choices, measure our advertising on public pages, sign-up and checkout. Never on a page that asks you about yourself). See Section 11.

c. Information from third parties

We may receive information from third parties such as:

• Payment processors (Stripe and PayPal: confirmation of payments and limited transaction details)
• Email and communication services (delivery and engagement metrics like opens/clicks when enabled)
• Analytics and advertising providers (aggregate performance and usage information, and measurement of our marketing campaigns — for example, Meta)
• AI technology providers that help us deliver Echo, assessments, and audio features (described in detail in Section 5 and listed in Section 10)
• Content delivery and security providers (such as Cloudflare) that help us deliver, protect, and optimize the platform

d. Information from features you choose to use

• Frame Mirror (people who answer about you) – When you send a Frame Mirror link, the person who opens it answers a short set of statements about you, chosen from your own results (about 14 on Explorer and 20 on Navigator) and may add one line and answer one question you chose. We never ask them for an email address or an account. For a “one person” link (for example a partner) we ask for their first name and tell them before they start that you will see their answers with their name; friends-and-family and work-team links are anonymous, take effect only once at least three people (four for a work team) have answered, and never show you who said what. A work-team link takes no written answers. We store the answers, the time, and a one-way scrambled code made from the answering network address, used only to stop abuse (at most 10 answers an hour per network); we cannot turn it back into an address. A small cookie on the answering device remembers that an answer was given, and if that person later joins we note that they came through a Mirror link (no reward is attached). Their written lines and answers are read once by our Kindness Watch (an AI model, through the AI providers listed in Section 10), only to hold back anything unkind before you see it, and the person answering is told this on the form. They are never used for Echo’s reading, which for Navigators uses only the combined answers. You can hide any written answer you receive, and reporting one sends it to our team. Links expire after 30 days. People who answer must be 18 or over, and can ask us to delete an answer at [email protected] (we will need the link they used).
• Inner Cartography – To draw your map, we send the first names you enter for the people closest to you, together with what you wrote about them, to our AI provider. Those people have no Framed Minds account. We send first names only, and Inner Cartography (unlike the Framed Origin Map) does not ask for your date, time or place of birth.
• Frame Tables – When you hold a seat we store your city, the evenings that suit you, the kind of table and conversation you prefer, an optional dietary note, and your two leading Frames, used to seat the table and to choose your own ice-breaker prompt for the evening (nobody else sees it). Our Table Host, an AI assistant that finds and books restaurants, sees only how many people at a table share each lead Frame and any dietary notes, never names. After an evening you can say who you would like to stay in touch with; we only connect two people when both said yes, and then each sees a link to the other’s community profile. Once your table is set, the other members at it see your first name and your lead Frame, and nothing else from your Self-Inventory, answers or reports. They never see your email, address or last name. If you report a concern about a table, we store your report and our review; only our team sees it, and the member you report is never told who reported them.
• When a paid plan ends – About an hour after a paid plan (such as Navigator) ends, we may send you one email asking why, at most once every 180 days. If you answer, your reason and anything you write go to our founder, and we keep them with your account.
• Frame Glimpse (before you have an account) – On our Frame Glimpse page you can guess which Frame leads for you and answer a few quick questions. Your guess and your answers stay in your own browser and are never sent to us; we only count anonymous steps (for example, that someone finished). If you ask us to email your glimpse, and agree to it, we keep your email address, the Frame your glimpse leaned toward, and a record of your yes (the wording you agreed to and when). We send you that one email, never add you to our newsletter unless you ask, and never use that Frame for advertising. After 12 months we delete the Frame and the record, and your email address too, unless you have an account, have signed up for our letter, or gave it to us another way. Your guess and your answers stay on your device. If you later create an account and say yes to the consent described in Section 5, your guess and the Frame your glimpse leaned toward are saved to your account.
• Frame name feedback – Since the Frames have new names, a short question may ask whether a name fits what it describes. You can answer “fits”, “not quite” or “not sure”, pick a suggested word, or type a better word of your own (up to 40 characters). We store your answer, the name and Frame it was about, which page you saw it on, whether you were signed out, on Explorer or on Navigator, and the day. We do not store your account, name, email or IP address, or the time of day, so we cannot link an answer back to you, and so we cannot find one answer to delete it later. To stop one person answering many times, your browser remembers that you answered, and we keep a scrambled code made from your network address, the day and the Frame for 24 hours; it cannot be turned back into an address. Typed words are filtered (no links, numbers or addresses) and deleted after 180 days. The rest stays as counts that help us review the names. The question never appears on checkout, the Pact, a Self-Inventory in progress, Stillness, Echo or crisis pages. Please don’t type anything about your health or about another person.
• Replies to public conversations – We sometimes reply to public conversations on other sites (for example a question on Stack Exchange or Reddit). When we use our drafting tool for a reply, the public text of that conversation may be processed by our AI providers (Section 10) to help draft it; other replies we write ourselves. We keep only the link and a short excerpt, never the author’s name. Conversations we pass on are deleted within 3 days, and any we don’t review within 14 days.
• Frames at Work for Teams – When you join a team, after you say yes, we share your display name and your lead and second Frame with that team, and add you to the team’s private conversation, a group only the people on the team can see. Echo writes the first post there from the team’s Frames (how many people each Frame leads for, never names or scores). Leaving the team takes you out of the conversation. Team plans are billed to the member who created the team.
• The Frame leading today – If you choose one after your Daily Compass check-in, we save that Frame with your check-ins.
• Payout and tax information – If you request a payout of Affiliate Credits or host earnings, we collect your payout details (such as your PayPal email, or the bank details you give our payment provider), the amount and date of each payout, and, once your payouts pass the yearly reporting threshold, the tax details we are required to collect (such as your legal name, address and tax identification number). We keep these records for 7 years for tax and financial recordkeeping.

