Privacy Notice

1. Who this Privacy Notice applies to

This Privacy Notice applies to personal information we process about:

• visitors to the Mint Leave website;
• people who create or use a Mint Leave account;
• customer account owners and billing contacts;
• HR administrators, managers, and employees using Mint Leave through an organization;
• people invited to join a Mint Leave workspace;
• people who contact us for support, sales, privacy, billing, or other business reasons.

If you use Mint Leave through your employer or organization, your organization may have its own privacy notice or internal policies that explain how it uses employee information. You should review those materials or contact your organization if you have questions about your employment-related data.

2. Our role: service provider / processor and business / controller

Mint Leave processes personal information in different roles depending on the context.

Customer workspace data

When an organization uses Mint Leave to manage its workforce leave information, the organization generally determines:

• which users are invited;
• what employee information is entered;
• what roles and permissions users receive;
• how leave policies, balances, approvals, reports, and records are managed;
• how long workspace records should be retained, subject to legal and contractual limits.

In that context, the organization is generally the customer, business, or controller, depending on the applicable law. Mint Leave generally acts as a service provider or processor that processes the information to provide the platform.

Mint Leave business data

When we process information for our own business purposes, such as website visits, account administration, billing, support, security, and communications, Mint Leave may act as the business or controller of that information.

3. Information we collect

We collect personal information depending on how you interact with Mint Leave and how your organization configures the platform.

Account and identity information

When you create, access, or are invited to a Mint Leave account, we may collect:

• first and last name;
• email address;
• preferred language;
• password authentication information;
• account status;
• email verification status;
• password reset activity;
• login activity;
• invitation status;
• account security events;
• user settings and preferences.

We do not store your plain-text password.

Organization and workspace information

When an organization creates or uses a Mint Leave workspace, we may collect and process:

• organization or company name;
• workspace settings;
• default language;
• timezone;
• organization or workspace identifiers;
• role and permission information;
• subscription plan;
• seat count;
• billing status;
• onboarding and setup progress;
• administrative configuration.

Mint Leave uses organization and workspace identifiers to keep each organization’s data separated.

Employee and leave management information

Depending on how an organization uses Mint Leave, we may process employee and leave-related information, such as:

• employee names and email addresses;
• roles, departments, locations, managers, and employment status;
• hire dates;
• leave policies;
• leave types;
• holidays and calendars;
• leave requests;
• leave request dates, duration, type, and status;
• approval, rejection, cancellation, and decision records;
• decision comments;
• leave balances;
• annual entitlements;
• opening balances;
• accrual records;
• carryover records;
• manual balance adjustments;
• reports and exports generated by authorized users;
• audit or activity records related to important actions.

This information is used to provide the leave management features requested by the organization.

Potentially sensitive information

Mint Leave is not designed to require highly sensitive information such as detailed medical records, government identity numbers, banking information, or biometric information.

However, depending on how an organization and its users use the platform, some leave-related information may reveal or suggest sensitive information. For example, a leave type, holiday, comment, or supporting note may relate to health, family responsibilities, religious observance, or other personal circumstances.

Customers should avoid entering sensitive personal information unless it is necessary, lawful, and appropriate for their leave management process. Mint Leave processes such information only as needed to provide the service, maintain security, comply with legal obligations, or as otherwise described in this Privacy Notice.

Billing information

We collect subscription and billing-related information, such as:

• plan information;
• seat counts;
• billing status;
• Stripe customer identifiers;
• Stripe subscription identifiers;
• payment status;
• invoice and billing events;
• customer portal activity related to billing.

Mint Leave uses Stripe to process payments. Mint Leave does not store full credit card numbers on its own servers. Payment information is handled by Stripe according to Stripe’s own terms and privacy practices.

Communications and notifications

We may process information related to:

• invitation emails;
• email verification messages;
• password reset messages;
• leave request notifications;
• approval, rejection, or cancellation notifications;
• billing and subscription notifications;
• account and security notifications;
• support messages;
• system alerts;
• product or service announcements, where permitted.

Transactional and service-related messages are necessary for operating Mint Leave. Marketing communications, if used, will include any required unsubscribe or preference options.

Technical, log, and usage information

When you visit or use Mint Leave, we may collect:

• IP address;
• browser and device information;
• operating system;
• language settings;
• pages visited;
• actions taken in the platform;
• timestamps;
• session information;
• authentication logs;
• security logs;
• error logs;
• diagnostic information;
• approximate location inferred from IP address.

We use this information to operate, secure, debug, monitor, and improve Mint Leave.

Social login information

Mint Leave may allow users to sign up or log in using third-party identity providers, such as Google or Microsoft.

If you choose to use social login, we may receive information from the identity provider, such as:

• name;
• email address;
• account identifier;
• profile image, if provided by the identity provider;
• authentication status.

We use this information only to create, authenticate, secure, and manage your Mint Leave account. We do not control how third-party identity providers collect or use information through their own services. You should review their privacy policies and account settings.

4. How we collect information

We collect information in the following ways:

• directly from you, when you create an account, use the platform, submit a form, or contact us;
• from your organization, when it invites users, configures a workspace, or manages employee leave data;
• automatically, when you use our website or platform;
• from service providers, such as Stripe or authentication providers, when needed to provide the service.

5. How we use personal information

We use personal information to:

• provide, operate, and maintain Mint Leave;
• create and manage user accounts;
• authenticate users and protect accounts;
• verify email addresses;
• manage organization workspaces;
• enforce role-based access and organization separation;
• process leave requests, approvals, cancellations, balances, calendars, policies, reports, and related workflows;
• send transactional emails and notifications;
• provide customer support;
• manage subscriptions, trials, billing, seat limits, invoices, and payment status;
• monitor service performance and reliability;
• detect, prevent, and investigate abuse, fraud, unauthorized access, or security incidents;
• troubleshoot errors and improve product quality;
• comply with legal, regulatory, tax, accounting, and contractual obligations;
• enforce our Terms of Service and other agreements;
• improve the product and user experience.

We do not sell personal information.

We do not use employee leave data for advertising.

We do not use customer workspace data to market to employees.

6. Customer employee and workspace data

Mint Leave processes employee and leave-management information on behalf of customer organizations.

For customer-controlled workspace data:

• the organization decides what information is entered into Mint Leave;
• the organization decides which users are invited and what roles they receive;
• the organization controls how leave information is used in its workspace;
• the organization is generally responsible for responding to employee access, correction, deletion, and employment-data questions;
• Mint Leave assists the organization in handling requests where required by law or contract.

If we receive a request from an employee or user about information controlled by their organization, we may refer the request to that organization or work with the organization to respond appropriately.

7. Legal bases for processing

Where applicable privacy laws require a legal basis for processing personal information, we rely on one or more of the following:

Contract

We process information where necessary to provide Mint Leave, administer accounts, deliver the platform, manage subscriptions, and perform our agreements with customers or users.

Legitimate interests

We process information where necessary for legitimate business interests, such as:

• operating and improving the service;
• securing accounts and workspaces;
• preventing fraud or abuse;
• troubleshooting errors;
• supporting customers;
• understanding product usage;
• maintaining business records.

We consider whether our interests are overridden by privacy rights and expectations.

Consent

We may rely on consent where required, such as for optional cookies, certain communications, or specific processing activities. Where processing is based on consent, you may withdraw consent at any time, subject to legal and contractual limits.

Legal obligations

We may process information where necessary to comply with tax, accounting, regulatory, legal, security, or recordkeeping obligations.

Customer instructions

Where Mint Leave acts as a processor or service provider for customer workspace data, we process that information according to the customer’s instructions, our agreement with the customer, and applicable law.

8. How information is shared

We share personal information only as needed to provide, secure, support, and improve Mint Leave, or as required by law.

With your organization

If you use Mint Leave through an employer or organization, authorized users within that organization may access information according to their role and permissions.

For example:

• HR Admins may access organization-wide leave and people information;
• managers may access relevant team leave information;
• employees may access their own leave information;
• billing or account owners may access subscription and billing information.

Your organization is responsible for assigning roles and deciding who should have access inside its workspace.

With service providers and subprocessors

We may share information with trusted service providers that help us operate Mint Leave, such as:

• hosting and infrastructure providers;
• payment processors, including Stripe;
• email delivery providers;
• monitoring, logging, and error-tracking providers;
• analytics providers, if used;
• customer support tools, if used;
• backup and security providers;
• authentication providers, if social login is enabled.

These providers may process personal information only for the purpose of providing services to Mint Leave and are expected to protect the information appropriately.

We may publish and update a Subprocessors page listing service providers that process customer workspace data.

For legal, safety, and security reasons

We may disclose information if we believe it is necessary to:

• comply with applicable law, regulation, legal process, or lawful government request;
• protect the rights, safety, or security of Mint Leave, our customers, users, or others;
• investigate fraud, abuse, unauthorized access, or security incidents;
• enforce our Terms of Service or other agreements.

Where legally permitted and appropriate, we may notify the relevant customer organization before disclosing customer-controlled workspace data in response to a legal request.

Business transfers

If Mint Leave is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar transaction, personal information may be transferred as part of that transaction, subject to appropriate confidentiality and privacy protections.

9. Stripe and payment processing

Mint Leave uses Stripe to support billing and payment-related workflows.

Stripe may process information such as:

• billing contact information;
• payment method details;
• invoices;
• subscription status;
• tax-related information, if applicable;
• payment events.

Mint Leave does not store full credit card numbers on its own servers. Stripe handles payment information according to its own terms and privacy practices.

Mint Leave may store Stripe customer IDs, subscription IDs, billing status, invoice references, and payment event information so that we can manage subscriptions, seat limits, billing states, and account access.

10. Cookies and similar technologies

Mint Leave uses necessary cookies for authentication, security, and language preferences. Mint Leave also uses Google Analytics 4 on Public and Auth pages to understand website traffic and campaign attribution. Cookies are mainly used to:

• keep users signed in;
• protect sessions;
• remember language preferences;
• support security features;
• improve website performance;
• understand Public/Auth website usage and traffic sources.

Some cookies are necessary for the website and platform to function. Optional analytics or marketing cookies will be described in our Cookie Notice and handled according to applicable consent requirements.

Within the Mint Leave application, we use cookies for authentication, security, preferences, service operation, and the PostHog analytics described below, subject to applicable consent requirements.

11. Analytics

Mint Leave uses Google Analytics 4 and PostHog on Public and Auth pages to understand website traffic, landing pages, referral sources, campaign parameters, interactions, heatmaps, browser errors, and visitor journeys. PostHog receives complete page URLs, including path identifiers, query strings, referrers, and password-reset tokens when they appear in URLs. Public PostHog activity remains anonymous unless the URL itself contains identifying information. Public autocapture and session replays may show page content, navigation, element attributes, and non-password input values. Password inputs are masked, and captured network headers and bodies are disabled.

Analytics may help us understand:

• which pages are visited;
• which channels or campaigns bring visitors to Mint Leave;
• how visitors move through Public/Auth pages;
• how to improve website content and user experience.

Google Analytics 4 is not installed in the authenticated Workspace. Mint Leave uses PostHog in Workspace to understand interactions, heatmaps, browser errors, and visitor journeys and to improve the service. PostHog receives complete page URLs, including path identifiers, query strings, referrers, and password-reset tokens when they appear in URLs. Workspace activity is associated with the signed-in user's email address. Workspace autocapture and session replays may show page content, navigation, element attributes, and non-password input values. Password inputs are masked, and captured network headers and bodies are disabled. Analytics information should not be used to make employment decisions about employees.

