Privacy Policy — Mindflex

1. Controller

The controller responsible for data processing is:

Mindflex UG (haftungsbeschränkt)
Mariendorfer Damm 85
12109 Berlin, Germany

Commercial Register: Amtsgericht Berlin-Charlottenburg, HRB 276989 B
VAT ID: DE456508601

Email: hello@mindflex.world
Website: https://mindflex.world

Managing Directors: Felix Mai, Moritz Tiedemann, Julian Hecht

2. Data Protection Officer

We have appointed an external Data Protection Officer:

heyData GmbH
Schützenstraße 5
10117 Berlin, Germany

Email: datenschutz@heydata.eu

3. Overview of Data Processing

We process personal data when you:

Visit our website
Create an account (via email, Google Sign-In, or Apple Sign-In)
Use the AI chat service
Subscribe to paid services
Contact us

Personal data means any information that can identify you directly or indirectly.

4. What Data We Collect

Data	Purpose	Stored where
Email address	Authentication & account management	Supabase (US-East-1)
Display name	Personalization within the app	Supabase
Chat messages	Conversation continuity	Supabase (AES-256 encrypted at rest)
Conversation memory	Long-term context for AI companion	Zep (SOC 2 Type II certified)
Device token	Push notifications (if enabled)	Supabase
Timezone / City	Reminder scheduling	Supabase

What we do NOT collect

Phone number
Location data / GPS
Biometric data
Health insurance information
Contacts, photos, or device data (unless you explicitly share an image in chat)

5. Google User Data

What Google user data we access

When you sign in with Google, we receive:

Email address — used solely for authentication and account identification
Display name — used solely for personalization within the app (e.g., greeting you by name)
Profile picture URL — not stored; only used for display during your active session

How we use Google user data

Google user data is used exclusively to provide and improve your Mindflex experience:

To create and authenticate your account
To personalize your experience within the app
To communicate with you about your account (e.g., password resets, service notifications)

How we protect Google user data

In transit: TLS 1.2+ encryption for all API calls
At rest: AES-256 encryption on all stored data via Supabase
Pseudonymization: Chat data is stored with random user IDs; your email is not embedded in conversation data

Sharing and transfer of Google user data

We do not:

Sell Google user data to any third party
Share Google user data with data brokers or information resellers
Use Google user data for targeted advertising, personalized ads, retargeted ads, or interest-based ads
Use Google user data to determine credit-worthiness or for lending purposes
Use Google user data to train AI models
Transfer Google user data to third parties for reasons other than providing or improving the app

Google user data is only shared with the following service providers, strictly to operate the app:

Supabase (authentication & database hosting)
Anthropic (AI conversation processing — conversations do not include your email or Google account data)

Retention and deletion of Google user data

Your Google user data is retained for as long as your account is active. You can delete your account at any time via Settings → Delete Account in the app. Upon deletion:

All personal data (email, name) is permanently deleted
All chat data is fully anonymized — no way to trace it back to you
Deletion is completed within 30 days

6. Legal Basis for Processing (GDPR)

We process personal data based on the following legal grounds:

Art. 6(1)(b) GDPR — Contract performance: To provide and operate the platform
Art. 6(1)(f) GDPR — Legitimate interest: To improve, secure, and maintain the service
Art. 6(1)(a) GDPR — Consent: Where required, such as for health data processing or optional analytics
Art. 6(1)(c) GDPR — Legal obligation: To comply with legal requirements

7. Your Rights Under GDPR

You have the right to:

Access your data (Art. 15 GDPR)
Correct inaccurate data (Art. 16 GDPR)
Delete your data (Art. 17 GDPR) — available in-app via Settings → Delete Account
Restrict processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR) — available in-app via Settings → Export Data
Object to processing (Art. 21 GDPR)
Withdraw consent at any time (Art. 7 GDPR)

To exercise your rights, contact: hello@mindflex.world

8. Data Security

Encryption in transit: TLS 1.2+ for all API communications
Encryption at rest: AES-256 encryption on all stored data
Pseudonymization: Chat data stored with random user IDs, not linked to email
External DPO: heyData GmbH monitors our GDPR compliance
SOC 2 Type II: Our memory provider (Zep) is SOC 2 Type II certified

9. Third-Party Services

Service	Purpose	Data shared
Supabase	Authentication, database, storage	Email, name, chat data (encrypted)
Anthropic (Claude API)	AI conversation processing	Chat messages only (no email/account data); not used for AI training
Zep	Conversation memory	Pseudonymized conversation summaries
RevenueCat	Subscription management	Anonymous user ID, purchase status
Sentry	Error tracking	Anonymous crash reports (no personal data)
Brevo	Transactional email	Email address (for auth emails only)

10. Data Retention

We store your personal data for as long as your account is active. Specifically:

Account data (email, name): Retained until you delete your account
Chat messages: Retained until you delete your account, at which point they are fully anonymized
Conversation memory: Deleted when you delete your account
Authentication tokens: Expire automatically and are refreshed as needed

When you delete your account, personal data is permanently removed within 30 days. Anonymized data (with no way to trace back to you) may be retained for service improvement.

11. Children's Privacy

Mindflex is intended for users aged 18 and older. We do not knowingly collect personal data from children under 18. If we learn we have collected data from a child under 18, we will delete it promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify users of material changes through the app or by email. The "Last updated" date at the top indicates when this policy was last modified.

13. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority. In Germany, this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI).

We encourage you to contact us first at hello@mindflex.world so we can address your concern directly.

14. Contact

Mindflex UG (haftungsbeschränkt)
Mariendorfer Damm 85
12109 Berlin, Germany

Email: hello@mindflex.world
Website: https://mindflex.world