Privacy policy

1. Introduction

This policy explains which personal data Mindlet processes, why, with which providers, for how long, and how to exercise your rights. It applies to the mindlet.app website, the app.mindlet.app web application and the Mindlet mobile applications for iOS and Android. The application is in French: its labels are quoted as they appear, with a translation.

Mindlet shows no advertising and sells no data.

2. Data controller

The data controller is SAS MINDLET.

• Registered office: Hameau de Cateraggio, Lot Rumana, Entrée Lot 1, 20270 Aléria, France
• Email: support@mindlet.app
• Full identity of the publisher: legal notice

3. Data collected

3.1 Your account

• To sign in: your email address, to which we send a sign-in code, or your Google account if you choose « Continuer avec Google » (Continue with Google). In that case, Google sends us your name, your email address and your profile photo. Mindlet does not ask you for a password.
• Without an account: if you choose « Essayer sans compte » (Try without an account), we create a guest account with no email address, which you can later turn into a full account.
• Your profile: the name, username, photo, banner and bio you choose to display. Your public profile is visible by default; you can make it private from the application. Other users can find you by your username or email address, in order to invite you.
• Your age: the month and year of birth you enter, used to apply the rules specific to minors (section 10). They are never shown on your profile.
• Your learning profile, if you fill it in: status, level, class or field of study, occupation, goal, context, generation language. It is used to adapt the generated content and your reviews.

3.2 Your content and your activity

• the documents, links, audio and video files you import, the notes you write and the decks you import from Anki;
• the collections, cards and materials generated from that content;
• your answers, your review history and your progress;
• your conversations with the Mindlet assistant;
• if you use features between members: your friends, followers and follows, your messages, your challenges;
• the card reports you send us.

3.3 Payment

On the web, payment is processed by Stripe: we neither receive nor store your bank details. On mobile, the purchase is collected by Apple or Google. We keep the status of your subscription and the transaction references.

3.4 Technical data

• the IP address and the type of device and browser, stored with your sign-in session;
• if you allow notifications, the technical identifier of your device with Apple or Google, needed to send them to you;
• the error reports described in section 9.

3.5 Voice

The microphone is used only for dictation and voice conversation, in both cases with your prior permission and never in the background.

Dictation. You press the dictation button to speak a message rather than type it. The microphone turns on at that moment and stops when you release it. The resulting text appears in the input field: you decide whether or not to send it.

Voice conversation. You press the call button to talk to the assistant. While the call is in progress, the microphone stays open and your voice is transmitted as you speak; the assistant answers you out loud and can open a screen of the application at your request. What you say goes directly to the assistant, with no validation step: it is a conversation. The button stops it at any time.

In both cases, the audio is transmitted to our provider Mistral AI, based in France, which converts it into text. For a call, the written transcript joins the history of your conversations with the assistant, in the same way as what you type to it.

The « Ne répondre qu’appelé par son nom » setting (Only answer when called by name). It is off by default. When it is on, the assistant only answers if you start your sentence with “Mindlet”. This setting only works during a call: there is no listening outside a call. During the call, everything said is still transcribed by Mistral AI; only the sentences that start with “Mindlet” are passed on to the assistant.

Call recording. By default, we do not keep the audio of your calls. If you turn on the « Garder l’enregistrement de mes appels » setting (Keep the recording of my calls; Réglages, « Voix de l’assistant »), we keep the audio of your calls, your voice and the assistant’s, so that you can listen to them again and download them. These recordings are automatically erased after 90 days, and you can delete them earlier at any time with the « Supprimer ces enregistrements » button (Delete these recordings). This setting is refused for accounts under 15, even if it is turned on.

We do not carry out any biometric analysis: your voice is never used to identify you.

You can withdraw permission to access the microphone at any time in your device settings. The rest of the application continues to work normally.

3.6 Cloned voice

If you wish, the application lets you create a synthetic voice from a short recording of your voice, so that the assistant reads its answers with it. This feature is optional and is never activated without action on your part: it requires a voluntary recording, a name given to the voice, and the box « C’est ma voix, ou j’ai le consentement explicite de la personne enregistrée. » (This is my voice, or I have the explicit consent of the person recorded) being ticked. Cloning a third party’s voice without their explicit consent is prohibited.

The sample is transmitted to our provider Mistral AI, based in France, which derives the voice model from it. We do not keep the recording: only the name you chose and the technical reference of the voice are stored on our side. The voice you create is offered only to you, never to other users.

You can delete a cloned voice at any time from the application settings. It is then deleted at our provider.

3.7 Newsletter

If you subscribe to the newsletter from the website, we keep your email address. The subscription only takes effect once you confirm it through the link we send you, and every mailing lets you unsubscribe.

4. Purposes and legal bases

We do not use your content to train artificial intelligence models.

5. Recipients and providers

5.1 Who sees your data within Mindlet

• the people with whom you choose to share a collection, and visitors to your public profile;
• if you join the space of an institution or organisation, its trainers and administrators see your progress on that space’s content;
• if a parent follows your account from « Famille et suivi » (Family and follow-up), what is shown there;
• public authorities, where the law requires it.

5.2 Our providers

They process your data on our behalf and according to our instructions.

When you import a YouTube link, we query YouTube (Google) to obtain the video’s information. To illustrate your cards, we query free image libraries (for example Wikimedia Commons, Openverse, Pexels or Pixabay) with a few words describing the subject: they receive neither your documents nor your identity.

