Version 2026-10-30.1. Effective 2026-10-30.
Scope
This notice covers Mindstamp's marketing website, account application and video player. Cookies, localStorage, sessionStorage, tags and similar technologies can store or access information on a device. Requests can disclose IP address and other connection information even without a cookie. Our Privacy Policy explains the related personal data processing.
Marketing website
A small prompt stays at the bottom of the website with Accept, Reject and Manage cookies. Manage cookies opens separate analytics and advertising choices. Optional choices start off. The website blocks Google Analytics until the analytics choice is enabled. It then measures page, link, form and conversion activity. Advertising and attribution require the separate advertising choice. Campaign and referral values can then remain in sessionStorage for the browser session and appear in supported signup or Calendly links. The app discards browser campaign attribution at signup. Google cross-domain linking into the app is disabled.
LinkedIn Insight, Meta Pixel and X Pixel load only after the advertising choice and only when their identifiers are configured. Production identifiers remain unverified. Cookie settings in the footer reopens the choices. Withdrawal blocks first-party event delivery, removes supported first-party storage and reloads the page to discard loaded vendor code. It does not erase provider-held records or cookies on another provider’s domain.
Account application
The application does not load Mindstamp Google Analytics, Google Ads, Rewardful, Bento and Customer.io browser tags. It does not create campaign signup storage or marketing visitor cookies. Authentication, sign-in preferences and the selected signup plan remain. The app and player do not show an optional-tracking consent popup. Acceptance of the Terms is not consent to optional advertising or tracking.
Video player and customer integrations
The player uses browser storage for viewer details, identifiers, variables, progress and enabled offline functions. These uses require assessment by purpose. They do not establish a cookie-free experience. Some information persists until application cleanup or browser clearing rather than expiring after a verified fixed period.
Mindstamp keeps remembered viewer identity, variables, plays and interactions separate for each customer organisation. Playlist progress uses the same organisation scope. The player ignores the former shared viewer and variable records. An old play can supply resume data only for the exact loaded video; old branch continuation is not imported. The recovery page uses the chosen or most recent scoped organisation. These controls do not separate different people who use the same browser within one organisation, erase old browser records or introduce a storage expiry.
Customers can enable analytics, pixels and external integrations. The customer must provide the required notice and obtain any required permission for its chosen processing. Mindstamp must still meet its own duties and provide a way to honour applicable instructions. A warning in a contract alone does not block a tag or obtain consent.
Mindstamp’s own optional browser marketing tags are absent from the app layout, including signed-in player pages. Customer Google and Meta settings resolve from the video, its group, its owner’s account or its organisation. Inherited settings must belong to the video organisation; a viewer’s account settings do not supply the tag. Customer-configured integrations retain their current loading behaviour, with no new host-consent protocol. The customer must prevent a tracking-enabled video from loading until any required consent is in place, including for direct links. External media and embeds can make separate provider requests.
Storage inventory
The table describes the release covered by this notice. Provider settings and customer configuration can affect the technologies used. Contact [email protected] for further information about the applicable configuration.
| Technology | Purpose and data | Duration or expiry evidence |
|---|---|---|
| Rails and authentication cookies | Sessions, account authentication and related service state. Explicit language selection can write a session. The app does not write a session solely to select the default language. | Session expiry follows the configured authentication and session settings. Contact us for the settings applicable to your use. |
| theme | Applies an existing interface theme preference. | The app can read an existing preference. It does not write a cookie solely for the default light theme. |
mindstamp_last_sign_in_method | Remembers email or Google sign-in. | One year from setting, unless removed sooner. |
mindstamp_last_sign_in_email | Remembers the account email for sign-in. | One year from setting, unless removed sooner. |
mindstamp_app_visitor (legacy) | Former app-visit indicator used to change marketing links. | The app no longer sets it and clears its legacy shared-domain value. The website clears supported legacy values before a choice or on refusal. |
mindstamp:cookie-choices:v2 | Stores separate analytics and advertising choices. | sessionStorage lifetime. Optional uses stay denied if a valid choice is absent. Blocked storage uses an explicit current-page choice only. |
mindstamp:campaign-attribution:v1 | Consented website campaign and referral values for selected links. | sessionStorage lifetime; removed on advertising refusal or withdrawal. |
ms_signup_attribution_v1 (legacy) | Former app signup campaign storage. | The app no longer writes it and removes an existing value. |
ms_signup_plan_v1 | Retains the selected signup plan. | sessionStorage lifetime. Assess this requested signup function separately from marketing attribution. |
| Mindstamp Google Analytics | Marketing-site measurement after analytics permission. Mindstamp app Analytics and Ads tags are not loaded. | Property and tag settings govern cookies and server retention. Contact us for the applicable property settings. |
| Rewardful (legacy browser use) | Former app browser affiliate attribution. | The affiliate program and its application integration have been retired. Existing provider records or cookies can have separate retention. |
| LinkedIn Insight, Meta Pixel and X Pixel | Marketing-site advertising after advertising permission and configured identifiers. | Only configured tags load after the relevant choice. Their cookie and record retention depends on the provider settings. These are separate from customer-enabled video tags. |
`mindstamp:viewer:<organisation>`, `mindstamp:variables:<organisation>` | Viewer details, identifiers and values scoped to the customer organisation. | localStorage has no new time expiry. Shared-device and deletion limits are described above. |
`mindstamp:plays:<organisation>`, `mindstamp:interactions:<organisation>` | Play progress, resume data and interaction state scoped to the customer organisation. | localStorage can persist until cleared or displaced by the existing record limits. A record limit does not set a time expiry. |
`mindstamp:last-identity-organization` | Most recent organisation scope for the identity recovery page. | localStorage has no new time expiry. It supplies an organisation pointer, not another organisation's identity. |
`playlist-viewer:<organisation>:<playlist>`, `playlist-enrollment:<playlist>` | Anonymous playlist reporting identity and explicit learner enrollment. | The anonymous fallback uses only the playlist organisation's viewer record. Enrollment token keys are unchanged. An enrollment token remains subject to the service access and validity checks. |
viewer, variables, MS_PLAYS, MS_INTERACTIONS (legacy) | Old shared player records. The player ignores global viewer and variables. It reads old resume records only for the exact loaded video and interactions for those accepted plays. | Existing values are not erased or given a new expiry by this change. |
| Offline storage | Enabled offline media functions. | Offline copies can persist until cleared or removed through the enabled feature. Contact us about the applicable disposal process. |
| Account and interface storage | Cached account or organisation data, lists, filters and interface preferences. | Storage can persist until the relevant service action or browser clearing removes it. |
| Marketing forms, booking and blog prompts | Session form progress, booking details and prompt dismissal state. | Session storage lasts for the browser session. Local storage can persist until the relevant function or browser clearing removes it. |
| Cloudflare Turnstile and protection services | Bot prevention, security and related connection metadata. | Storage and connection records follow the enabled protection function and provider settings. |
| Customer-enabled tracking and external embeds | Customer-selected analytics, pixels, hosts and connected functions. | Depends on the customer's configuration and provider. The customer must provide the required notice, permission and withdrawal controls. |
mindstamp:consent:v1 (legacy) | Key from the earlier paused consent work. | The website ignores and removes it. It does not grant the new choices. |
Required choices
Use a technology without consent only where the applicable exception and its conditions are met. Assess the function the person requested, the purpose, data and recipients. A label such as analytics, necessary or first party does not decide the result. The UK statistical-purpose exception has conditions and does not provide a general exemption for advertising, individual tracking or affiliate measurement. EEA national rules need separate assessment.
Where consent is required, block the relevant storage and requests until valid consent and provide an accessible withdrawal control. Where an exception requires an objection mechanism, provide it. Browser settings can restrict or clear storage but do not replace Mindstamp's required controls. A popup is one possible interface; compliance depends on the processing and valid controls, not the shape of the interface.
Contact
Contact [email protected] about Mindstamp's technologies or to make a privacy complaint. Contact the organisation responsible for a video about the tracking and integrations it enables.