Your data
Your data and GDPR: what we keep, where, and why.
The readable version of our privacy policy: what's collected, who processes it, how long we keep it, and how to take back control.
- No trackers on this site
- No advertising
- Delete your account online
GDPR in plain words
The General Data Protection Regulation (Regulation (EU) 2016/679) has applied since May 2018 to any organisation processing personal data of people in the European Union. It requires saying what is collected, why, for how long and by whom, and it gives you rights to stay in control.
This page is the short version. The reference text, the one that binds us, is our privacy policy. If in doubt, it prevails.
What we collect
What data does Mindlet collect?
What the app needs to work, and nothing for advertising.
-
Your account
Email address, username, month and year of birth (to apply the age rules). You sign in with a code sent by email or with your Google account.
-
Your content
The documents you import, your collections, cards and notes, and your conversations with the assistant.
-
Your learning
Your answers, progress, statistics and settings: accessibility, reminders, learning profile.
-
Social features, if you use them
Friends, messages and challenges. These stay closed to under-13s, and to 13 to 15-year-olds without parental consent.
-
Your voice, if you use it
For dictation or voice conversation, the sound goes to Mistral AI to be turned into text; by default, the audio isn't kept. No biometric analysis.
-
How the app is used
Cookieless usage analytics that you can switch off, and technical error reports, without your documents' content or your answers.
Payments go through Stripe on the web, and Apple or Google on mobile. Your card details never pass through our servers.
What is it used for?
| What we do | What you can do |
|---|---|
| Run the service: your account, generating your cards, scheduling your reviews, syncing between your devices. | Edit or delete content, or delete your account. |
| Measure app usage: which pages, which actions, what fails. | Switch off « Mesure d'audience » (usage analytics) in Réglages → Confidentialité (Settings → Privacy). |
| Detailed diagnostics, with session replay, to understand a problem. | Nothing to do: it stays off unless you turn it on. |
| Write to you: sign-in codes, security, billing, weekly summary. | Set your emails and reminders in Réglages → Notifications. |
| Meet our obligations: billing, security, reports when required by the authorities. | This data is kept for the periods set by law (see below). |
Where your data goes
Where is the data hosted, and by whom?
The providers that store or process your data, as declared in our legal notice.
| Provider | Role | Location |
|---|---|---|
| Cloudflare | Hosting the site and the app, database, imported files and media | American company, global network; transfers covered by the Data Privacy Framework and standard contractual clauses |
| Mistral AI | AI models: reading content, generating study material, transcription | France |
| Qdrant | Search index of your imported content | European Union (Frankfurt) |
| Stripe | Payment for subscriptions bought on the web | European Union (Ireland) |
| Resend | Sending emails (sign-in, security, billing) | United States, under standard contractual clauses and the EU-US Data Privacy Framework |
| PostHog | App usage analytics | European instance (Frankfurt) |
On mobile, subscriptions are collected by Apple and Google. The models that generate images are detailed on our AI page. We sell no data and there is no advertising in the app.
Analytics
What we measure, and how to switch it off.
On this website, nothing. mindlet.app sets no analytics, advertising or tracking cookies: that's why no banner asks for your consent. Only your accessibility preferences are kept in your browser, and they're sent to no one.
In the app, we use PostHog, hosted in the European Union, at two levels. Usage analytics, cookieless, are on by default and serve Mindlet only. Detailed diagnostics, which reconstruct your navigation to understand a problem, are off by default and only turn on with your consent.
Even with diagnostics on, every input field, the content of your cards and your private messages stay masked. Usage data is tied to a technical identifier, without your name or email address, kept for up to 7 years at PostHog and erased with your account. Your choice is never reset over time.
Minors
Children's data
Mindlet is open from age 13. Below that, an account can only be created and managed by a parent, from their own account. Between 13 and 15, learning is fully available, but features between members (friends, messages, challenges, publishing) stay closed until a parent agrees, as French data protection law requires (article 45 of the loi Informatique et Libertés). Purchases are for adults only.
Shared content is moderated by automated tools and by people. Worrying content or behaviour can be reported to safety@mindlet.app; our commitments are set out on the child safety page.
