Who we are
Mind the Front (mindthefront.com) lets small businesses put a request widget on their own website: a visitor answers a few questions, and the business receives the request. In this policy "we" means Mind the Front.
Questions about this policy or your data: support@mindthefront.com.
Two kinds of people, two roles
Business owners sign up in our console at console.mindthefront.com. For their account data we decide why and how it is processed.
Visitors fill in the widget on a business's website. The business decides what the widget asks and what happens to the request; we store and deliver the request on the business's behalf. If you left a request through a widget, the business you sent it to is the one to ask about it — we can help you reach them at the address above.
What we collect from business owners
- Account: your email address and your password, stored only as a bcrypt hash; or, if you sign in with Google, your email address and Google account ID (see Google user data).
- Business: the business name and the widget configurations you create — the questions, texts and opening hours your visitors see.
- Descriptions for generation: when you ask us to generate a widget, the description you write.
- Notifications: the Telegram chat ID you connect, if you do.
- Calendar connection, if you connect Google Calendar — see Google user data.
- Plan and usage: your plan, prepaid requests, and counts of requests and generations used to apply plan limits.
- Session cookie: one strictly necessary cookie keeps you signed in for up to 7 days. We use no advertising or analytics cookies.
What the widget collects from visitors
- The request: the answers the visitor gives — for example a name, phone number, email address or chosen time. Which fields there are is set by the business.
- A random visitor token stored in the browser's local storage, so the widget can show the status of the visitor's request when they come back. It does not identify the visitor and is not shared.
Neither our website nor the widget loads analytics, advertising or third-party tracking scripts.
Google user data
We use Google data only for the two features below and only after the business owner chooses to use them. Visitors are never asked to sign in with Google.
Sign in with Google
We request the openid and email scopes and receive your email
address and Google account ID. We use them only to sign you in to the console and, when
Google confirms the email address, to link Google sign-in to an existing account with the
same email. We do not request your name, photo or contacts.
Google Calendar
If you connect your calendar in the console, the widget can offer your free times and put new requests into your calendar. We request three scopes:
| Scope | What we do with it | What we keep |
|---|---|---|
calendar.calendarlist.readonly |
List your calendars so you choose which one the widget uses. | The chosen calendar's ID, name and time zone. |
calendar.freebusy |
Read when the chosen calendar is busy, to offer visitors only free times. | Nothing: busy times are held in memory for up to a minute and never written to our database. We do not read the contents of your events. |
calendar.events |
Create a tentative event for each request with a chosen time — its description holds the request details — and update or remove that event when you confirm or decline the request. | The IDs of the events we created. We do not read, change or delete any other event. |
To keep the connection working we store a refresh token, encrypted with AES-256, and a short-lived access token.
How Google data is protected and shared
- Google user data is used only to provide the features above. It is not sold, not used for advertising, not used to train AI models, and not shared with anyone except as needed to provide those features or required by law.
- It is not sent to our AI provider: widget generation uses only the description you write.
- Mind the Front's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Removing our access
"Disconnect" in the console's calendar panel revokes our access at Google and deletes the stored tokens and calendar details at once. Deleting your account does the same. You can also remove our access at any time on your Google Account permissions page.
Why we use the data
- To run the service: show your widget, take and deliver requests, keep your calendar in sync, and send the notifications you turn on.
- To generate widget configurations from your description.
- To send the emails the service needs: confirming your email address and resetting your password. We do not send marketing email.
- To keep the service safe and apply plan limits. Rate limits use the IP address of a request and are kept only in memory. Our web server keeps short technical logs with the IP address and the requested address; they are overwritten automatically once they reach a small fixed size, usually within days.
We do not sell personal data.
Who processes data for us
| Provider | What for | What it receives |
|---|---|---|
| Clodo Cloud Service | Servers that run the service and hold the database | All data described in this policy |
| Cloudflare | Domain name service and forwarding of email sent to our support address | Email you send to us |
| Resend | Delivering our emails | The recipient's email address and the email's content |
| Anthropic | Generating widget configurations | Only the description the business owner writes |
| Telegram | Notifications, if the business owner connects them | Request details sent to the owner's chat |
| Sign-in and calendar, if the business owner uses them | What is described in Google user data |
How long we keep data
- Account and business data: until the account is deleted.
- Requests: on the free plan, the details of the latest requests are kept (currently the latest 10); for older ones we erase the details and keep only the time and status. On other plans requests are kept until the account is deleted.
- Email links: a sign-up confirmation link works for 24 hours, a password reset link for 30 minutes; we store only a hash of each link.
- Sessions: up to 7 days, or until you sign out.
Deleting your data and your rights
Business owners can delete their account in the console at any time. Deletion happens immediately and removes the account, the business, its widget configurations, requests and calendar connection, and revokes our access to Google Calendar. You can also ask us at support@mindthefront.com.
Visitors should contact the business they sent a request to; we will help if you write to us.
You can ask us to access, correct, export or delete your personal data, or object to how we process it. We answer within 30 days.
Security
Everything travels over HTTPS. Passwords are stored as bcrypt hashes, calendar refresh tokens are encrypted, and links we email are stored only as hashes.
Children
The service is meant for businesses and is not directed at children under 16.
Changes
When this policy changes we update the date at the top. If a change affects how we use data you have already given us, we tell business owners by email before it applies.
Contact: support@mindthefront.com