3. Sensitive information you may share — and how we treat it

Framed Minds is a reflective platform. Assessments, Echo conversations, reflections, and community posts naturally invite you to describe your emotional patterns, reactions, protective behaviors, and relationships. Although Framed Minds is educational and non-clinical — we never diagnose you, and our results are not medical or psychological evaluations — the information you choose to share may nonetheless reveal, or allow inferences about, sensitive aspects of your life, such as:

• Mental or physical health, including a diagnosis you mention
• Trauma or past experiences
• Disability
• Sexuality, sexual life, or sexual orientation
• Religious or philosophical beliefs
• Racial or ethnic origin
• Substance use
• Family, marital, and relationship circumstances

We treat all Echo conversations, assessment responses and results, and private reflections as potentially sensitive information, regardless of what they contain. That means, at a minimum:

• We ask for your separate, affirmative consent before what you tell us about yourself through Echo, the Self-Inventories or the features built on them is first saved on our servers, as described in our Consumer Health Data Privacy Policy;
• We do not use this information for advertising or sell it to anyone;
• We limit access to it as described in Sections 7 and 9; and
• You can request deletion of it as described in Sections 15 and 16.

You are never required to share sensitive personal information to use Framed Minds. What you disclose — and how much — is always your choice.

4. How we use your information

We use your information for these core purposes:

Provide and maintain the Services

• Create and manage your account
• Deliver courses, assessments, reflections, and community features
• Support events (registration, attendee updates, organizer tools)
• Enable Echo and other interactive experiences
• Process payments, memberships, and refunds in accordance with our Refund & Returns Policy

Personalize your experience

• Tailor content and prompts
• Show progress, saved items, and relevant resources
• Support features that help you pick up where you left off

Operate, protect, and improve the platform

• Monitor performance, debug issues, and prevent abuse
• Understand how features are used so we can improve them, using aggregate usage data wherever possible
• Enforce our Terms of Use and the community commitments in the Framed Minds Pact
• Verify that users meet our minimum age requirement

Market and grow the platform

• Measure the performance of our advertising and understand which campaigns bring people to Framed Minds
• Reach people who may be interested in Framed Minds, using advertising and measurement tools (such as Meta) on our public pages, sign-up and checkout only, in line with the choices and opt-out controls in Sections 11 and 17. These tools never run on a page that asks you about yourself. Echo conversations, assessment responses and results, and private reflections are never used for these purposes.

