Privacy Policy

1. Information About the Data Controller

Mindova is a mobile application for AI-based life coaching. Personal data is processed by:

Ahmet Yildirim
Ludwigsburger Straße 109
70435 Stuttgart, Germany
Email: info@mindova.de

2. Legal Basis for Data Processing

We process personal data on the following legal grounds under Article 6 GDPR:

• Consent (Art. 6(1)(a)): Your explicit consent for app functionality, analytics, and personality analysis
• Contract (Art. 6(1)(b)): Performance of contractual obligations for coaching services
• Legal Obligation (Art. 6(1)(c)): Compliance with legal obligations
• Protection of Vital Interests (Art. 6(1)(d)): Protection of vital interests in crisis or safety situations
• Legitimate Interests (Art. 6(1)(f)): Service improvement, security, and fraud prevention

Special Data Categories (Art. 9 GDPR): Mood and emotional data are processed as health-related data with your explicit consent and for crisis safety purposes only.

3. Data We Collect and Why

Account Information: For user authentication and account management, we collect email addresses (registered users only) and encrypted passwords. Anonymous users can use the app without providing email, with all data stored locally on their device only.

Coaching Data: During use of our coaching features, we store session records, user profiles, and progress data. This data is used to provide coaching services and improve your experience. Local data is stored on your device, and for registered users, data synchronizes to cloud systems for backup.

Mood and Emotional Data (Health Data - Art. 9 GDPR): You can voluntarily track mood using a 10-point scale and add emotional notes. This data is classified as health-related personal data and processed only with your explicit consent. You can delete mood entries anytime.

AI-Generated Patterns and Personality Analysis (Automated Processing - Art. 22 GDPR): Our app automatically analyzes your conversation patterns using AI to identify therapeutic patterns and create personality profiles. This analysis is automated decision-making. You have the right to:

• Request an explanation of these analyses
• Request manual review instead of automated analysis
• Object to this automated processing (though core features may be unavailable)

Usage Analytics: We collect anonymized statistics about app usage through standard analytics tools to improve service quality. No personal information or coaching content is included in analytics.

4. Data Processing by Third Parties

We use the following service providers (Data Processors under GDPR Art. 28) to deliver the app:

• Authentication and Cloud Storage: Google/Firebase processes user accounts, data backup, and synchronization in EU and globally.
• AI Coaching: OpenAI provides natural language processing and coaching assistance. OpenAI may process data in the US.
• Life-Coaching Features: Simli generates avatar videos. Simli may process data in the US/EU.
• Real-time Communication: LiveKit provides voice and video streaming using globally distributed infrastructure.
• Analytics: Google Analytics for Firebase provides anonymized usage statistics and processes data globally.

All processors have signed Data Processing Agreements (Art. 28) with valid Standard Contractual Clauses (Art. 46). We verify their GDPR compliance regularly.

5. Data Storage and Retention

Local Data: Stored on your device until app deletion.

Cloud Data (registered users only):

• Account information: Until account deletion
• Coaching data: Until user deletion
• Analytics: 26 months (standard retention)

Anonymized User Data: Automatically deleted after 90 days of inactivity.

Video/Audio Sessions: Not permanently stored. Real-time communication only.

6. Your Rights and How to Exercise Them

You have the following rights under GDPR:

• Right of Access (Art. 15): Request to see what personal data we hold about you.
• Right to Correction (Art. 16): Request correction of inaccurate data.
• Right to Erasure/Right to be Forgotten (Art. 17): Request deletion of your account and all associated data. We will delete your data within 30 days.
• Right to Data Portability (Art. 20): Request your data in machine-readable format to transfer to another service.
• Right to Restrict Processing (Art. 18): Request limitation of how we process your data.
• Right to Object (Art. 21): Object to processing based on legitimate interests. Object to automated decision-making and profiling (Art. 22).
• Right to Withdraw Consent (Art. 7): Withdraw consent at any time for any processing based on consent. This does not affect processing before withdrawal.
• Right to Lodge a Complaint (Art. 77): File a complaint with your supervisory authority.

How to Exercise Your Rights: Submit written requests with clear identification to:

• Email: info@mindova.de (with subject "GDPR Data Request")
• Mail: Ahmet Yildirim, Ludwigsburger Straße 109, 70435 Stuttgart, Germany

We will verify your identity and respond within 30 days.

Right to Automated Decision-Making (Art. 22): You have the right not to be subject to automated decision-making that produces legal effects. Our AI pattern analysis and personality profiling are automated. You can request manual review instead or object to these practices.

7. Data Security and Incident Notification

Security Measures (Art. 32):

• End-to-end encryption for data in transit
• Encrypted password storage
• Regular security updates and monitoring
• Access controls limiting employee data access
• Secure authentication via Firebase

In case of Security Breaches (Art. 33-34): If we discover a security breach affecting your personal data, we will notify the supervisory authority (BfD Baden-Württemberg) within 72 hours and notify you directly without undue delay if the breach poses high risk.

Note: No system is 100% secure. We cannot guarantee absolute protection against sophisticated attacks, but maintain industry-standard safeguards.

8. International Data Transfers

Your data is processed by service providers in different countries:

• Google/Firebase: EU and global data centers
• OpenAI: US/EU data processing
• Simli: US/EU data processing
• LiveKit: Globally distributed infrastructure
• Google Analytics: Global processing

All transfers are protected by Standard Contractual Clauses under GDPR Article 46, ensuring adequate data protection.

9. Permissions Required

The app requires the following device permissions to function:

• Microphone access (for voice interaction)
• Internet connection (for cloud services)
• Device storage (for local data storage)

All permissions are requested before first use and can be revoked anytime in device settings.

10. Age Restrictions

Mindova is designed for users aged 16 and above. We do not knowingly collect data from children under 16.

11. Automatic Safety Monitoring

The app includes automatic monitoring for signs of crisis or self-harm in conversations. When detected, sessions are automatically interrupted for your safety. Professional help resources are provided.

• Crisis sessions are NOT stored in your coaching records
• Crisis sessions are NOT counted toward your session limits

This automatic monitoring operates continuously and does not require your active consent as it is a justified safety measure. You may disable this feature in app settings at any time (though we recommend keeping it enabled).

12. Withdrawal of Consent and Consequences

You can withdraw consent to any processing at any time. However, some features may become unavailable (e.g., if you withdraw mood tracking consent). Already processed data up to withdrawal continues under the previous legal basis. Deletion requests are processed separately.

If you withdraw consent to automated pattern analysis: Coaching functionality will be reduced as personalization will not be available.

13. Policy Changes

We may update this privacy policy to reflect new features, legal requirements, or operational changes. Significant updates will be communicated with at least 30 days advance notice via in-app notification. Continued use after notification constitutes acceptance of changes.