Last updated: May 31, 2026
The controller responsible for data processing is:
Mindflex UG (haftungsbeschränkt)
Mariendorfer Damm 85
12109 Berlin, Germany
Commercial Register: Amtsgericht Berlin-Charlottenburg, HRB 276989 B
VAT ID: DE456508601
Email: hello@mindflex.world
Website: https://mindflex.world
Managing Directors: Felix Mai, Moritz Tiedemann, Julian Hecht
We have appointed an external Data Protection Officer:
heyData GmbH
Schützenstraße 5
10117 Berlin, Germany
Email: datenschutz@heydata.eu
We process personal data when you:
Personal data means any information that can identify you directly or indirectly.
| Data | Purpose | Stored where |
|---|---|---|
| Email address | Authentication & account management | Supabase (US-East-1) |
| Display name | Personalization within the app | Supabase |
| Chat messages | Conversation continuity | Supabase (AES-256 encrypted at rest) |
| Device token | Push notifications (if enabled) | Supabase |
| Timezone / City | Reminder scheduling | Supabase |
| App events + device advertising identifier (only if you consent) | Measuring which ads bring people to Mindflex | Shared with TikTok and Meta (Facebook/Instagram), see Section 9a |
What you write in the chat or say in a call can contain personal information, for example about how you are doing. Such information belongs to the special categories of personal data under Art. 9 GDPR and is specially protected.
Legal basis: we process this information only on the basis of your explicit consent (Art. 9(2)(a) GDPR in conjunction with Art. 6(1)(a) GDPR). We ask for this consent before you use the chat or a call for the first time.
Purpose: we process this information only to reply to you in the chat and in calls, to continue your conversation, and to offer you guidance adapted to you. We do not use it for advertising, do not sell it, and do not share it with advertising partners.
Withdrawal: you can withdraw your consent at any time with effect for the future, in the app settings or by email to hello@mindflex.world. The lawfulness of processing carried out before the withdrawal remains unaffected.
Consequence of withdrawal: without this consent we cannot offer chat and calls, because we cannot prevent you from sharing such information there. Chat and calls can then no longer be used. Your previous conversation data is deleted or anonymized as described in this policy.
When you sign in with Google, we receive:
Google user data is used exclusively to provide and improve your Mindflex experience:
We do not:
Google user data is only shared with the following service providers, strictly to operate the app:
Your Google user data is retained for as long as your account is active. You can delete your account at any time via Settings → Delete Account in the app. Upon deletion:
If you enable “Apple Watch check-ins” in Settings and grant permission, Mindflex reads the following data from Apple Health (typically measured by your Apple Watch): heart rate, heart-rate variability, resting heart rate, and step count.
Purpose: this data is used ONLY to recognise, on your device, possible signs of stress (and to tell stress apart from exercise), so that your chosen companion can send you a gentle check-in notification. We do not analyse this data any further, and we do not build a profile of you from it.
On-device only: this processing happens entirely on your device. Your Apple Health data is never transmitted to our servers, never stored by us, and never shared with any third party. We do not use it for advertising, marketing, or profiling.
Your control: the feature is off by default. You can switch it off at any time in Settings, and you can revoke Mindflex’s access in iOS Settings → Privacy & Security → Health → Mindflex.
Legal basis: Art. 9(2)(a) GDPR, your explicit consent for the processing of this data (special categories of personal data, Art. 9 GDPR). You may withdraw this consent at any time, with effect for the future.
We process personal data based on the following legal grounds:
You have the right to:
To exercise your rights, contact: hello@mindflex.world
| Service | Purpose | Data shared |
|---|---|---|
| Supabase | Authentication, database, storage | Email, name, chat data (encrypted) |
| Google (Gemini API) | AI replies in chat and calls | Chat messages and call audio (no email/account data) |
| Anthropic (Claude API) | Summaries, and replies when Google is unavailable | Chat messages only (no email/account data); not used for AI training |
| RevenueCat | Subscription management | Anonymous user ID, purchase status |
| Sentry | Error tracking | Anonymous crash reports (no personal data) |
| Brevo | Transactional email | Email address (for auth emails only) |
| TikTok (TikTok Business SDK) | Advertising measurement / attribution — only with your consent | App events (install, trial start, purchase) and your device advertising identifier. Never your conversations, your answers, or any sensitive data. |
| Meta Platforms (Meta Pixel, web app at mindflex.world/app) | Advertising measurement for Facebook and Instagram ads — in the EU only with your consent | Four steps: that you opened the page, that you started, that you sent your first message (once, without its content), and whether you opened the subscription page, plus Meta cookies (_fbp, _fbc). Never your conversations, your answers, or any sensitive data. |
| Meta Platforms (Facebook SDK for iOS/Android) | Advertising measurement / attribution for Facebook and Instagram ads — only with your consent | App events (install, trial start, purchase) and your device advertising identifier. Never your conversations, your answers, or any sensitive data. |
Mindflex is funded in part through advertising on TikTok and on Meta’s platforms (Facebook and Instagram). To understand which ads actually help people find Mindflex, we can share a small set of non-sensitive app events with TikTok through the TikTok Business SDK and with Meta through the Facebook SDK.
What is shared (only if you consent): basic app events such as install, trial start, and purchase, together with your device’s advertising identifier (IDFA on iOS).
What is never shared: your conversations, your questionnaire answers, anything about how you are feeling, and any sensitive data. This advertising measurement never touches the content you share with your companion.
It is your choice: before onboarding we ask for your consent on a dedicated screen with equally weighted “Accept” and “Decline” options. Mindflex works exactly the same whether you accept or decline. If you decline, the advertising SDK is not activated and your advertising identifier is never accessed. On iOS you will also see Apple’s App Tracking Transparency prompt only if you accept.
Withdraw anytime: you can turn ad measurement off (or back on) at any time under Settings → Ad measurement in the app, separately for TikTok and for Facebook, and on iOS under Settings → Privacy & Security → Tracking.
Legal basis: Art. 6(1)(a) GDPR and § 25 TDDDG — your consent. You may withdraw it at any time with effect for the future.
Web app (mindflex.world/app): in the browser we use the Meta Pixel instead of an SDK. It sets Meta cookies and shares only four steps with Meta: that you opened the page, that you started, that you sent your first message (once, never its content), and whether you opened the subscription page. In the EU we ask first, and the pixel only loads if you agree. Outside the EU the pixel loads when you open the web app (page view only); the first-message step is only shared if you tap “Continue” in the consent window, and you can choose “Continue without ad measurement” instead, which keeps the chat free and stops the pixel for this browser. You can withdraw at any time by deleting the site data for mindflex.world in your browser or by writing to hello@mindflex.world.
We store your personal data for as long as your account is active. Specifically:
When you delete your account, personal data is permanently removed within 30 days. Anonymized data (with no way to trace back to you) may be retained for service improvement.
Mindflex is intended for users aged 18 and older. We do not knowingly collect personal data from children under 18. If we learn we have collected data from a child under 18, we will delete it promptly.
We may update this Privacy Policy from time to time. We will notify users of material changes through the app or by email. The "Last updated" date at the top indicates when this policy was last modified.
If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority. In Germany, this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI).
We encourage you to contact us first at hello@mindflex.world so we can address your concern directly.
Mindflex UG (haftungsbeschränkt)
Mariendorfer Damm 85
12109 Berlin, Germany
Email: hello@mindflex.world
Website: https://mindflex.world