Privacy Policy

1. Who is responsible for your data

MindSolutions, operator of mindsolutions.ai, is the data controller for the personal data described in this policy. For any privacy matter, contact privacy@mindsolutions.ai. This policy covers visitors to our website, people who start a journey with us, and people we contact through outreach.

2. What we collect

If you start a journey:

• Identity and contact details: name, email, and (optionally) phone number
• Your assessment answers — choices, slider values, and free-text responses
• Your reflections after each listening cycle
• Usage data: which modules you receive, listen counts and progress, timestamps, and the pages you visit on our site
• Messages you send us through the on-site chat or by email/SMS
• Payment data if you upgrade: handled by Stripe — we never see or store your card number, only the subscription status and billing history Stripe reports to us

If you only visit the website:

• Technical data: pages viewed, referrer/UTM parameters, approximate device type, and IP address (used transiently for security and rate limiting)

3. Wellbeing data — a special note

Your assessment answers and reflections can reveal information about your emotional life and wellbeing. Under the GDPR this may qualify as a special category of personal data. We process it only because you explicitly choose to share it with us for the purpose of generating your personal content (GDPR Art. 9(2)(a) — explicit consent), and only for that purpose. You can withdraw consent and have it deleted at any time (see Section 11). We never use it for advertising, never sell it, and never share it outside the small operating team and the processing strictly needed to run the service.

4. What we use your data for, and on what legal basis

• Generating your profile and audio modules — your explicit consent and the contract with you
• Sending access links, module notifications, and reminders — the contract with you
• Billing and receipts — the contract with you and our legal obligations (bookkeeping)
• Security, abuse prevention, and rate limiting — our legitimate interest in keeping the service safe
• Improving the platform — our legitimate interest, using aggregated or anonymised usage patterns only
• Marketing measurement (pixels) — only with your consent (Section 6)

5. AI processing — how your content is generated

Your profile and audio modules are generated by AI models that run on our own infrastructure — your answers and reflections are not sent to external AI companies for generation and are never used to train external AI models. The personalisation is automated, but it produces content only; we make no automated decisions about you that have legal or similarly significant effects. If our systems flag a message as a possible crisis, it is surfaced to a human on the operating team so we can respond with care.

One exception: if our self-hosted text-to-speech system is unavailable, the written script of your module (not your raw answers) may be converted to audio by a third-party speech provider acting as our processor.

6. Cookies, local storage & marketing pixels

Essential storage (always on): we use browser local storage to remember your session, your consent choice, and basic product state (e.g. what you have already seen). This is required for the service to function and involves no advertising.

Marketing pixels (only with your consent): if — and only if — you choose "Accept all" in the cookie banner, we load measurement pixels from Meta (Facebook/Instagram), Google, LinkedIn, and/or TikTok on our marketing pages. These let us measure whether our advertising works (e.g. that a signup or purchase happened) and may cause those platforms to set cookies and process your data as described in their own policies. With that same consent we may also send conversion events (e.g. "purchase") to these platforms server-side, keyed so duplicates are ignored. Your assessment answers and reflections are never shared with ad platforms.

If you choose "Essential only", no pixels load and no data is sent to ad platforms. You can change your mind at any time by clearing this site's data in your browser, which resets the consent banner.

7. Who we share data with

We do not sell personal data — to anyone, ever. We share data only with processors we need to operate, each bound by a data-processing agreement to act solely on our instructions:

• Email delivery providers, to send your access links, notifications, and our emails
• An SMS/messaging provider (Twilio), when you choose phone-based channels
• Stripe, for payment processing (Stripe is also an independent controller for its own compliance duties)
• A text-to-speech provider, only as the fallback described in Section 5
• Telegram, which we use internally for operational alerts (e.g. that a chat message arrived and needs a reply) — limited to what the alert needs
• Our hosting/infrastructure, on servers we control

Beyond processors: with the ad platforms listed in Section 6 only with your consent; with authorities where the law obliges us; and with a successor entity if the service is ever transferred, under this same policy.

8. International transfers

We are based in the EU and keep your core data (profile, answers, reflections, modules) on servers under our control. Some providers (e.g. Stripe, email delivery, Twilio, ad platforms you consent to) may process data in the United States or other countries outside the EEA. Where that happens, transfers rely on an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses, plus supplementary safeguards where appropriate.

9. How long we keep it

• Journey data (profile, answers, reflections, modules): for as long as your journey is active
• On deletion request: personal data and reflections removed within 30 days, except records we must keep by law (e.g. billing records, kept per bookkeeping law)
• Unsubscribe/opt-out records: kept indefinitely in minimal form (the address only), because we need them to honour your opt-out
• Technical logs: rotated on a short cycle and not used to profile you

10. If we contacted you and you never signed up

We sometimes reach out to people we believe may be interested in MindSolutions. In that case we hold your name, work contact details, and professional context, collected from publicly available sources or business contact databases, on the basis of our legitimate interest in direct marketing (GDPR Art. 6(1)(f)). Our emails may contain measurement so we know whether they were opened or a link was clicked, and links may lead to a page personalised with your name. You can object at any time — every email includes an unsubscribe link, and one email to privacy@mindsolutions.ai removes you permanently. Outreach data is kept separate from journey data and is never combined with anyone's assessment answers or reflections.

11. Your rights

Under the GDPR you can, at any time and free of charge:

• get a copy of the data we hold about you (access & portability)
• have inaccurate data corrected
• have your data deleted ("right to be forgotten")
• restrict or object to processing, including direct marketing (always honoured)
• withdraw any consent, without affecting processing that already happened

Email privacy@mindsolutions.ai and we will respond within 30 days. You also have the right to lodge a complaint with a supervisory authority — in Sweden, the Swedish Authority for Privacy Protection (IMY, imy.se), or the authority in your own country of residence.

12. Security

Your data is stored on encrypted disks behind authenticated access, on infrastructure we control. We do not use passwords — access is gated by private, randomly generated links sent only to your email and phone. Keep those links private; treat them like a password — anyone holding your link can view your content. If you believe a link has leaked, contact us and we will rotate it. No system is perfectly secure; if a breach ever puts your rights at risk, we will notify you and the supervisory authority as the GDPR requires.

13. Children

MindSolutions is for adults. We do not knowingly process data of anyone under 18; if we learn we hold such data, we delete it. Parents or guardians who believe a minor has used the service should contact us.

14. Changes to this policy

We may update this policy as the service evolves. Material changes will be announced by email or in-product notice before they take effect, and the version and effective date above always tell you what you are reading.

15. Contact

For privacy questions, data requests, or deletion: privacy@mindsolutions.ai.