Your data
Your data and GDPR: what we keep, where, and why.
The readable version of our privacy policy: what's collected, who processes it, how long we keep it, and how to take back control.
- No trackers on this site
- No advertising
- Delete your account online
GDPR in plain words
The General Data Protection Regulation (Regulation (EU) 2016/679) has applied since May 2018 to any organisation processing personal data of people in the European Union. It requires saying what is collected, why, for how long and by whom, and it gives you rights to stay in control.
This page is the short version. The reference text, the one that binds us, is our privacy policy. If in doubt, it prevails.
What we collect
What data does Mindlet collect?
What the app needs to work, and nothing for advertising.
-
Your account
Email address, username, month and year of birth (to apply the age rules). You sign in with a code sent by email or with your Google account.
-
Your content
The documents you import, your collections, cards and notes, and your conversations with the assistant.
-
Your learning
Your answers, progress, statistics and settings: accessibility, reminders, learning profile.
-
Social features, if you use them
Friends, messages and challenges. These stay closed to under-13s, and to 13 to 15-year-olds without parental consent.
-
Your voice, if you use it
For dictation or voice conversation, the sound goes to Mistral AI to be turned into text; by default, the audio isn't kept. No biometric analysis.
-
How the app is used
Cookieless usage analytics that you can switch off, and technical error reports, without your documents' content or your answers.
Payments go through Stripe on the web, and Apple or Google on mobile. Your card details never pass through our servers.
What is it used for?
| What we do | What you can do |
|---|---|
| Run the service: your account, generating your cards, scheduling your reviews, syncing between your devices. | Edit or delete content, or delete your account. |
| Measure app usage: which pages, which actions, what fails. | Switch off « Mesure d'audience » (usage analytics) in Réglages → Confidentialité (Settings → Privacy). |
| Detailed diagnostics, with session replay, to understand a problem. | Nothing to do: it stays off unless you turn it on. |
| Write to you: sign-in codes, security, billing, weekly summary. | Set your emails and reminders in Réglages → Notifications. |
| Meet our obligations: billing, security, reports when required by the authorities. | This data is kept for the periods set by law (see below). |
Where your data goes
Where is the data hosted, and by whom?
The providers that store or process your data, as declared in our legal notice.
| Provider | Role | Location |
|---|---|---|
| Cloudflare | Hosting the site and the app, database, imported files and media | American company, global network; transfers covered by the Data Privacy Framework and standard contractual clauses |
| Mistral AI | AI models: reading content, generating study material, transcription | France |
| Qdrant | Search index of your imported content | European Union (Frankfurt) |
| Stripe | Payment for subscriptions bought on the web | European Union (Ireland) |
| Resend | Sending emails (sign-in, security, billing) | United States, under standard contractual clauses and the EU-US Data Privacy Framework |
| PostHog | App usage analytics | European instance (Frankfurt) |
On mobile, subscriptions are collected by Apple and Google. The models that generate images are detailed on our AI page. We sell no data and there is no advertising in the app.
Analytics
What we measure, and how to switch it off.
On this website, nothing. mindlet.app sets no analytics, advertising or tracking cookies: that's why no banner asks for your consent. Only your accessibility preferences are kept in your browser, and they're sent to no one.
In the app, we use PostHog, hosted in the European Union, at two levels. Usage analytics, cookieless, are on by default and serve Mindlet only. Detailed diagnostics, which reconstruct your navigation to understand a problem, are off by default and only turn on with your consent.
Even with diagnostics on, every input field, the content of your cards and your private messages stay masked. Usage data is kept for 25 months at most, and your choice is never reset over time.
Minors
Children's data
Mindlet is open from age 13. Below that, an account can only be created and managed by a parent, from their own account. Between 13 and 15, learning is fully available, but features between members (friends, messages, challenges, publishing) stay closed until a parent agrees, as French data protection law requires (article 45 of the loi Informatique et Libertés). Purchases are for adults only.
Shared content is moderated by automated tools and by people. Worrying content or behaviour can be reported to safety@mindlet.app; our commitments are set out on the child safety page.
Child safety
Schools
Schools: subprocessors and student data
In a school space, the display rule is simple: whatever the teacher sees, the student can see too. Accessibility profiles are offered to students, never imposed.
In the pilot program, the data stays with the institution, which can export it at any time. Mindlet keeps nothing that identifies students by name: the table matching students to identifiers stays with the school. No health data is collected.
To formalise how your institution's data is processed, or for any question from your data protection officer, write to us: our list of subprocessors is the one on this page.
The pilot program
Your rights
Your GDPR rights, and how to use them.
-
Access and export
Find out what we hold about you and get a copy. In the app: Réglages → Confidentialité, « Export de tes données » (export your data).
-
Rectify
Correct inaccurate information, from your settings or by writing to us.
-
Erase
Delete a piece of content, or your whole account, directly in the app.
-
Object, withdraw consent
Switch off analytics, decline detailed diagnostics, delete a cloned voice.
-
Restrict processing
Ask for the use of some data to be paused while it's being checked.
-
Complain to a regulator
If our answer doesn't satisfy you, you can complain to the CNIL, France's data protection authority, or to the authority in your country.
For any request, write to support@mindlet.app from your account's email address. The GDPR gives us one month to reply.
Deletion
Deleting your account and content
Deleting from the app is immediate and permanent.
-
Open your account
In Mindlet, open Réglages → Compte et sécurité (Settings → Account and security).
-
Danger zone
Scroll down to « Zone de danger » and tap « Supprimer mon compte » (delete my account).
-
Confirm
Type the word SUPPRIMER. Your account and content are erased.
- Lost access to your account? Write to us from the associated email address: we handle the request within 30 days.
- Some data stays for a while, for legal reasons: security logs for 90 days, billing records for 10 years (an accounting obligation). Aggregated statistics that can no longer identify you may be kept.
- A subscription taken on the App Store or Google Play doesn't stop with the account: cancel it with Apple or Google first.
FAQ
Frequently asked questions
Is Mindlet GDPR compliant?
Mindlet is a French company subject to the GDPR, and we apply it: every piece of data has a purpose, every provider is named with its country, analytics are cookieless and can be switched off, you exercise your rights by email and you can delete your account online. We don't claim any label; the details are in our privacy policy.
Can others see my notes?
No, unless you share them. Your documents and collections are private by default. They're only shown to people you choose to share them with, or to everyone if you publish a collection in the community catalogue. In a school space, the teacher sees their class's progress.
How do I delete my Mindlet account?
In the app, open Réglages → Compte et sécurité (Settings → Account and security), then « Zone de danger » and « Supprimer mon compte ». Type SUPPRIMER to confirm: deletion is immediate and permanent. If you can't sign in, write to support@mindlet.app from the associated address.
Does Mindlet sell data?
No. Mindlet sells no data and there is no advertising in the app. Your data is used to run the service, and our providers process it on our behalf, for this service only. The mindlet.app website sets no trackers at all.
Can a school get a data processing agreement?
Write to us to discuss it: we work out with each institution, and its data protection officer, how to formalise the processing. Our list of subprocessors, with their role and country, is public, on this page and in our legal notice.
Does the mindlet.app website use cookies?
No. The website sets no analytics, advertising or tracking cookies, so it asks for no consent. Only your accessibility preferences are kept in your browser. The app itself uses cookieless usage analytics, which you can switch off in your settings.
Keep reading
Your courses, under your control.
Try Mindlet for free. You can export or delete everything whenever you like.
Free to start, no credit card · Web, iPhone, iPad and Android