Communicate with you

• Send transactional messages (account updates, event confirmations, receipts, membership renewal notices)
• Respond to support questions and requests
• Send optional updates or promotional messages (you can opt out any time)

Comply with legal obligations

• Protect the rights, safety, and integrity of our platform and users
• Respond to lawful requests when required (see Section 8)

5. Echo and AI processing — how it actually works

Echo is designed to support your experience inside Framed Minds. Echo is available only to registered adult users (18+). We do not permit minors to interact with Echo under any circumstances. Before what you tell us about yourself through Echo, the Self-Inventories or the features built on them is first saved on our servers (for example, your Self-Inventory answers, a message to Echo, Inner Cartography, a Frame Mirror request, your Framed Origin Map details, the Frame you pick as leading today, or a moment from Echo you save as a reflection), we ask for your separate, affirmative consent. It is one clear question, asked at that moment, separate from our Terms and from any choice about marketing email. Until you say yes, what you have entered there is not saved by us. If you said yes before October 26, 2026, under consent text 1.0 or 1.1, that consent stays valid and we will not ask again. That consent covers the processing described in this Section and in our Consumer Health Data Privacy Policy.

The processing chain

When you send Echo a message, here is what happens:

• Your message is sent from your device to Framed Minds’ servers.
• Framed Minds sends your message — together with limited context needed to respond — through OpenRouter (an AI routing service) to an Anthropic large language model (the Claude model family), which generates Echo’s reply. Anthropic’s Claude models may be served by Anthropic directly or, when Anthropic is busy, through Amazon Web Services (Amazon Bedrock) or Google Cloud (Vertex AI), which run the same Claude models for us under their business terms and may not use your content to train their models. If Claude is briefly unavailable, OpenRouter sends the same request to a backup model from OpenAI, which likewise may not use it to train its general models.
• Echo’s reply is returned to Framed Minds and displayed to you.
• The same chain is used when our features write from what you enter elsewhere: your assessment results, Inner Cartography, the daily check-in, Frame Mirror and team readings (combined answers only), Echo’s first post in a team conversation (Frame counts only), and the Kindness Watch review of public posts, team conversations and written Frame Mirror answers (Section 7), and, when we use our drafting tool, the public text of a conversation on another site that we reply to.

What is included in the request

• Your current message;
• Your recent Echo conversation history (so Echo can follow the conversation);
• Your first name and limited profile details, so Echo can respond personally;
• Your assessment results (such as Frame activation scores and your Frame Stack), where relevant to your question; and
• Platform context such as courses, events, or groups, when you ask about them.

Because Echo is personalized, requests are not anonymized before they are sent — your first name and your own results may be included so Echo can speak to you directly. Requests do not include your email address, payment details, or password.

Where your Echo data lives

• Framed Minds stores your Echo conversations and assessment results on our own systems, separately from our AI providers, so we can show you your history and provide your results. Retention is described in Section 12.
• Our AI providers process requests on our behalf under their business/API terms. Under those terms, they do not use our API content to train their general-purpose models, and they retain API content only for limited periods for abuse and safety monitoring. We do not permit our AI providers to use your content to train general models.

Voice features

• Voice input: if you use voice input with Echo, your speech is converted to text by your own browser or device’s built-in speech-recognition service (for example, Google or Apple, depending on your device). Framed Minds receives only the resulting text — we do not receive, record, or store your voice audio. Your device vendor’s privacy policy governs that conversion.
• Voice output: Echo’s spoken replies and narrated lessons are generated by sending the text of the reply or lesson to OpenAI’s text-to-speech service, which returns an audio file. Guided Stillness meditations are generated the same way using OpenAI and/or ElevenLabs voices. These providers receive the text to be spoken — they never receive your voice, and we do not use your voice for any voice-development purpose.

Summary video, Framed Origin Map, and Bridges

• Reflection in Motion (summary video): when you ask for your summary video, Echo writes a short narration from your results, OpenAI voices it, and JSON2Video renders the video from that narration, its on-screen words, and your first name. The finished video is stored on our servers.
• Framed Origin Map: the birth place you type is looked up with Google Maps Platform (in your browser as you type, and on our servers to find its location and its time zone on your birth date). Google does not receive your name; the map itself is computed on our servers.
• Bridges: a Bridge is made only after the friend you invite agrees to it. Echo’s reading of your Frames together is then shown to both of you.

Echo is clearly identified as AI

Echo is an artificial intelligence system, not a human. Echo is identified as AI throughout the interface, consistent with the transparency requirements of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689, Art. 50) for members in the European Union. Content generated by Echo — including assessment summaries, insights, and generated meditation audio — is AI-generated and is labeled or presented as such.

