7 Mindsets and Affiliates Privacy Policy

Last Updated: 2026

1. Introduction

This Privacy Policy applies to 7 Mindsets Academy, LLC and its affiliates, including 7 Mindsets Insights (formerly xSEL Labs, LLC) and BASE Education, LLC (collectively, “7 Mindsets,” “we,” “our,” or “us”). It explains how we collect, use, disclose, and protect information when you use our websites, mobile applications, and online products and services (collectively, the “Services”); when you contact our support team; and when you interact with us through our official social media pages.

7 Mindsets partners with schools, school districts, educational institutions, mental health facilities, and other organizations (collectively, “Organizations”) to provide educational services to their students and patients (“Participants”). We may also provide access to the Services to parents and guardians of Participants, and to teachers, school administrators, and other Organization staff (collectively, “Non-Participants”).

Where 7 Mindsets provides Services to an Organization under a written agreement, including a data privacy or data protection agreement, that agreement governs our handling of Participant information and controls in the event of any conflict with this Privacy Policy.

By accessing or using the Services, you acknowledge and agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Services. We welcome your questions at any time; see Section 15 (Contact Us).

2. Websites and Applications Covered

This Privacy Policy applies to the following 7 Mindsets websites and applications:

• The 7 Mindsets Academy, LLC platform at www.7mindsetsportal.com, including 7 Mindsets Core, 7 Mindsets Wellness, and 7 Mindsets Insights (the “7 Mindsets Site”).
• The BASE Education, LLC (“BASE”) website at www.base.education (the “BASE Site”) and the BASE mobile application (the “Application”). BASE is now branded as 7 Mindsets Wellness.

The 7 Mindsets Site and the BASE Site are collectively referred to as the “Websites.”

3. Student Data Privacy

When we provide the Services to educational institutions, we act as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act (“FERPA”), under the direct control of the institution with respect to the use and maintenance of education records.

Education records and other Participant information remain under the ownership and control of the Organization, and 7 Mindsets does not claim ownership of them. We handle Participant information in accordance with FERPA, the Children’s Online Privacy Protection Act (“COPPA”), and applicable state student privacy laws.

4. Information We Collect

We practice data minimization: we collect only the information reasonably necessary to provide, support, secure, and improve the Services. “Personal Information” means information that identifies, relates to, or could reasonably be linked to an identifiable individual.

4.1 Information Organizations Provide About Participants

Each Organization decides what Participant information to provide, typically through secure rostering integrations (such as Clever or ClassLink) or authorized uploads. Depending on the Organization’s choices, this may include a Participant’s name, school-issued login or identifier, student or patient identification number, school, grade level, date of birth, gender identity, ethnicity, class or group membership, and the courses assigned to the Participant.

4.2 Information Participants Provide

Participants provide information through their use of the Services, including responses to lessons, coursework, reflections, and assessments (including responses a Participant later deletes, as described in applicable 7 Mindsets documentation), and requests for help directed to their Organization or to the 7 Mindsets Partner Support Team.

From time to time, we may invite Participants to complete anonymous surveys after a course. Survey responses are de-identified so that individual respondents cannot be identified.

4.3 Information From Non-Participants

When educators, administrators, parents, or guardians use the Services, we collect their name, email address, role, and Organization affiliation, including the Organization’s name and business address. When Non-Participants complete professional learning or family modules, we also receive the responses they submit as part of that coursework. Non-Participants may choose to provide optional demographic information, such as age range, gender, or education level, which we use only in de-identified, aggregate form to improve the Services.

When you contact us, request a demonstration, register for an event, or send us a message through our Websites, we collect the information you choose to provide, such as your name, email address, telephone number, Organization, and role. If you purchase Services directly, we collect the billing information needed to complete the transaction; payment card information is processed directly by our third-party payment processor.

For business contacts at current and prospective customer Organizations, we may also obtain professional contact information, such as name, title, and work email address, from publicly available sources. We never collect Participant information from such sources.

4.4 Information Collected Automatically

When you visit our Websites, we and our service providers use cookies and similar technologies to collect limited technical information, such as IP address, browser and device type, operating system, pages viewed, referring website, language preference, approximate location (city or region) derived from IP address, and the date and time of access. We use this information to operate and secure the Services, diagnose technical problems, understand in aggregate how the Services are used, and improve performance.

We do not use cookies or similar technologies to track Participants across third-party websites or to deliver targeted advertising.

5. How We Use Information

5.1 Participant Information

We use Participant Personal Information solely to provide the Services to the applicable Organization, including to:

• deliver the lessons, courses, and assessments the Organization assigns;
• enable educators and authorized Organization staff to view progress, results, and reports;
• route requests for help to the Organization or to our Partner Support Team;
• where enabled by the Organization, help identify responses that may indicate a risk of harm to the Participant or others, so that the Organization can respond;
• maintain, secure, troubleshoot, and improve the Services; and
• comply with our legal obligations.

We do not sell Participant Personal Information, use it for targeted or behavioral advertising, send marketing communications to Participants, build profiles of Participants for any purpose other than providing the Services to the Organization, or use it for any purpose the Organization has not authorized.

5.2 Non-Participant Information

We use Non-Participant Personal Information to:

• create and manage accounts and deliver the Services;
• provide customer support and respond to inquiries;
• manage our contractual relationships with Organizations, including billing;
• send service-related communications, such as account notices and product updates;
• send information about 7 Mindsets products, resources, and events that may interest you (you may opt out at any time; see Section 9.2);
• invite you to share feedback about the Services; and
• maintain, secure, and improve the Services.

5.3 Website Analytics

We use web analytics services, such as Google Analytics, to understand in aggregate how our Websites are used and to maintain the quality of the Services. These providers process the information described in Section 4.4 on our behalf. You can prevent Google Analytics from collecting your information by installing the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout.

5.4 Artificial Intelligence

Some features of the Services may use artificial intelligence (“AI”) technologies. When an AI feature processes Personal Information, it does so only to provide that feature within the Services. We engage AI service providers under terms that prohibit them from using the information we submit to train their own models, and we do not use Participant Personal Information to train generalized AI models.

6. How We Share Information

We do not sell, rent, or lease Personal Information, and we do not share Personal Information with third parties for their own marketing or advertising purposes. We disclose Personal Information only as described below.

6.1 With the Organization

Participant information is available to the Organization that provided it and to authorized Organization staff, such as teachers and administrators, according to the roles and permissions the Organization establishes. Where an Organization grants access, parents and guardians may view information about their own child.

6.2 With Service Providers

We engage carefully selected service providers (“Sub-Processors”) that help us operate the Services, such as providers of cloud hosting and storage, content delivery, email delivery, secure sign-on and rostering, video and interactive content hosting, customer support, website analytics, and payment processing. Sub-Processors may access Personal Information only as necessary to perform services for us, under written agreements that:

• prohibit them from using Personal Information for any other purpose;
• require them to keep Personal Information confidential and protect it with appropriate security safeguards; and
• impose data protection obligations at least as protective as those in this Privacy Policy.

We maintain a current list of our Sub-Processors, which is available to Organizations upon request. We are not responsible for information you provide directly to a third party, and we encourage you to review the privacy policy of any third-party website you visit.

6.3 For Safety and Legal Reasons

We may disclose Personal Information when we believe in good faith that disclosure is necessary to:

1. comply with applicable law, regulation, or valid legal process;
2. protect the safety of any person, including making lawful disclosures when a Participant or Non-Participant indicates a plan to harm themselves or others;
3. enforce our agreements, policies, and terms of use;
4. protect the rights, property, or security of 7 Mindsets, our users, or the Services; or
5. detect, prevent, and respond to fraud, unauthorized access, and other security threats.

Where legally permitted and consistent with safety, we will notify the affected Organization of any legal demand for Participant information.

6.4 Business Transfers

If 7 Mindsets is involved in a merger, acquisition, reorganization, sale of assets, or similar transaction, Personal Information may be transferred as part of that transaction. We will ensure that any successor, as of the closing of the transaction, either (i) continues to be bound by this Privacy Policy, or (ii) agrees to privacy and security obligations at least as protective as those in this Privacy Policy. We will notify affected Organizations of any such transfer of Participant information. In the event of a dissolution, we will return or delete Participant information in accordance with our agreements with Organizations.

6.5 De-Identified Information

We may use and share information that has been de-identified and aggregated so that it cannot reasonably be used to identify any individual, such as anonymous survey results that help us understand outcomes and improve our courses. We never share individual survey responses, and we do not attempt to re-identify de-identified information.

7. How We Protect Information

Protecting the information entrusted to us is one of our highest priorities. We maintain a layered security program of administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, use, alteration, disclosure, and loss. Our safeguards include:

• Independent audit. 7 Mindsets has completed an independent SOC 2 Type 2 examination of its platform against the AICPA Trust Services Criteria for Security, with an unqualified opinion from the auditor. A copy of the report is available to customers and prospective customers upon request.
• Encryption. Data transmitted between your device and our Services is encrypted using TLS (HTTPS), and data stored in our databases and file storage is encrypted at rest using AES-256 encryption.
• Secure cloud infrastructure. The Services are hosted in Amazon Web Services (AWS) data centers in the United States, which maintain independently audited certifications, including SOC 2 and ISO/IEC 27001.
• Network protection. A managed web application firewall, content delivery network protections, and network segmentation restrict access to our systems.
• Access controls. Access to Personal Information is role-based, follows the principle of least privilege, and is limited to personnel who need it to perform their duties.
• Secure sign-on. The Services integrate with Organizations’ identity providers, such as Clever, ClassLink, and Microsoft, so users can sign in with credentials their Organization manages.
• Monitoring and resilience. We continuously monitor and log activity on our systems, alert on suspicious behavior, and maintain regular backups and disaster-recovery capabilities.
• Ongoing review. We regularly review the security of our applications and infrastructure and prioritize remediation of identified issues based on risk.
• Confidentiality. Our employees and contractors are bound by confidentiality obligations.

If a security incident affecting Personal Information occurs, we will promptly investigate, contain, and remediate it, and we will notify affected Organizations and individuals as required by applicable law and our agreements.

No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security. That is why we continuously review and strengthen our safeguards to keep pace with evolving risks. You can help protect your account by keeping your login credentials confidential and notifying us promptly at [email protected] of any suspected unauthorized access.

8. Data Retention and Deletion

We retain Personal Information only as long as necessary for the purposes described in this Privacy Policy.

• Participant information. We retain Participant Personal Information for the duration of our agreement with the Organization and as the Organization directs. Upon the Organization’s request, or following the end of our agreement, we will delete or de-identify Participant Personal Information in accordance with that agreement, unless applicable law requires us to retain it.
• Non-Participant information. We retain Non-Participant Personal Information while your account is active and as needed to provide the Services, maintain our business relationship, meet legal, tax, and accounting obligations, resolve disputes, and enforce our agreements.

When Personal Information is no longer needed, we securely delete or de-identify it.

9. Your Rights and Choices

9.1 Access, Correction, and Deletion

Participants, parents, and guardians. Because Participant information is provided by and remains under the control of the Organization, requests to review, correct, or delete Participant information should be directed to the Organization (for example, your school). We support Organizations in responding to these requests promptly. If you contact us directly, we will refer your request to the Organization or work with the Organization to fulfill it.

Non-Participants. You may request to access, correct, update, restrict, or delete Personal Information you have provided to us by emailing [email protected]. When we receive a verified request to delete your Personal Information, we will delete it, except for information we are required or permitted by law to retain. We will respond to all requests in accordance with applicable law.

9.2 Marketing Communications

You may opt out of marketing emails at any time by using the unsubscribe link in any such email or by emailing [email protected]. You may also opt out of other marketing communications, such as phone calls or mailings, by contacting us in the same way. We will honor your request as soon as reasonably practicable. If you opt out, we may still send you non-promotional messages about your account or our business relationship.

