Summary
- The connector only reads. It cannot change, delete or send anything in your Mingo account.
- It works only after you sign in with your Mingo account and choose Allow, or create a personal key yourself.
- What it reads goes only to the AI assistant you connected, and only when that assistant asks for it to answer you.
- We do not see or keep your conversations with the assistant.
- We do not sell connector data or use it for advertising.
- You can disconnect at any time, from the assistant or from Mingo.
Who and what this covers
This policy covers the Mingo connector: the service at mcp.mingo.cards that lets an AI assistant you choose read your Mingo account over the Model Context Protocol (MCP). Setup steps are in the AI assistants guide.
The connector is run by Mobilio Asia (www.mobilio.asia), the data controller for Mingo (“Mingo”, “we”). Everything else about your Mingo account, such as the app, your cards and the website, is covered by the Mingo Privacy Policy. Where the two differ for the connector, this page applies.
What the connector reads
When the assistant calls one of the connector's tools, the connector reads the following from your Mingo account and returns it to the assistant:
| Data | Examples |
|---|---|
| Contacts you saved or scanned | Name, job title, company, when and where you saved them, tags; and when asked: email, phone, address, website, note |
| Tags | Tag names and how many contacts each has |
| Your own cards | Card names and their public links |
| Card activity | Views, saves and card exchanges over a period, and how they change |
| Plan and usage | Your plan, scans and credits left, and what used them |
The connector reads only your own account. It does not read other Mingo users' accounts, your device, or anything outside Mingo.
Most of these details are about other people: the contacts you saved. When you let an assistant read them, you are sharing those people's details with the assistant's provider, so the responsibilities in section 5 of the Mingo Privacy Policy apply. Only connect an assistant you are comfortable sharing your contacts with.
What we collect when you use it
Sign-in
The connector uses OAuth 2.0 with PKCE. When you allow access, Mingo issues the assistant an access token (valid for 1 hour) and a refresh token (valid for 30 days, replaced each time it is used). We store these tokens only in hashed form, together with which assistant app was registered, when you allowed access and when the connection was last used.
Every approval is its own connection. An account can hold up to 20 connections and 10 personal keys, and a connection unused for 30 days ends by itself.
Personal API keys
If you create a personal key, in the Mingo app (Settings → AI assistants) or at app.mingo.cards/dashboard/mcp, we store it hashed, with the name you gave it, when it was made, when it expires and when it was last used. The full key is shown to you once and never again.
Server logs
For each request the connector logs the tool name, a shortened identifier of your account, whether it succeeded, how long it took and the size of the answer. It does not log the contents of your contacts or the answers it returns.
What we do not collect
- Your prompts or your conversations with the assistant: we receive only the tool requests it sends.
- Data from other apps or accounts you have connected to the assistant.
How the data is used
- To answer the assistant's request so it can answer you.
- To check that the connection is yours and is still allowed.
- To keep the service working and secure: finding errors and preventing abuse.
Legal bases where required (for example under the GDPR): your consent, which you give when you choose Allow or create a personal key, and which you can withdraw at any time by disconnecting; and our legitimate interest in keeping the service secure. This matches how the Mingo Privacy Policy treats AI features.
How long we keep it
| Data | Kept |
|---|---|
| Your Mingo data | As described in the Mingo Privacy Policy. The connector keeps no separate copy. |
| Tokens | Ended when you disconnect or delete your account; a refresh token expires 30 days after its last use |
| Personal keys | Until they expire, you revoke them, or you delete your account |
| Server logs | Only as long as needed to run and secure the service, then deleted |
How to disconnect
- From Mingo: open app.mingo.cards/dashboard/mcp (menu MCP) and choose Disconnect next to the assistant. Access stops within one minute.
- From Claude: Customize → Connectors, select Mingo, then disconnect or remove it.
- From ChatGPT: Settings → Apps, select Mingo, then disconnect.
- From Codex: run
codex mcp logout mingo, or remove Mingo under Settings → MCP servers. - A personal key: revoke it in the Mingo app under Settings → AI assistants, or at app.mingo.cards/dashboard/mcp. It stops working within one minute.
Disconnecting does not delete your Mingo account or its data. To delete your account and data, follow the account deletion guide.
Security
All traffic uses HTTPS. Tokens and keys are stored hashed, access tokens expire after one hour, and sign-in uses PKCE. The connector can only call read operations on your own account, and our backend enforces the same ownership and plan rules as the Mingo app.
Your rights
You have the rights described in the Mingo Privacy Policy, including access, correction, export and deletion, and you can withdraw the connector's access at any time by disconnecting. To exercise a right, email privacy@mingo.cards. You may also complain to your local data-protection authority.
Children
Mingo is a professional tool and is not meant for anyone under 16 (or your country's digital-consent age).
Changes
If we change this policy we will update the date at the top. If a change affects what the connector reads or who receives it, we will tell you before it takes effect.
Contact
Mobilio Asia · www.mobilio.asia
Privacy: privacy@mingo.cards · Support: support@mingo.cards
This document is provided in English; translations may be offered for convenience, in which case the English version prevails.