While you talk with Echo, a line saying “You’re talking with Echo, an AI” stays on the screen. A notice says it again when a session starts, and again at least every three hours while you keep talking. Echo is not a person, a therapist or a crisis service. If something you write suggests you may be at risk of harming yourself, Echo stops the reflection and gives you crisis contacts: the 988 Suicide & Crisis Lifeline in the U.S. (call or text 988), findahelpline.com for other countries, and your local emergency number. This is a fixed reply, not one the AI writes, and our full Echo crisis protocol is published at framedminds.com/echo-crisis-protocol. We keep a count of how often the crisis reply is shown, without the words you wrote, so we can check that the protocol works and report on it where the law requires.

Your controls

• Echo is optional. You can decline or withdraw consent for Echo and assessments and still use the rest of the platform (courses, community, Stillness, and events remain available; Echo chat, assessments, and features built on assessment results, including Inner Cartography, Frame Mirror, Frame Tables and Frames at Work teams, will be unavailable).
• You can request deletion of your Echo conversation history and assessment history — without deleting your entire account — as described in Section 15.

6. How we use assessment data

Assessment responses and results are used to:

• Generate your results, summaries, and platform experiences related to your participation (your responses are processed by our AI providers, as described in Section 5, to produce your results)
• Support your ability to track patterns over time within Framed Minds
• Personalize Echo’s responses and features such as Daily Compass and Frame Insights

We may use aggregated and/or de-identified assessment data (data that does not identify you personally) to analyze trends and improve platform features and experiences.

We do not sell your personal assessment data, and we do not use your individual assessment responses or results for advertising.

Who can see your results

Your individual assessment results are not displayed to other members except as you direct — for example, if you choose to share a report through a share link, or participate in a Bridges report with another member (in which case limited assessment information is shared with that participant as part of the feature).

Like any online service, however, a limited set of authorized people and systems can technically access your results in order to operate the platform: Framed Minds administrators and support personnel (for support, safety, and quality purposes — see Section 7), our hosting and security providers, our AI providers when generating your results, and system logs and backups. We do not share your individual results with employers, insurers, or other third parties without your explicit consent, except where we are required to do so by law or valid legal process (see Section 8).

7. Monitoring and human review — please read this

We want to be direct about this rather than bury it: your Echo conversations and assessment results are accessible to authorized Framed Minds personnel, and may be reviewed by a human.

• Automated monitoring: our systems and our AI providers’ systems automatically screen Echo interactions for abuse prevention, safety, and reliability. Our Kindness Watch uses an AI model, through the AI providers listed in Section 10, to read each new public post, comment and forum reply, and each post and comment in a Frames at Work team conversation, within minutes. It tells our team about posts that may be hurtful, and about posts suggesting the writer may be at risk, so a person can follow up. It never hides a post on its own. It also reads each written Frame Mirror answer before the person it describes sees it, and holds back one that reads as unkind. If your post suggests you may be at risk, we automatically send you a private note with crisis resources (at most once a day), and a person on our team may follow up. This is not a monitoring service: it reads only the posts and answers described here, it can miss things, and no one watches around the clock. Echo’s own crisis steps are in our published Echo crisis protocol. Private messages, reflections and Echo conversations are not part of this.
• Human review: authorized Framed Minds administrators and support personnel can view Echo conversation history and assessment results — for example, to troubleshoot a problem you report, investigate suspected abuse or a Terms violation, respond to a safety concern, or maintain quality. Access is limited to personnel who need it for these purposes.
• AI-assisted review of how members use the platform: an AI assistant (Anthropic’s Claude) reviews each member’s recent path through the platform (pages and features used, timings, membership status and first name; never your answers, Echo conversations, messages, email address or IP address) to suggest improvements to our team. Nothing changes for you automatically.

We do not monitor your private reflections or private journals in the ordinary course, and we do not review Echo conversations for curiosity or marketing. But you should use Framed Minds knowing that what you write is not invisible to us.

8. Legal process and discoverability — please read this too

If we receive a subpoena, court order, or other legally binding request for your information, we may be required to produce it. Where legally permitted and practical, we will attempt to notify you before producing your information so you have an opportunity to object, but we cannot guarantee notice in every case.

Please keep this in mind when deciding what to share. Framed Minds is a space for honest reflection — but it is a documented one.

9. How we share information

We do not sell your personal information.

We may share information in the following situations:

Service providers

We use vendors to help operate the platform — hosting, email delivery, analytics, payment processing, content delivery and security, and the AI providers that power Echo, assessments, and audio features. These providers are permitted to use your information only to provide services to us. We maintain data processing agreements with providers that handle personal data on our behalf, and Section 10 lists the material providers we currently use.

Advertising and measurement partners

We use advertising and measurement technologies (such as the Meta pixel) to understand how our marketing performs and to reach people who may be interested in Framed Minds. Depending on your settings, this may involve sharing limited information (such as a hashed identifier, device data, or the fact that you took an action like signing up) with these partners. You can opt out as described in Sections 11 and 17. We do not share your Echo conversations, assessment responses or results, or private reflections with advertising partners, and we do not fire advertising events from any page that asks you about yourself: the Frame Glimpse, the Self-Inventories, Frame Mirror answer pages, Bridges, the Daily Compass, Echo, and your reflections and courses, and, once you are signed in, from any page except checkout. Purchases of Stillness sessions, Frame Table seats and Bridge Reports are never reported to advertising partners.

Event organizers (when you register for an event)

Framed Minds events may be operated by Framed Minds directly, hosted by independent Circle Holders (members approved to host circles and events), or jointly presented. When you register, your registration details (your name and the information you provide during registration) are shared with the host so they can manage attendance and communicate updates. Event listings will identify the host and indicate whether an event is recorded and whether it is open to other members. Event registration never gives a host access to your assessment results or Echo conversations.

Other members (community features)

If you post in community spaces, your display name and content will be visible to other members. A Bridge is made only after the friend you invite agrees to it; once you both have, Echo’s reading of your Frames together, drawn from both of your assessment results, is shown to each of you. If you create a share link for a report, anyone with the link can view the shared report until the link is revoked or expires. You control what you share in these contexts.

Professional advisors

Lawyers, accountants, auditors, or insurers when reasonably necessary for our business operations.

Legal and safety reasons

• To comply with a law, regulation, legal process, or government request (see Section 8)
• To protect the rights, property, or safety of Framed Minds, our users, or the public

Business transfers

If we undergo a merger, acquisition, restructuring, or asset sale, information may transfer as part of that transaction. We will notify you (via email or prominent notice on our website) before your personal information becomes subject to a different privacy policy.

Teams and Frame Tables

A team sees each member’s display name and lead and second Frame, and nothing else from their Self-Inventory, reports or Echo; leaving a team removes you from its map at once, and the person who created the team sees no more than anyone else on it. At a Frame Table, once the table is set, the other members see your first name and your lead Frame, and nothing else from your Self-Inventory, answers or reports. After the evening, if you and another member both said you’d like to stay in touch, each of you sees a link to the other’s community profile. We tell a restaurant only the number of seats and, if given, dietary notes without names.

10. Our service providers (subprocessor list)

In the interest of transparency — and because of the sensitive nature of what you may share here — this is the current list of material third-party providers that may process personal information on our behalf, and what they do. We will update this list as our providers change.

For questions about any provider, or to request the current version of this list, contact [email protected].

11. Cookies, pixels, and similar technologies

We use cookies and similar technologies for several purposes:

• Strictly necessary – keep you logged in and help the platform function properly
• Preferences – remember settings and choices
• Analytics – understand how the Services are used and improve performance
• Advertising and measurement – measure how our marketing performs and, where permitted, support advertising. This includes the Meta pixel, which can record actions such as viewing a page, starting a sign-up, or completing registration so we can measure and improve our campaigns. The Meta pixel runs only on our public pages, sign-up and checkout. It never runs on a page that asks you about yourself, or on the checkout for a Stillness session, Frame Table seat or Bridge Report. Once you are signed in, it runs only on checkout, because Echo is on every other page. The same rule keeps Google Analytics off every page that asks you about yourself and, once you are signed in, off every page except checkout.

Our content delivery and security provider (Cloudflare) may also set cookies as part of its services to protect the platform from malicious traffic.

Some features set their own cookies: a referral cookie that remembers which member invited you (30 days); fm_mirror_dev, which remembers on your own device that you made a Frame Mirror link (1 year); a cookie on the device of someone answering a Frame Mirror link (Section 2d); fm_team_return, which brings you back to a team invitation after you sign in (2 hours); and fm_attr_first and fm_attr_last, which remember for 30 days how you first and last reached us (the campaign tags in the link, or the site you came from) and the page you landed on. If you create an account or buy something, we copy them onto the account or order so we can tell which campaigns bring people in. On blog posts we show our own promotions (house ads) to visitors who are signed out and to Explorers; they use no third-party ad network and do not track you across sites.