9.3 Do Not Track

Some web browsers offer a “Do Not Track” setting. Because there is not yet a common industry standard for responding to these signals, our Services do not currently respond to them. Regardless of this setting, we do not use Participant information for targeted advertising or track Participants across third-party websites.

10. Children’s Privacy

Many Participants are children, and we take our responsibility to protect their privacy seriously. We comply with the Children’s Online Privacy Protection Act (COPPA).

When the Services are provided through a school, we rely on the school to provide consent on behalf of parents for the collection of Personal Information from students under the age of 13, as COPPA permits, solely for the use and benefit of the school and for no other commercial purpose. When the Services are provided to children under 13 in other settings, we or the Organization obtain parental consent as required by law.

We protect children’s privacy by:

• providing notice of our information practices, including what we collect, how we use it, and with whom we share it;
• collecting no more Personal Information than is reasonably necessary for a child to participate in the Services;
• never using children’s information for advertising; and
• enabling parents and guardians, through the Organization or directly, to review their child’s Personal Information, request its correction or deletion, and refuse further collection.

If you are under 13, please ask your parent or guardian for permission before using the Services. Parents or guardians who do not wish their child to use the Services should contact the child’s school administrator. Parents with questions may contact us using the information in Section 15.

11. Content You Share Through the Services

Some features of the Services allow users to share content, such as responses or posts, with other users. Shared content is visible to the users that feature is designed to reach, such as a class, group, or Organization, as configured by the Organization. Please do not include Personal Information in shared content that you do not want others to see.

Participant content remains under the control of the Organization, and 7 Mindsets does not claim ownership of it. By submitting content, you grant 7 Mindsets a non-exclusive, royalty-free license to host, store, display, and process that content solely as necessary to provide and support the Services. You represent that you have the right to submit such content and that it does not violate the rights of others or applicable law. Additional terms governing content you submit are set out in our Terms of Use.

12. Your California Privacy Rights

California residents have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), including the right to know what Personal Information we collect and how we use and disclose it; to request access to, correction of, or deletion of Personal Information; to opt out of the sale or sharing of Personal Information; to limit the use of sensitive Personal Information; and to be free from discrimination for exercising these rights. California residents may also designate an authorized agent to make a request on their behalf.

7 Mindsets does not sell or share Personal Information, as those terms are defined under the CCPA.

To exercise your rights, email [email protected]. We will verify your request and respond as required by law. Requests concerning Participant information will be handled together with the applicable Organization.

13. Individuals Outside the United States

7 Mindsets is based in the United States, and we store and process Personal Information in the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country of residence. By using the Services, you consent to this transfer.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your Personal Information on the following legal bases: to perform our contracts with you or your Organization; for our legitimate interests in providing, securing, and improving the Services; to comply with legal obligations; and, where required, with your consent. Subject to applicable law, you may have the right to access, correct, delete, restrict, or object to the processing of your Personal Information; to data portability; and to withdraw your consent at any time. You may also lodge a complaint with your local data protection authority.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, our practices, or legal requirements. When we do, we will revise the “Last Updated” date at the top of this policy. If we make material changes, we will notify Organizations before the changes take effect. We will not make material changes to how we handle Participant information we have already collected without notice to the Organization and, where required by law or agreement, the Organization’s consent. Our practices will always remain consistent with our contractual commitments to Organizations. Continued use of the Services after changes take effect constitutes acceptance of the updated Privacy Policy.

15. Contact Us

We welcome your questions and comments about this Privacy Policy and our privacy practices. If you believe 7 Mindsets has not adhered to this Privacy Policy, please contact us and we will promptly investigate.

Data Protection Officer: Greg Chisholm · [email protected]

Privacy requests and general inquiries: [email protected]

Security concerns: [email protected]

Mail: 7 Mindsets Academy, LLC, 60 King Street, Roswell, Georgia 30075

Telephone: 678-878-3144