Privacy Policy

1. Introduction

Codon (the “Platform”, at getcodon.ai and its associated application) is owned and operated by MindSci.ai Private Limited (“Company”, “we”, “our”, or “us”). Codon is an AI-powered consumer research platform: it simulates how people respond to your product, pricing, messaging, and ad creative using AI Twins — individual-level behavioral profiles grounded in established social-science survey research — before you launch.

This Privacy Policy explains what data we collect, how we use it, who we share it with, and the choices you have — whether you're browsing our site, signing in, running a simulation, or connecting a third-party platform such as Shopify, Zoho, HubSpot, Meta Ads, or Google Ads.

2. Our Legal Role

• Account & billing data: we act as the Data Controller.
• Business data you sync from a connected platform (e.g. Shopify, Zoho CRM, HubSpot, Meta Ads, Google Ads): you remain the Data Controller for that data, and we act as a Data Processor, handling it strictly to provide the simulation and analytics you've configured.
• The AI Twin research panel: our underlying panel of AI Twins is built from licensed and publicly available academic survey research, combined with our own enrichment — this is our own dataset, independent of any single client's account, and we act as Controller for how it is maintained and used across the Platform.

3. Information We Collect

A. Account & Identity Information

When you register or sign in (including via Google OAuth), we collect your name, email address, workspace/business name, and profile picture if provided. We request only the minimum scopes necessary for authentication.

B. Brand & Simulation Inputs

To run a simulation, you provide brand brief details (positioning, category, price points), research questions, and optionally creative assets such as ad images or concept mockups you upload for testing. This content is used to construct the simulation and, where a study calls for it, is sent to an AI model provider (see Section 4) to generate the AI Twins' responses.

C. Integration Data

If you connect a third-party platform, we access data through that platform's official API, using OAuth authentication and requesting only the scopes needed for the features below.

• Shopify: product catalog, inventory, and store data. If you use the Customer Insights / audience-sync feature, we also access customer and order records (name, location, order history) via Shopify's read_customers and read_orders scopes — these records are used to build AI Twin profiles that represent your actual customer base for simulation and segmentation purposes. This is a real customer-data feature, not a product-catalog-only integration — enable it only if you intend to research your own customer base this way.
• Magento / WooCommerce: product and order-level data, accessed the same way, for the same catalog and customer-research purposes as Shopify above.
• Zoho CRM: read-only access to contacts, leads, and deals, used to build audience segments and AI Twin profiles from your CRM data.
• HubSpot: read-only access to contacts, deals, and companies, used for the same audience-segment purposes.
• Meta Ads / Google Ads: ad account identifiers and campaign performance metrics (spend, impressions, clicks, conversions, ROAS), plus creative assets, accessed to provide performance context and — where you use the Output Feeds feature — to publish AI-generated creative you've approved back to your connected ad account.

We do not use integration data to advertise to your customers on our own behalf, and we do not sell or resell it.

D. The AI Twin Research Panel

Separately from any data you connect, Codon maintains its own panel of AI Twins used to simulate research responses. This panel is derived from established social-science survey sources — including Twin-2K-500 (Columbia Business School), the World Values Survey, the European Values Study, Pew Research Center's Global Attitudes surveys, the General Social Survey, and the India Human Development Survey — combined with AI-generated enrichment. This panel is our own research asset; it is not your customer data, and using it does not disclose any of your own connected business data to other clients.

E. Technical & Usage Data

We collect standard technical data (IP address, browser/device information, log data, cookies) to operate, secure, and improve the Platform. See our Cookie Policy for details on cookies.

4. AI & Model Providers

Codon uses large language models to generate AI Twins' simulated responses and AI-assisted insights. Depending on the study, prompts (which may include your brand brief, research questions, and uploaded creative) are sent to one of our model providers, routed primarily through OpenRouter to providers such as Anthropic, OpenAI, Alibaba (Qwen), Meta (Llama), or Google, with Groq as a secondary provider and a self-hosted fallback for availability.

• These providers process prompts solely to return a response to Codon — we do not permit them to use your data to train their own models where that control is available to us.
• We do not sell your data to any model provider, and providers do not receive your account credentials or integration access tokens.
• Publicly available signals (Google Trends, Reddit, news sources) used for market-context features are aggregated and not linked to your account or customer data.

5. Cross-Border Data Transfers

We are based in India and process data under the Digital Personal Data Protection Act, 2023 (DPDP Act). Because several of our AI model and infrastructure providers are based outside India, your prompts and related data may be transferred to and processed in other countries, including the United States. We only transfer data to providers with appropriate contractual safeguards in place, and we do not transfer data to any country restricted by the Central Government under the DPDP Act.

6. Security

We use encrypted connections (HTTPS/TLS) in transit, encrypted storage for OAuth access tokens and account credentials, and role-based access controls restricting who at MindSci.ai Private Limited can access production data. In the event of a personal data breach, we will notify the Data Protection Board of India and affected users as required under the DPDP Act.

7. Retention & Deletion

• Integration data (e.g. Shopify, Zoho, Meta, Google) is retained only while the connection is active. If you disconnect a platform or delete your account, associated data and access tokens are deleted within 30 days.
• Simulation results and reports are retained while your account is active, so you can revisit past research.
• AI Twin panel data is retained as our own research asset independent of any single client's account, and is not deleted when a client's account is closed.
• You may request earlier deletion of your account or integration data at any time by contacting us (Section 11).

8. Your Rights

Under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you
• Correct or update inaccurate data
• Withdraw consent and request erasure of your data, subject to any legal retention requirements
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity
• Lodge a grievance with our Grievance Officer, and escalate to the Data Protection Board of India if unresolved

To exercise any of these rights, contact us using the details in Section 11.

9. Children’s Data

Codon is a business-to-business platform and is not directed at children. We do not knowingly collect personal data from individuals under 18.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date above, and for material changes, notify account holders by email.

11. Contact Us

For any privacy-related requests or to exercise your rights, contact us: