Privacy Policy

1. Controller and Contact

The controller responsible for data processing on MyMindSeed is:

Marko Leicht, c/o COCENTER, Koppoldstr. 1, 86551 Aichach, Germany
E-mail: info@mymindseed.com · Contact form: mymindseed.app/en/kontakt

We are currently not required to appoint a data protection officer. Please contact us directly with any privacy questions.

2. The Essentials

• You tell your Mindseed about your life. So that it can reply, remember and grow, we store and process your chats and what comes from them.
• Replies are generated by OpenAI. For voice output and cloned voices we use MiniMax, for images fal.ai – each only when you use the feature.
• Your data is stored on servers in Frankfurt. Some service providers are based in the USA or Singapore (Section 6).
• We only process sensitive details (e.g. about health or faith) with your explicit consent (Section 3).
• No tracking, no advertising, no selling of your data. Your content is not used to train AI models – except for what MiniMax may do under its own terms (Section 5).
• You can export, edit and delete your data with your account at any time.
• Use is permitted from age 18.

4. What Data We Process and Why

Account

• E-mail address, password (stored only in encrypted form), display name, language setting (for e-mails in your language), time of sign-up and last login
• When you log in, our database provider processes your IP address and browser identifier to manage your session and detect abuse
• Legal basis: contract (Art. 6(1)(b) GDPR)

Your Mindseed, Chats and Life Tree

• Your Mindseed's name and descriptions, memories, biography, traits with their earlier versions (annual rings), buds (what you want to do differently right now, with your Mindseed's notes on them), year of birth, question cards, your focus (what you are here for) and suggestions you approve or reject
• Chat histories (including chats you have with other people's shared Mindseeds), short-lived chat notes your Mindseed keeps, and blossoms in the life tree (summaries of your conversations)
• Voice input: your recording is sent to OpenAI to be turned into text and is not stored by us
• Photos in the chat: a photo you show a Mindseed – your own or someone else's shared Mindseed – is reduced in size in your browser (which also removes metadata such as where it was taken) and sent to OpenAI for this one reply only. We do not store the photo, only a short note about what is on it (without names and without facial features); the note is part of your chat history. If you show the photo to someone else's Mindseed, the note is only in your chat: the person the Mindseed belongs to sees neither the photo nor the note. People on the photo are not identified.
• AI images you have created in the chat
• Legal basis: contract (Art. 6(1)(b) GDPR), for sensitive details your consent (Section 3)

Mood Analysis

• From your chat messages the app derives values for mood, conversation style and your relationship to individual Mindseeds and forms short guesses from them (e.g. “seems thoughtful today”). Your latest messages are sent to OpenAI for this.
• Purpose: your Mindseed should respond to you appropriately. The values only shape its replies; we make no decisions about you with them (Section 9).
• Retention: mood and relationship values for as long as your account exists; the guesses are formed anew for each reply and are not stored
• Legal basis: contract (Art. 6(1)(b) GDPR), where sensitive details are involved your consent (Section 3). The values are part of your data export.

Photos, Videos and Voices

• Your Mindseed's profile photo, photos and videos; the crop you choose for cards
• Your own 3D figure: the settings from the figure editor (e.g. face shape, hairstyle, colours) and a preview picture of the figure. A photo of yourself that you choose in the editor for comparison or for “Suggest from photo” is analysed only in your browser (face shape, hairstyle, beard and glasses, plus skin, eye, hair and clothing colour) and is never sent to us or anyone else, nor stored. The analysis does not recognise people; only the slider values are taken over, which you then adjust and save yourself.
• Cloned voice: your recording is sent to MiniMax; afterwards we only keep the voice's identifier and a short preview and delete the recording
• Legal basis: contract (Art. 6(1)(b) GDPR), for voice cloning your consent (Section 5)

Sharing and Gallery

• If you share your Mindseed by link, anyone with the link sees its name, short description, profile photo and the media you released; only signed-in users can chat with it. If you make it public, it also appears in the “Discover” gallery, which only signed-in users can see.
• We tell search engines and AI crawlers not to include shared Mindseeds and their media (noindex, robots.txt). Reputable providers follow this; we cannot guarantee it for every one.
• We do not display the long description, memories, traits (including their earlier versions, the annual rings) and biography. Your Mindseed does use them in conversations and can tell visitors about them. Before you share, we point this out and store the version and time of your confirmation until your account is deleted.
• “Only for me”: your Mindseed uses entries you mark with a lock only when it talks to you. In conversations with others it does not get to see them. When you talk to it yourself, the AI services process these entries like all others (Section 5), and they are part of your data export. Annual rings follow the lock of their trait. Your Mindseed only knows your buds and your focus when it talks to you, even without a lock.
• We translate the short description of public Mindseeds into visitors' languages with OpenAI and store the translation.
• Saving: which shared Mindseeds you save, we store with the time until you remove them from the list or one of the accounts or the Mindseed is deleted. The owners are not told. If an owner makes their Mindseed private, we no longer show it in your list.
• Legal basis: contract (Art. 6(1)(b) GDPR)

Stories About Other People

When you talk about family, friends or others, we also process their details – only as they appear in your stories and only for your Mindseed. The legal basis is the legitimate interest in recording your life story (Art. 6(1)(f) GDPR). For shared Mindseeds we automatically check whether others are exposed (see moderation). Anyone who finds themselves in a shared Mindseed can contact us at any time.

Bridge Messages

• Messages between users via their Mindseeds and the replies (at most 500 characters each), with status and the sender's display name
• Receiving: only people whose Mindseed is shared receive messages. Receiving is on at first and can be turned off under “Messages”.
• Missed messages: if someone wants to write to a person who is not accepting messages, we only store the time – no text and no sender – at most once per chat and day, for 30 days.
• Removal: if one side removes a message, it disappears from their list; once both have removed it, we delete it permanently.
• Blocking: if you block someone, we store this with the time and the Mindseed through which you blocked them, until you lift the block or one of the accounts is deleted. The messages between you disappear from your lists; the blocked person is not notified.
• Legal basis: contract (Art. 6(1)(b) GDPR)

Moderation and Abuse Protection

• Checked automatically: uploaded photos and videos (reduced-size copies or individual still frames), photos you show in the chat, image requests, bridge messages and replies, the name and short description of a Mindseed, display names and – once a Mindseed is shared – its long description, memories, traits including their earlier versions and biography (except entries marked “Only for me”; they are checked as soon as you remove the lock). The content is sent to OpenAI for this. People on photos are not identified.
• If the check rejects something, we store the time, type and reason – never the content – for 90 days. After 10 rejected bridge texts within 24 hours we temporarily block sending (24 hours, 7 days if repeated) and keep the block for 30 days.
• Further measures (warnings, blocks, setting back to private) are decided by a person and explained by e-mail. We keep restrictions, warnings and an internal note for as long as the account exists; after deletion only the type and time of our decisions remain, without reference to you.
• Legal basis: legitimate interest in protecting users and the public from illegal and harmful content (Art. 6(1)(f) GDPR)

Purchases, Tokens and Usage Log

• Token entries (purchases, subscription credits, bonuses, usage) and your subscription status. Your balance results from these entries; after 6 months we combine all entries except purchases and subscription credits into a single carry-over that only keeps the balance.
• Usage log: for every request to an AI, speech or image service we store the time, service, model and amount – never the content. After 90 days we remove the link to your account.
• Legal basis: contract and statutory retention duties (Art. 6(1)(b) and (c) GDPR); the usage log serves cost control and detecting abuse (Art. 6(1)(f) GDPR)

Contact, Cancellation, Withdrawal and Reports

• Contact form: topic, name (optional), e-mail address and message reach us by e-mail; we store none of it in the app. We keep the e-mail until the matter is settled (Art. 6(1)(b) or (f) GDPR; requests from authorities Art. 6(1)(c) GDPR in conjunction with Art. 11, 12 DSA).
• “Cancel contracts here” and “Withdraw from contract”: your details and the time of receipt, kept for three years as proof (Art. 6(1)(c) and (f) GDPR).
• “Report content”: details of the reported content, optionally name and e-mail of the reporting person, until the decision and for one year afterwards (Art. 6(1)(c) GDPR in conjunction with Art. 16 DSA). With the report we record what the reported Mindseed shows at that moment: name, short and long description, visibility and the addresses of its photos and videos (no copies of the files). If the reporting person wishes, the latest messages of their own conversation with this Mindseed are added. This copy is kept as long as the report, even if content, conversation or account are deleted earlier, so that we can decide and give reasons for our decision (additionally Art. 6(1)(f) GDPR).
• Reporting messages (in your messages): the wording of the reported message or reply, the reason, your optional addition and both accounts involved, until the decision and for one year afterwards. The reported person is not told who reported them (Art. 6(1)(c) and (f) GDPR in conjunction with Art. 16 DSA).

Technical Data

• When you open our pages, our hosting provider processes your IP address, the time and the requested address, also for rate limits against abuse; it deletes logs after one day at the latest.
• Legal basis: legitimate interest in secure operation (Art. 6(1)(f) GDPR)

5. Service Providers and Other Recipients

We only pass on data to these service providers as far as the respective feature requires it. We have a data processing agreement (Art. 28 GDPR) with all of them except MiniMax. We do not sell data or pass it on for advertising.

• PayPal's privacy statement: www.paypal.com/de/legalhub/paypal/privacy-full

6. Transfers Outside the EU

Some service providers are based in the USA or Singapore or access data from there. We base transfers to the USA on the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) where the recipient is certified, otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). For MiniMax neither applies; transfers there only take place with your explicit consent (Art. 49(1)(a) GDPR, see Section 5). In third countries, authorities may be able to access data without you having the same remedies as in the EU.

7. How Long We Keep Data

• Account, Mindseed, chats, media and voices: until you delete them or your account. We keep the last 50 messages of each chat; we permanently remove older ones after 7 days.
• Deleting a conversation (in the chat via “⋯”): we immediately delete the messages and the chat notes. In the chat with your own Mindseed, your blossoms and the notes on your buds stay; you remove each of them in the life tree (“Remove blossom”, letting go of or deleting a bud). In the chat with someone else's Mindseed, we also delete all blossoms (summaries) from that conversation, the relationship value of the mood analysis for that Mindseed and AI images from the conversation. Messages you have already sent to the person behind the Mindseed stay in their inbox. Deleted content may remain in our database provider's backups for up to 7 days.
• Accounts that have not been used for 24 months (no sign-in and no opening of the app): we terminate them by e-mail with four weeks' notice and then delete them as described in the next point if you do not use the account by then (Terms of Service 8.2). This does not apply to accounts with a shared Mindseed or to accounts with purchases or a subscription. We store when we announced the deletion until the deletion or until you use the account again.
• When you delete your account, we immediately delete all content, files and cloned voices; a running subscription ends. Data may remain in our database provider's automatic backups for up to 7 days.
• Short-lived chat notes expire when your Mindseed no longer needs them; AI images after 7 days.
• Mood analysis: see Section 4.
• Token entries: we keep purchases and subscription credits for as long as your account exists; all other entries are combined into a carry-over after 6 months (Section 4). If you delete your account, all entries immediately lose any reference to you. We then keep purchases and subscription credits for the tax retention period (10 years from the end of the calendar year) and delete them afterwards; all other entries are deleted 6 months after booking. Stripe also keeps payment records.
• Usage log: link to the account removed after 90 days. Moderation rejections: 90 days. Missed bridge messages: 30 days.
• Consents and confirmations: until the account is deleted.
• Cancellations and withdrawals: 3 years. Reports: up to 1 year after the decision. Contact requests: until the matter is settled. Blocks: until lifted. Saved Mindseeds: until you remove them.

8. Cookies and Browser Storage

We only use technically necessary cookies:

• Login and session
• Security features
• Your language, if you change it yourself (cookie “NEXT_LOCALE”, one year)

In addition, the app keeps what the features you use need in your browser's local storage: your login, the most recently shown chat messages per Mindseed (so the chat appears quickly), unsaved drafts, display settings such as sound on or off, and whether you have hidden the hint about installing the app. This data stays on your device.

This storage is strictly necessary for the features you ask for and needs no consent (Section 25(2) No. 2 of the German TDDDG). That is why we don't show a cookie banner. No tracking, no marketing cookies, no analytics tools.

9. Automated Decisions

We make no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Only this happens automatically: the content check rejects individual content, and after repeated rejections sending bridge messages is blocked temporarily (Section 4). On request, a person reviews any such rejection. The mood analysis is an evaluation of your chats (profiling) that only determines how your Mindseed replies.

10. Your Rights

• Access and copy (Art. 15 GDPR) – also yourself via the Data Export page (JSON file)
• Rectification (Art. 16) – you can edit entries, descriptions and display names yourself
• Erasure (Art. 17) – individual entries where you edit them (including annual rings with the traits, buds and blossoms in the life tree), a conversation in the chat via “⋯” (section 7), the whole account under “Home” in the account settings
• Restriction of processing (Art. 18)
• Data portability (Art. 20) – via the data export
• Withdrawal of consent (Art. 7(3)) – at any time with effect for the future; for sensitive details and voice output directly in the account settings
• Complaint to a supervisory authority (Art. 77) – our competent authority is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de; you can also contact the authority where you live

For any request, a message via the contact form or to info@mymindseed.com is enough.

11. In the Event of Death

The GDPR only protects living people, but we treat the data of deceased users with the same care. Heirs and authorised representatives can contact us with a death certificate and proof; what is then possible – data export, setting to private, deletion – is set out in Section 8a of the Terms of Service. We continue to protect details about other living people in the account.

12. Data Security

• Encrypted transmission (TLS) and encrypted storage
• Access control at database level: everyone only sees their own data
• Passwords only as a secure hash, bot protection at login, rate limits
• Regular security updates