What this policy covers
This policy explains how the Mindation website handles personal information. It covers the pages you read, the launch-notification form, the contact form, the Focus check-in, and site analytics.
Mindation is the controller of the personal information described here. You can reach us about anything in this policy at hello@mindation.app or through the Contact page.
The Mindation mobile app is a separate product with its own data practices and its own policy. This policy does not cover it, and it does not cover other websites or platforms we link to.
You do not need an account to use this site, and we do not ask for information we do not need. Reading the Library requires nothing from you.
Information we collect
Email address, when you choose to give it
If you ask to be notified when the Mindation app launches, we collect the email address you enter and the fact that you submitted the form. Nothing else about you is required.
Contact messages
If you write to us through the contact form or by email, we receive what you choose to send: your message, the topic you select, and the contact details you provide so we can reply. Please do not send health details or other sensitive information you would not want stored in an ordinary inbox — we do not need it to answer you.
The Focus check-in
If you complete the Focus check-in and ask for your four-week plan, we collect your first name, your email address, a score for each of the five areas the check-in covers, an overall score, and the order your plan will follow. We keep the scores, not your individual answers: once the result is worked out, the answers themselves are not stored.
If you arrived from an ad, a social post or a link we sent you, we also store the campaign labels in that link and, where the link came from a Messenger or Instagram conversation, the identifier that conversation gave us. We use this to see which posts bring people here and to avoid asking you again in that conversation for something you have already done. It is kept with your check-in result and for no longer.
The check-in is a wellness exercise, not a psychological assessment or a clinical test. The result describes how you answered about the last two weeks, nothing more. We use it to build your plan and the emails that carry it; we do not use it to diagnose anything, and we do not sell it or share it for advertising.
Technical information
Like most websites, our hosting and security providers process standard request data needed to deliver and protect the site, such as IP address, browser and device type, referring page, and timestamps. This is used for delivery, security, and abuse prevention rather than to build a profile of you.
Analytics
With your consent where required, we use Google Analytics 4 to understand how the site is used in aggregate — which pages people read, how they arrive, and where something is not working. See Cookies and analytics below.
We do not knowingly collect special category data such as health, religious, or biometric information, and we do not ask you to tell us how you feel in order to use the site.
Why we use it, and on what legal basis
Where the GDPR or UK GDPR applies, we rely on the following legal bases:
- Consent — sending you the app launch notification and any later Mindation emails, sending the four-week plan you asked for at the end of the Focus check-in, and setting analytics cookies where consent is required. You can withdraw consent at any time; this does not affect processing that already happened.
- Legitimate interests — operating and securing the site, preventing abuse and spam, understanding aggregate usage so the content gets better, and replying when you contact us. We balance these interests against your rights and keep the data involved to a minimum.
- Legal obligation — keeping records or responding where the law requires it.
We do not use your information to make automated decisions that produce legal or similarly significant effects, and we do not profile you for advertising.
Service providers
We keep the number of providers small, and each one only processes what its service requires:
- Cloudflare — hosting, content delivery, protection against automated abuse, and storing our own copy of the email list.
- SendPulse — storing the email list, sending the launch notification, the four-week plan and later emails, and delivering contact form messages to our inbox.
- Google — analytics measurement, as described above.
These providers act on our instructions under contracts that require appropriate confidentiality and security. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not trade or rent it to anyone.
We may disclose information if the law requires it, to establish or defend legal claims, or to protect the safety and integrity of the site. If Mindation is ever transferred to another owner, personal information may transfer with it, and this policy would continue to apply until you are told otherwise.
International transfers
Our providers operate internationally, so your information may be processed outside your country, including in the United States.
Where information is transferred out of the European Economic Area or the United Kingdom, we rely on legally recognized safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an applicable adequacy decision, together with the provider's own certifications where these exist.
How long we keep information
- Email address — until you unsubscribe or ask us to delete it, and for a short period afterwards so we can honour the unsubscribe.
- Contact messages — normally up to 24 months after the conversation ends, unless a longer period is needed for a legal claim.
- Check-in results — until you ask us to delete them, and in any case no longer than 24 months after your four-week plan ends.
- Technical and security logs — a short period set by our hosting and security providers, typically measured in days or weeks.
- Analytics — aggregate reporting is retained according to the provider's configured retention window, after which event-level data expires.
When information is no longer needed for the purpose it was collected for, we delete it or keep it in aggregate form that cannot identify you.
Your rights and choices
Every marketing email includes an unsubscribe link, and unsubscribing takes effect without you needing to explain why.
Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to delete it, to restrict or object to certain processing, to receive it in a portable form, and to withdraw consent you previously gave. Residents of California and other US states with comparable laws may have rights to know, delete, correct, and opt out, and may use an authorized agent.
We do not sell or share personal information, so there is nothing to opt out of on that front. We honour recognized browser opt-out preference signals, including Global Privacy Control, as a request to limit analytics where it applies.
To exercise any right, write to hello@mindation.app or use the Contact page. We respond within the period the applicable law allows, and we will not treat you differently for exercising a right. If we cannot identify you from what we hold, we may need to ask for enough detail to locate your record — or, if we genuinely cannot, we will tell you that instead of collecting more information about you.
If you are in the European Economic Area or the United Kingdom and you are not satisfied with our response, you can complain to your local data protection authority.
Children
This site is intended for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 16.
If you believe a child has given us personal information, contact us and we will delete it.
Security
The site is served over HTTPS, forms are protected against automated abuse, and access to the email list is limited to the people who need it. Our providers are chosen partly for their own security practices.
No website or service can promise perfect security, and we do not claim to. What we can promise is that we collect as little as possible, so there is very little to lose.
Changes and contact
If our practices change — a new provider, a new purpose, or a change in what we collect — we will update this policy and change the date at the top of the page. Material changes will be explained, not slipped in.
Questions, requests, or complaints about privacy can be sent to hello@mindation.app or submitted through the Contact page.