6. Transfers outside the European Union

Some providers are established in the United States: Cloudflare, Resend, Google and, for the parent company, PostHog. When data is transferred outside the European Economic Area, the transfer relies on the European Commission’s adequacy decision on the EU-US Data Privacy Framework for certified providers, or on the European Commission’s standard contractual clauses. The safeguards specific to each provider are given in the table in section 5.2.

7. Retention periods

When you delete your account, your request takes effect at once: your sign-in sessions are closed, a subscription taken out on the web is cancelled without renewal, your profile and public content are removed from public areas, and emails and notifications stop. An email confirms the erasure date. For 30 days, you can cancel the deletion by signing in again.

At the end of those 30 days, all data linked to your account is erased automatically: data of your account and personal space, imported files and media, audio recordings of calls, search index, cloned voices at Mistral AI, customer record at Stripe, audience measurement data and replays linked to your account at PostHog, error reports, the assistant’s state.

Only the following remain:

• invoices, which the law requires us to keep for ten years (article L123-22 of the French Commercial Code);
• copies that other people have made of your public collections;
• without any link to your account: technical logs of AI usage and review scheduling, éclats consumption in a team space, card reports and store transaction identifiers (with no name or email address);
• the security log of administration actions;
• email delivery logs, at our email delivery provider, for the period it applies.

A subscription taken out on the App Store or Google Play is cancelled in the store concerned. The deletion procedure is described on the account deletion page.

8. Data security

Exchanges with Mindlet are encrypted in transit. Access to data is limited to what each feature needs, and a space’s data is only accessible to its members. We fix the vulnerabilities reported to us at support@mindlet.app.

9. Cookies and other trackers

9.1 On the mindlet.app website

The mindlet.app website sets no audience measurement, advertising or tracking cookie. No consent banner is shown to you, because there is nothing to consent to. Only your accessibility preferences are stored locally in your browser, so that they can be reapplied on your next visit: they are not sent to anyone and fall under storage strictly necessary for the service you asked for.

9.2 In the Mindlet application

The app.mindlet.app application and the mobile applications use PostHog, an audience measurement and usage analysis tool hosted in the European Union. It works on two levels, and you stay in control of both from Réglages → Confidentialité (Settings → Privacy).

We chose not to impose a consent banner on you. This is not a workaround: it is the counterpart of a default collection deliberately reduced to what does not require your consent.

Level 1, audience measurement (on by default). We record the pages viewed and the actions carried out in the application: what is used, what fails, what makes people abandon a flow. This measurement is cookieless: no information is written to or read from your device for this purpose. It is used only by Mindlet, is not combined with other processing and allows no tracking from one site to another. Since nothing is written to or read from your device, it does not require your consent under Article 82 of the French Data Protection Act; it relies on our legitimate interest in understanding how the service is used in order to improve it. You can object at any time by turning off the « Mesure d’audience » setting (Audience measurement): no usage data is sent any more. Your browser’s “Do Not Track” signal is also respected.

Level 2, detailed diagnostics (off by default). This level adds the automatic recording of your interactions and a session replay, that is, the reconstruction of your navigation in the interface. To do so, it stores an identifier in your browser or device. It goes well beyond audience measurement, so it is subject to your consent: it stays inactive until you turn on the « Diagnostic détaillé » setting (Detailed diagnostics). Turning it on is a positive act on your part; turning it off is done in the same place and just as easily. Refusing, or doing nothing, has no effect on your use of the service.

What stays masked even with diagnostics on. All input fields without exception (email addresses, answers to cards, searches), the content of your review cards and your messages. Payment information never passes through our servers.

Keeping your choice. Your settings are stored in your browser or device, and are not reset over time: an objection remains valid until you change it. This is more protective than the CNIL recommendation, which allows the question to be asked again after six months.

Error reporting. A technical error occurring in the application is reported to us (error message, screen concerned, application version). This processing is strictly necessary for the operation and security of the service, without which we could not fix what breaks. It contains neither the content of your documents nor your answers.

10. Minors

Mindlet is available from the age of 13. Below that age, an account can only be created and managed by a parent, from their own account. We ask for the month and year of birth in order to apply the following rules:

• under 13: features between members (friends, messages, challenges, publishing) are not available;
• between 13 and 15: these features remain closed until a holder of parental authority has given their consent, in accordance with article 45 of the French Data Protection Act (loi Informatique et Libertés);
• under 15: call recording is refused, even if the setting is turned on;
• minors: purchases are not possible.

Our commitments regarding the protection of minors are detailed on the child safety page.

11. Your rights

You have the following rights over your data:

• right of access and right to data portability;
• right to rectify inaccurate data;
• right to erasure;
• right to restriction of processing;
• right to object, in particular to audience measurement;
• right to withdraw your consent at any time;
• right to set instructions on what happens to your data after your death;
• right to lodge a complaint with the CNIL (the French data protection authority).

To obtain a copy of your data or exercise another right, write to support@mindlet.app. In the application, the Réglages → Confidentialité (Settings → Privacy) page also offers an « Écrire à support@mindlet.app » link (Write to support@mindlet.app) to request an export of your data. To delete your account and the associated data, see the account deletion page.

12. Links to other sites

The website and the application may contain links to sites we do not operate. Their privacy policy applies when you visit them.

13. Changes to the privacy policy

We may update this policy. The date of the last update appears at the top of this page. If a change is significant, we inform you more visibly, by email or in the application.

14. Contact

For any question about this policy:

• By email: support@mindlet.app
• By post: SAS MINDLET, Hameau de Cateraggio, Lot Rumana, Entrée Lot 1, 20270 Aléria, France