12. International data storage and transfers

Mint Leave may store and process personal information in Canada, the United States, or other jurisdictions where we or our service providers operate.

When personal information is processed outside your province, state, or country, it may be subject to the laws of that jurisdiction. We use reasonable contractual, technical, and organizational safeguards designed to protect personal information.

For users in the European Economic Area, United Kingdom, or Switzerland, where required, we will use appropriate transfer safeguards such as adequacy decisions, standard contractual clauses, the UK International Data Transfer Addendum or Agreement, or other legally recognized transfer mechanisms.

13. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information.

These safeguards may include:

• encrypted connections using HTTPS;
• account authentication;
• email verification;
• password reset controls;
• role-based access controls;
• organization and workspace access separation;
• secure session handling;
• CSRF protection;
• audit and event logging for important actions;
• restricted access to production systems;
• monitoring and error tracking;
• backup and recovery practices;
• security review of important workflows.

Mint Leave is designed around organization separation so that each organization’s workspace data is scoped to that organization. Organization-specific access controls are intended to reduce the risk of cross-organization access.

No system can be guaranteed to be completely secure. If we become aware of a security incident affecting personal information, we will take appropriate steps to investigate, mitigate, and notify affected parties where required by law.

Users are responsible for keeping their account credentials secure and for using Mint Leave in a secure environment.

14. Data retention

We keep personal information only as long as reasonably necessary for the purposes described in this Privacy Notice, including to provide Mint Leave, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and support business operations.

Retention periods may vary depending on the type of information and the organization’s use of Mint Leave.

For example:

• account information may be kept while the account is active;
• organization and leave records may be kept while the organization maintains a Mint Leave workspace;
• billing records may be kept as required for tax, accounting, and legal purposes;
• security logs may be kept for a limited period to protect the service;
• backups may retain information for a limited period before being overwritten or deleted;
• support messages may be kept as needed to provide support and maintain business records;
• audit records may be kept as needed to preserve the integrity of workspace activity history.

When information is no longer needed, we will delete, anonymize, or securely retain it where deletion is not immediately possible, such as in backups or legal records.

To request deletion, contact support@mintleave.com. We may need to verify the request and may retain limited information where required for legal, security, billing, audit, or backup purposes.

15. Customer controls, exports, and deletion requests

Customer organizations may be able to update, export, or delete certain information through the Mint Leave platform.

Authorized users may generate reports or exports that contain personal information. Customers are responsible for protecting any reports or exports they download from Mint Leave.

If you are an employee using Mint Leave through your employer or organization, requests to access, correct, export, or delete work-related leave information should usually be directed to your organization first.

You may also contact Mint Leave using the contact information below. We will respond directly where appropriate or help route the request to the relevant organization.

Deletion may be limited where information must be retained for legal, tax, accounting, security, audit, dispute-resolution, or contractual reasons.

16. Automated decision-making

Mint Leave helps organizations manage leave workflows based on rules configured in the platform, such as leave policies, balances, entitlements, approver assignments, and billing status.

Mint Leave does not make employment decisions on behalf of customers.

Mint Leave may automatically calculate balances, validate requests, route approvals, apply role permissions, send notifications, or enforce billing-related access limits. These actions are part of operating the service and are based on customer configuration, user actions, and platform rules.

Mint Leave does not currently make decisions about users based solely on automated processing that produce legal or similarly significant effects.

17. Your privacy rights

Depending on where you live, you may have rights regarding your personal information, such as the right to:

• access personal information;
• correct inaccurate information;
• request deletion;
• request portability;
• restrict or object to processing;
• withdraw consent where processing is based on consent;
• request information about how personal information is used and shared;
• opt out of certain marketing communications;
• file a complaint with a privacy regulator.

To exercise privacy rights, contact us at:

Privacy contact: support@mintleave.com

We may need to verify your identity before responding to certain requests. If your request relates to workspace data controlled by your employer or organization, we may refer the request to that organization or respond in coordination with them.