Your controls

On your first visit, a small banner asks about non-essential cookies. In Europe (judged from your device’s time zone), analytics and advertising stay off unless you choose “Accept all” or switch them on under “Choose”. Elsewhere, they are on unless you turn them off: the banner offers “Choose” and a “Do not sell or share my personal information” link, which switches advertising off. If your browser sends a Global Privacy Control (GPC) signal, we treat it as that opt-out and advertising stays off. You can change your choice any time from the “Cookie Preferences” link in the footer of every page, or through your browser settings. Your choice is kept in a first-party cookie (fm_cc) for 12 months, and we keep a record of it as described in Section 12. If you remove or reject cookies, some features may not work as intended.

Server-side measurement

In addition to the pixel in your browser, we may send Meta a record of key actions (signing up, starting a trial, a purchase) from our own servers so Meta can measure our ads. We never send it from a page that asks you about yourself, and it never includes anything you answered or wrote. It includes the name of what you signed up for and its value, hashed (scrambled) versions of your email address, name and member number, your IP address and browser details, and Meta’s own cookie IDs. We send it only when your browser carries the Meta advertising cookie, meaning you have allowed advertising cookies, and never when your browser sends a Global Privacy Control signal. In Europe, advertising cookies stay off unless you turn them on (see “Your controls” above). Purchases of Stillness sessions, Frame Table seats and Bridge Reports are never sent. You can opt out through our cookie preferences or your ad settings with Meta.

Counting how people join (our own servers)

To see whether people find their way in, we count, for each day, how many people reach each step: opening the Frame Glimpse, answering its first question, finishing it, saving it or having it emailed, creating an account, finishing the Introductory Self-Inventory, starting Navigator, and the first payment. Each count is split by the kind of page someone first came in on and a broad source (for example paid social, search, a referral or an invitation), read from the cookies above. We keep totals only: no account, no IP address, and nothing finer than the day. Nothing is sent to an advertising platform.

12. Data retention

We keep personal information only as long as necessary to provide the Services, maintain platform integrity and security, comply with legal obligations, and resolve disputes. Our current retention practices, by data type:

We may keep de-identified or aggregated information (which no longer identifies you) for analytics and improvement. If you close your account, we deactivate and delete personal data on the schedule above, subject to legal obligations, evidence-preservation duties, fraud prevention, and backup cycles.

13. Security

We use technical and organizational safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, or unauthorized access. These include encrypted connections (TLS/SSL), web application firewall protections, access controls limiting who can view sensitive data, and periodic security reviews. We maintain internal procedures for responding to suspected security incidents and will notify you and regulators of a breach where required by law.

No system is perfectly secure, and we cannot guarantee absolute security. You are responsible for keeping your password and account information safe. If you believe your account has been compromised, contact us immediately at [email protected].

14. International users — EEA, United Kingdom, and Switzerland

Framed Minds is available to individuals in the United States, the European Economic Area (EEA), the United Kingdom, and Switzerland. If you are located in the EEA, the UK, or Switzerland, the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018 (as amended, including by the Data (Use and Access) Act 2025), or the Swiss Federal Act on Data Protection apply to our processing of your personal data, and this section applies to you in addition to the rest of this Policy.

Controller

Framed Minds is the controller of your personal data. Our contact details are in Section 20.

Legal bases for processing

We process personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — creating and managing your account, delivering courses, community features, events, memberships, and billing.
• Consent (Art. 6(1)(a)) — Echo conversations, assessments, marketing emails, non-essential cookies and pixels, and push notifications. You can withdraw consent at any time without affecting prior processing.
• Explicit consent (Art. 9(2)(a)) — for special category data. The content of your Echo conversations, assessments, and the Reflections you save from Echo may reveal information about your health (including mental health), sex life or sexual orientation, religious or philosophical beliefs, or other special categories. We process this content only with the separate, explicit consent you give before it is first saved on our servers (see our Consumer Health Data Privacy Policy, which also serves as our special-category-data notice for EEA/UK users).
• Legitimate interests (Art. 6(1)(f)) — platform security, fraud prevention, aggregate analytics, community safety monitoring of public content, and service improvement using de-identified data. You may object at any time (see rights below).
• Legal obligation (Art. 6(1)(c)) — tax, accounting, and responses to valid legal process.

Your rights (EEA/UK/Switzerland)

In addition to everything in Section 16, you have the right to: access your personal data; rectify inaccurate data; erasure (“right to be forgotten”); restrict processing; data portability (receive your data in a structured, commonly used, machine-readable format); object to processing based on legitimate interests; object to direct marketing at any time; withdraw consent at any time; and not be subject to solely automated decisions producing legal or similarly significant effects — Echo does not make any such decisions about you. To exercise any of these, use the process in Section 16. You also have the right to lodge a complaint with your national data protection supervisory authority (in the UK, the Information Commissioner’s Office — ico.org.uk). We would appreciate the chance to address your concern first, but you may contact your authority at any time.

International data transfers

Framed Minds is operated from the United States, and your personal data is stored and processed in the United States. For transfers of EEA, UK, and Swiss personal data, we rely on: (a) the EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. DPF, for providers that are certified under those frameworks; (b) the European Commission’s Standard Contractual Clauses (and the UK Addendum / International Data Transfer Agreement) with providers where applicable; and (c) your explicit consent to the transfer where you have been informed of the possible risks (Art. 49(1)(a)) — which is included in the Echo/assessment consent for that content. You may request a copy of the relevant safeguards via Section 20.

15. Your choices

• Marketing emails – We send our newsletter and offers only if you opt in: an unticked box when you sign up, or the toggle in your privacy settings. Unsubscribe any time using the “unsubscribe” link or by emailing [email protected]. We’ll still send essential transactional emails (account confirmations, renewal notices, security alerts).
• Emails from ads and forms – If you give us your email address through a Framed Minds ad on any platform, a lead form, or another sign-up form, we may send you emails about Framed Minds, such as updates, offers, and invitations. You can unsubscribe at any time using the link in any email.
• Cookies & advertising – Manage non-essential cookies and pixels through our cookie preferences banner or your browser settings, as described in Section 11.
• Echo & assessment consent – You can withdraw your consent to Echo and assessment processing at any time through your account settings or by emailing us; Echo and assessment features will become unavailable, and the rest of the platform will keep working. See our Consumer Health Data Privacy Policy.
• Delete Echo history – Delete your Echo conversation history, without deleting your account, from Privacy Settings or by emailing us with “Privacy Request” in the subject line. In Privacy Settings you can also choose to have conversations older than 30 days, 90 days or 1 year deleted automatically.
• Delete assessment history – Request deletion of your assessment history the same way. Note that deleting assessment history removes the results that power personalized features, and any Bridges report you previously shared with another member will no longer display your details.
• Account details – Update certain profile details inside your account.
• See, download or delete your data – If you are signed in, you can see what we hold about you, download a copy, or delete your account at any time on your Privacy Settings page, on the web or in the app. Deleting takes a confirmation and nothing more: you don’t need to write to us, and every paid plan is canceled at the same moment. You can also email [email protected] with “Privacy Request” in the subject line (Section 12 describes what is deleted and on what schedule; Section 16 describes the process and timeline).

16. Your privacy rights, our process, and appeals

Depending on your state of residence, you may have rights that include:

• The right to access and receive a copy of your personal data
• The right to correct inaccurate or incomplete information
• The right to request deletion of personal data
• The right to opt out of targeted advertising
• The right to withdraw consent where processing is based on consent (including consent relating to Echo and assessments)

How to submit a request

Email [email protected] with “Privacy Request” in the subject line, or use the privacy request options in your account settings. To protect your information, we verify requests before acting on them — typically by confirming control of the email address on the account, and, where the request involves sensitive data, through an additional verification step. You may designate an authorized agent to submit a request on your behalf; we will require proof of the agent’s authorization and may still verify your identity directly.

Timeline

We will respond within 45 days of receiving a verifiable request. If we need more time, we may extend once by an additional 45 days and will tell you why.

Appeals

If we decline all or part of your request, we will explain why, and you may appeal by replying to our decision (or emailing us with “Privacy Appeal” in the subject line) within 60 days. A different reviewer will consider your appeal and respond within 60 days. If your appeal is denied, we will provide a way to contact your state Attorney General to submit a complaint (for Texas residents, the Texas Attorney General at texasattorneygeneral.gov).

17. U.S. state privacy rights

If you are a resident of Texas, California, Colorado, Connecticut, Virginia, Utah, Washington, Nevada, or another U.S. state with an applicable consumer privacy or consumer health data law, you may have additional rights regarding your personal information.