Child safety
Organisations
Organisations: data processing and learner data
Within the space of a school, a training provider or a company, the organisation is the controller of how it follows its learners and Mindlet acts on its behalf, as a processor. Our data processing agreement is published and applies as soon as the space is created.
Depending on the organisation's setting, a trainer sees the learners in their own groups or all of the organisation's learners. Each time they open a learner's record, the learner can read it in a log. Surveys are anonymous by default and show no result below three answers, and the details of how materials are read are erased after 90 days. Accessibility profiles are suggested, never imposed, and a trainer only sees a learner's reading comfort if the learner agrees to share it. Thirty days after a learner leaves, the organisation keeps nothing about them.
Mindlet provides no field for a diagnosis or a medical condition. For any question from your data protection officer, or to get our impact assessment template, write to us.
The data processing agreement
Your rights
Your GDPR rights, and how to use them.
-
Access and export
Find out what we hold about you and get a copy. In the app: Réglages → Confidentialité, « Export de tes données » (export your data).
-
Rectify
Correct inaccurate information, from your settings or by writing to us.
-
Erase
Delete a piece of content, or your whole account, directly in the app.
-
Object, withdraw consent
Switch off analytics, decline detailed diagnostics, delete a cloned voice.
-
Restrict processing
Ask for the use of some data to be paused while it's being checked.
-
Complain to a regulator
If our answer doesn't satisfy you, you can complain to the CNIL, France's data protection authority, or to the authority in your country.
For any request, write to support@mindlet.app from your account's email address. The GDPR gives us one month to reply.
Deletion
Deleting your account and content
Your request takes effect at once, and erasure happens 30 days later: until then, you can change your mind.
-
Open your account
In Mindlet, open Réglages → Compte et sécurité (Settings → Account and security).
-
Danger zone
Scroll down to « Zone de danger » and tap « Supprimer mon compte » (delete my account).
-
Confirm
Type the word SUPPRIMER. Your sessions are closed and an email gives you the erasure date. To cancel, sign in again before that date.
- Lost access to your account? Write to us from the associated email address: we handle the request within 30 days.
- Only invoices remain, for 10 years (an accounting obligation), along with the security log of administrative actions and technical logs not linked to your account. The details are in the privacy policy.
- A subscription taken on the App Store or Google Play doesn't stop with the account: cancel it with Apple or Google first.
FAQ
Frequently asked questions
Is Mindlet GDPR compliant?
Mindlet is a French company subject to the GDPR, and we apply it: every piece of data has a purpose, every provider is named with its country, analytics are cookieless and can be switched off, you exercise your rights by email and you can delete your account online. We don't claim any label; the details are in our privacy policy.
Can others see my notes?
No, unless you share them. Your documents and collections are private by default. They're only shown to people you choose to share them with, or to everyone if you publish a collection in the community catalogue. Within an organisation's space, your trainers see your progress on that space's content, and how far you have read its materials.
How do I delete my Mindlet account?
In the app, open Réglages → Compte et sécurité (Settings → Account and security), then « Zone de danger » and « Supprimer mon compte ». Type SUPPRIMER to confirm: your account is erased 30 days later, and you can cancel until then by signing in again. If you can't sign in, write to support@mindlet.app from the associated address.
Does Mindlet sell data?
No. Mindlet sells no data and there is no advertising in the app. Your data is used to run the service, and our providers process it on our behalf, for this service only. The mindlet.app website sets no trackers at all.
Can an organisation get a data processing agreement?
Yes, it is published: our data processing agreement, required by Article 28 of the GDPR, applies to any school, training provider or company that opens a space. It names our sub-processors, with their role and country. For a question from your data protection officer, write to support@mindlet.app.
Does the mindlet.app website use cookies?
No. The website sets no analytics, advertising or tracking cookies, so it asks for no consent. Only your accessibility preferences are kept in your browser. The app itself uses cookieless usage analytics, which you can switch off in your settings.
Keep reading
Your courses, under your control.
Try Mindlet for free. You can export or delete everything whenever you like.
Free to start, no credit card · Web, iPhone, iPad and Android