18. Canada and Quebec privacy rights

If you are located in Canada, including Quebec, you may have rights under applicable federal or provincial privacy laws.

These may include the right to:

• request access to your personal information;
• request correction of inaccurate information;
• withdraw consent where consent is the basis for processing;
• ask questions about how your information is collected, used, disclosed, retained, and transferred;
• file a complaint with the applicable privacy regulator.

For Quebec residents, personal information may be transferred or stored outside Quebec where we or our service providers operate. We use reasonable safeguards designed to protect personal information when it is transferred outside Quebec.

19. EEA, UK, and Switzerland privacy rights

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you may have rights under applicable data protection laws, including the right to:

• access your personal data;
• correct inaccurate personal data;
• request deletion of personal data;
• restrict processing;
• object to processing;
• request data portability;
• withdraw consent where processing is based on consent;
• lodge a complaint with your local data protection authority.

Where Mint Leave processes customer-controlled employee data on behalf of an organization, the organization is usually the controller of that data, and Mint Leave is usually the processor. Employee requests about workspace data should generally be directed to the organization first.

Where required, Mint Leave will process personal data according to applicable data processing terms or a Data Processing Addendum.

20. California privacy notice

This section applies to California residents where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies.

Categories of personal information we may collect

In the past 12 months, Mint Leave may have collected the following categories of personal information:

Sources of personal information

We may collect personal information from:

• you;
• your organization;
• your device or browser;
• service providers;
• payment processors;
• authentication providers, if social login is used.

Purposes for collection and use

We collect and use personal information for the purposes described in this Privacy Notice, including to provide the service, manage accounts, process leave workflows, support customers, manage billing, secure the platform, troubleshoot errors, and comply with legal obligations.

Disclosure of personal information

We may disclose personal information to service providers, subprocessors, your organization, payment processors, security providers, and other parties as described in this Privacy Notice.

Sale and sharing

Mint Leave does not sell personal information.

Mint Leave does not share personal information for cross-context behavioral advertising unless this is separately disclosed and any required opt-out or consent mechanism is provided.

Sensitive personal information

Mint Leave does not use sensitive personal information for purposes other than those permitted by applicable law, such as providing the service, security, fraud prevention, account authentication, and compliance.

California rights

California residents may have the right to:

• know what personal information we collect, use, disclose, or share;
• request access to personal information;
• request correction of inaccurate personal information;
• request deletion of personal information;
• opt out of sale or sharing, if applicable;
• limit use of sensitive personal information, where applicable;
• not be discriminated against for exercising privacy rights.

Where personal information is customer-controlled employee data, we may refer the request to the relevant customer organization.

Authorized agents may submit requests where permitted by law. We may require proof of authorization and identity verification.

21. Children’s privacy

Mint Leave is intended for use by organizations and their workforce. It is not directed to children under the age of 13, and we do not knowingly collect personal information directly from children under 13.

If we learn that we have collected personal information directly from a child under 13 without appropriate consent, we will take steps to delete it.

Because Mint Leave is used by organizations, customers should not invite or enter information about children unless they have a lawful basis and authority to do so.

22. Third-party links and services

Mint Leave may contain links to third-party websites or services, such as Stripe-hosted billing pages, identity providers, or customer support tools.

We are not responsible for the privacy practices of third parties. Your use of third-party services is governed by their own terms and privacy policies.

23. Do Not Track signals

Some browsers may send “Do Not Track” signals. Because there is no consistent industry standard for responding to these signals, Mint Leave does not currently respond to Do Not Track browser signals.

If a legally required standard is adopted, we will update this Privacy Notice.

24. Changes to this Privacy Notice

We may update this Privacy Notice from time to time. When we make changes, we will update the “Last updated” date above.

If changes are material, we may provide additional notice, such as through the website, email, or in-app notification.

25. Contact us

For privacy, security, support, or account questions, contact us at: