Privacy Policy – MindBright

Note on this translation

This English version is provided for convenience only. In case of discrepancies, the German version shall prevail.

1. Privacy at a glance

General information

The following notes provide a simple overview of what happens to personal data when the web app "MindBright" is visited or used. Personal data is any data that can be used to personally identify an individual.

Data collection in the app

Who is responsible for data collection? Data processing is carried out by the app operator (Controller).

A data protection officer has not been appointed, as there is no legal obligation to do so.

How is data collected? Data is collected in two ways: firstly, data provided directly (e.g. during registration: email address, password; during onboarding: first name; or when creating personal entries). Secondly, data is recorded automatically by the IT systems when the app is used (e.g. technical data such as browser, operating system, IP address, login status).

What is the data used for? Some data is collected to ensure the error-free provision of the app (hosting, database, security). Other data is used to provide the app's features (storing entries, AI feedback, personalisation of communication) and — with consent — for information by email.

2. Hosting and infrastructure (data processing agreement)

External service providers are used to operate the app. The necessary data processing agreements (DPA) are concluded with service providers who process personal data on behalf of the operator. This ensures that data is only processed according to instructions and in compliance with the GDPR.

Application hosting (Render)

The application runs on the platform of Render Services, Inc. (USA), data centre region Frankfurt am Main, Germany. Data: Render processes technical metadata, log files and temporary data in order to execute the app's code. Third-country transfer: Processing takes place in Germany. Access by the US parent company cannot be excluded and is safeguarded by Standard Contractual Clauses (SCC) and certification under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (security and efficiency).

Database (Neon)

User data and entries are stored in a PostgreSQL database operated by Neon, Inc. (USA), data centre region Frankfurt am Main, Germany. Personal entries are stored there in encrypted form. Third-country transfer: Storage takes place in Germany. Access by the US parent company cannot be excluded and is safeguarded by Standard Contractual Clauses (SCC) and certification under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(b) GDPR.

Backups (Hetzner)

Encrypted backups of the database are stored with Hetzner Online GmbH (Gunzenhausen, Germany) in the Falkenstein data centre, Germany. Legal basis: Art. 6(1)(f) GDPR (data security).

Delivery and protection (Cloudflare)

Cloudflare, Inc. (USA) is used for DNS, content delivery and protection against attacks. Cloudflare processes connection data such as IP address and requested URL. Third-country transfer: possible, safeguarded by Standard Contractual Clauses (SCC). Legal basis: Art. 6(1)(f) GDPR (security and availability).

Sign in with Google

For the optional login with Google, the sign-in service of Google Ireland Limited (Ireland) is used. Data & purpose: When signing in with Google, a redirect to Google takes place; after consent there, the email address and name are received from Google in order to create or match the user account. Journal content is never transmitted to Google. Third-country transfer: Google may transfer data to servers in the USA. This is safeguarded by Standard Contractual Clauses (SCC). Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

3. Data subject rights

The following rights exist with regard to personal data at any time:

• Right of access (Art. 15 GDPR): Information about stored data can be requested at any time.
• Right to rectification (Art. 16 GDPR): Correction of incorrect data can be requested.
• Right to erasure (Art. 17 GDPR): The account and all data can be deleted at any time directly in the profile settings of the app or by contacting the operator.
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR): Data that is processed automatically can be received or transferred to a third party.
• Right to withdraw consent (Art. 7(3) GDPR): Any consent given can be withdrawn at any time.
• Right to object (Art. 21 GDPR): Objection to the processing of data (in particular logs for security purposes) is possible insofar as this processing is carried out on the basis of Art. 6(1)(f) GDPR.
• Right to lodge a complaint with a supervisory authority.

4. Data collection when using the app

Registration and login

To use MindBright, registration is required. The data entered during registration (email address, password) is used exclusively to provide the service. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Social Login: When signing in via Google or Apple, authentication data is received from these providers (e.g. an ID, email address, and possibly a name). This data is stored to create the account.