Selling, sharing, and targeted advertising

• We do not sell your personal information for money (as defined under applicable state privacy laws, including the California Consumer Privacy Act).
• We use advertising and measurement technologies (such as the Meta pixel) that, depending on configuration, may be considered “sharing” for cross-context behavioral advertising or “targeted advertising” under some state laws. You have the right to opt out, and you can do so through our cookie preferences banner, your browser settings, a recognized opt-out preference signal such as the Global Privacy Control (GPC), or by emailing us.
• We do not use sensitive personal information (including Echo conversations, assessment responses and results, and private reflections) for targeted advertising or for purposes beyond what is necessary to provide the Services and as described in our Consumer Health Data Privacy Policy.

Consumer health data

Some states (including Washington and Nevada) regulate “consumer health data.” Our Consumer Health Data Privacy Policy describes the categories of such data we may collect, our purposes, the categories of third parties and affiliates with whom it may be shared, and how to exercise your rights regarding it — including withdrawing consent.

Your state-specific rights may include

• The right to know what personal information we collect, use, disclose, and share
• The right to delete personal information we have collected from you
• The right to opt out of the sale or sharing of personal information, and of targeted advertising
• The right to correct inaccurate personal information
• The right to limit the use of sensitive personal information
• The right to appeal our decision on your request (see Section 16)
• The right to not be discriminated against for exercising your privacy rights

To exercise any of these rights, follow the process in Section 16.

18. Age requirement and children’s privacy

Framed Minds is an adult platform. Our Services — including the website, courses, assessments, community features, Bridges reports, events, and Echo — are designed exclusively for adult learners engaged in their own personal and professional development. You must be at least 18 years old to register for, access, or use any part of the Services.

No exceptions

Framed Minds does not offer any product, feature, or experience for individuals under 18. This applies regardless of supervision, consent, or involvement by a parent, guardian, or other adult. Specifically:

• Parents, guardians, and other adults may not create or maintain an account on behalf of a person under 18.
• Parents, guardians, and other adults may not use their own account to run assessments, generate reports, or interact with Echo on behalf of, or in relation to, a specific person under 18.
• Allowing a person under 18 to use your account, directly or indirectly, is a violation of our Terms of Use and may result in immediate termination of your account.

Age attestation

During registration, you are required to attest that you are at least 18 years old. Providing false information about your age is a violation of our Terms of Use. We reserve the right to request additional information to verify age, and to suspend or terminate any account where we have reason to believe the user is under 18.

No knowing collection of data from minors

We do not knowingly collect personal information from anyone under 18. This includes information entered during registration, profile setup, assessments, community participation, events, or Echo conversations. If we learn that we have collected personal information from someone under 18 — whether directly or through an adult’s account — we will delete that information and terminate the associated account as promptly as reasonably practicable, subject to legal hold, evidence-preservation, fraud prevention, and backup-cycle requirements.

Reporting a suspected underage account (takedown requests only)

If you are a parent, guardian, or any other person who believes that someone under 18 has created or accessed a Framed Minds account, email [email protected] with “Minor Account Report” in the subject line.

This channel exists solely to request the removal of an underage account and the deletion of associated data. It is not, and may not be used as, a pathway to:

• Enroll, register, or create an account for a person under 18;
• Request access to Framed Minds on behalf of a person under 18;
• Run assessments, generate reports, or interact with Echo for or about a person under 18; or
• Authorize any other use of the Services by a person under 18.

On receiving a Minor Account Report, we will acknowledge receipt, investigate, and take appropriate action, which may include suspending the account and deleting associated personal information. To protect the privacy of all account holders, we may not be able to confirm to the reporter whether a particular account exists, who owns it, or what specific action was taken.

19. Changes to this Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, or legal requirements.

When we do, we will update the “Last updated” date at the top of this page and, where appropriate, provide additional notice (such as via email or in-app notification). For material changes affecting how we handle Echo conversations, assessment data, or other sensitive information, we will seek renewed consent where required. When we moved the consent question to the moment you first save something about yourself (consent text 1.2, October 26, 2026), consents given under texts 1.0 and 1.1 stayed valid. We encourage you to review this Policy periodically.

20. Contact us

If you have questions or concerns about this Policy or how we handle your data, contact us at:

Email: [email protected]
Mailing address: 11816 Inwood Rd #1555, Dallas, TX 75244