Personalisation (first name / nickname)

A first name or nickname can be provided voluntarily. Purpose: Personal form of address within the app. Legal basis: Art. 6(1)(a) GDPR (Consent). The name can be changed or deleted at any time.

Personal entries and sensitive data (Art. 9 GDPR)

The core function of the app is writing journal entries. It is entirely possible to enter information that falls under "special categories of personal data" (e.g. health data, political opinions, etc.). Voluntariness: Entering such sensitive data is not required to use the app (neutral topics can also be written about). Legal basis: When such data is entered and saved, it is processed exclusively to provide the app's features (storage, display, AI feedback). By entering it voluntarily, consent to processing for this purpose is given (Art. 9(2)(a) GDPR). Confidentiality: This content is not manually accessed during regular operation.

Log files and cookies

The app uses technically necessary cookies or the local storage of the browser to save login status. Analytics cookies are set on the website only after consent (see section 9). Advertising cookies are not used. Logs: The servers automatically collect information in log files (e.g. IP address, browser, timestamp). Purpose: Detection and prevention of misuse and error analysis. Retention period: Logs are stored for a maximum of 14 days and then deleted. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security).

5. Use of AI services

AI services from external providers are used to generate feedback, impulses and analyses for entries and to provide voice features. Providers: Anthropic Ireland, Limited (Dublin, Ireland) for feedback, impulses and analyses; OpenAI Ireland Limited (Dublin, Ireland) for converting speech to text (dictation) and text to speech (read-aloud). Data transfer: When an entry is saved, its text is transmitted to Anthropic. When dictation is used, the voice recording is transmitted to OpenAI; when the read-aloud feature is used, the text to be read (for example feedback or MindLights) is transmitted. Purpose: Provision of the respective feature. Training: According to both providers, content submitted via the API is not used to train the models. Third-country transfer: Processing in the USA is possible and is safeguarded by Standard Contractual Clauses (SCC) and certification under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(b) GDPR (performance of a contract); for sensitive content Art. 9(2)(a) GDPR (consent through voluntary input).

6. Newsletter and marketing emails

Distinction

A distinction is made between system emails (necessary for the app, e.g. password reset) and marketing emails (tips, updates).

Marketing data & Brevo

When subscribing to the newsletter/updates ("opt-in"), the email address and first name are used for sending. Service provider: Sending is handled via Brevo (Sendinblue GmbH, Berlin, Germany). Data is stored on servers in Germany. Legal basis: Art. 6(1)(a) GDPR (Consent). Data transfer: Contact data is only transferred to Brevo when sending is active and an opt-in exists. As long as no sending takes place, the data remains exclusively in the operator's system. Withdrawal: Consent can be withdrawn at any time in the account settings ("Email Updates") or via the unsubscribe link in any email.

Free email course "5 Days of Clarity Under Pressure"

Only an email address is required to participate in the free email course. Registration follows a double opt-in procedure: after signing up, a confirmation email is sent and the course begins only after the link in that email has been confirmed. The data stored includes the email address, the times of registration and confirmation, course progress, the page through which registration took place, and any campaign parameters from the link used. The data is stored in the app database (Neon, data centre region Frankfurt am Main, Germany). The five course emails are sent via Brevo (Sendinblue GmbH, Berlin, Germany). Brevo may technically record whether an email was delivered, opened, or a link in it was clicked. The course emails contain no third-party advertising. Legal basis: Art. 6(1)(a) GDPR (Consent). Withdrawal: Consent can be withdrawn at any time with effect for the future via the unsubscribe link in any course email. If additional consent is given during registration to receive occasional further content from MindBright, the preceding section on marketing emails applies.

When email notifications are activated, reminders and updates about MindLights and MindPrint are sent by email; this can be stopped at any time in the account settings or via the unsubscribe link.

7. Retention periods

Data is stored only for as long as necessary for the purposes described:

• Account data & entries: Until deletion of the account (in settings) or by the operator.
• Hosting system logs: Max. 14 days. Technical event log of the application (without content from entries): Max. 90 days.
• Email course: Unconfirmed registrations are deleted after 30 days; all other course data is deleted 90 days after course completion or unsubscription. The record of consent is retained under the rule above.
• Consent records: Retained for evidence purposes (Art. 7(1) GDPR) until expiry of limitation periods (typically 3 years).

8. Use of the iOS app

In addition to use in the browser, MindBright is available as an app for iPhone. All sections of this privacy policy apply to the iOS app. The following applies in addition.

Obtaining the app

The app is obtained via the App Store or TestFlight from Apple. The provider for users in the European Union is Apple Distribution International Limited (Ireland). When the app is downloaded and updated, Apple processes data under its own responsibility, such as the Apple account and device data. The operator does not receive account data from Apple, only aggregated information on installations and crashes where sharing of such information has been enabled on the device.

Sign in with Apple

For the optional login with Apple, the sign-in service provided by Apple is used. Apple transmits an identifier of the Apple account, an email address (optionally a relay address provided by Apple) and, where applicable, the name. This data is used to create or assign the user account. Content from entries is not transmitted to Apple. Legal basis: Art. 6(1)(b) GDPR.

Notifications (push notifications)

Notifications are sent only if they have been allowed on the device. In that case, a device identifier assigned by Apple is stored and assigned to the user account. Delivery takes place via the Apple Push Notification service of Apple Inc. (USA). The device identifier and the title and text of the notification are transmitted to Apple. Notifications contain no content from entries, only general prompts, for example about an open daily question or a new MindLight. Users who receive notifications do not receive reminders by email. Legal basis: Art. 6(1)(a) GDPR (consent). Withdrawal: notifications can be switched off at any time in the account settings of the app or in the iOS settings; the device identifier is then no longer used. Third-country transfer: processing in the USA is possible and is safeguarded by Standard Contractual Clauses (SCCs).

App lock with Face ID or Touch ID

The app can optionally be locked with Face ID or Touch ID. The check is performed exclusively on the device by iOS. The operator neither receives nor stores biometric data; the app only learns whether the check was successful. The lock setting is stored on the device only.

Microphone

The microphone is accessed only after permission has been granted on the device and only during a voice recording for dictation. The recording is processed for conversion into text as described in section 5 and is not stored after conversion.

Consent to processing by AI services

Before the iOS app is used for the first time, explicit consent to the processing by AI services described in section 5 is obtained. The time and version of the consent are stored for evidence purposes. The app cannot be used without this consent. Consent can be withdrawn at any time by notifying the operator or by deleting the account.

No web analytics in the iOS app

No third-party analytics or advertising services are used in the iOS app.

9. Consent management and web analytics on the website

Consent management (CookieYes)

The website mindbright.one uses a consent management service (CookieYes Limited, United Kingdom). The service displays the consent banner and stores the decision made in a cookie so that it is respected on subsequent visits. Technical connection data such as the IP address is processed in the process. Legal basis: Art. 6(1)(c) and (f) GDPR (evidence and management of consent). An adequacy decision of the European Commission exists for the United Kingdom.

Google Tag Manager

The consent banner is integrated via Google Tag Manager provided by Google Ireland Limited (Ireland). Tag Manager itself does not set analytics cookies; when it is retrieved, technical connection data such as the IP address is transmitted to Google. Legal basis: Art. 6(1)(f) GDPR (provision of consent management).

Google Analytics 4

Google Analytics 4 provided by Google Ireland Limited (Ireland) is used to evaluate use of the website, but only after explicit consent to the analytics category in the consent banner. Without this consent, Google Analytics is not loaded. Data: with consent, cookies are set and information on use of the website is processed, such as pages visited, time spent, approximate location, device and browser data and a pseudonymous identifier. Content from entries is not transmitted to Google Analytics. Retention: according to the periods configured in Google Analytics, at most 14 months. Third-country transfer: processing in the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework, and Standard Contractual Clauses (SCCs) apply in addition. Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent). Withdrawal: consent can be withdrawn at any time with effect for the future via the cookie settings of the website.

In the iOS app, neither the consent banner nor Google Tag Manager or Google Analytics is loaded.