Privacy Policy

Welcome to Mindstone (the "App"). This Privacy Policy explains what information we collect about you, how we use it, when we share it, and the controls we provide you to manage your information.

1. What data we collect & Why

We have summarized the data we collect, why we use it, and the legal basis for doing so in the table below.

Why do we process your data?	What data is used?	Legal basis
To create your account and manage access (including anonymous/guest sessions)	Account Data: Name, email, password, profile picture, SSO identifiers (Google, Apple). Guest Data: Anonymous User ID to allow app usage before full registration	Performance of contract
To generate personalized AI learning paths (Audio, Text, Images)	User Content: Text prompts and inputs. Learning Preferences: Selected level, preferred voice style, and content duration.	Performance of contract
To build and maintain your personal Knowledge Graph	Activity Data: Association of learned concepts, progress tracking, and interaction history with the chatbot.	Performance of contract
To improve our App, analyze usage trends & monitor business performance	Usage Data: App interactions, screens viewed, session duration, features used. Device & Technical Data: device model, OS version, connectivity type, crash reports	Consent
To measure marketing performance	Technical & Advertising Data: Advertising IDs (IDFA/GAID), IP address, installation events	Consent
To send you updates & push notifications at appropriate times	Contact Data: push tokens. Technical Data: timezone or approximate location	Consent
To help you & fix issues (customer support, bug tracking)	Communications: history of your messages with us. Usage Data	Legitimate interest
To ensure safety & security (detecting fraud, moderating illegal content)	All relevant data: Account Data, Usage Data, User Content, Technical Data, etc.	Legitimate interest & Legal obligation
To process In-App Purchases & manage subscriptions	Purchase Data: product ID, purchase token, subscription status, expiration date	Performance of contract
To send marketing communications (newsletters, offers)	Contact Data: email address or phone number	Legitimate interest

Note: The legal basis listed above apply specifically to users in the EEA and UK; in other regions, we process data based on equivalent grounds under applicable local laws.

2. When we share information about you

We share your information with:

• The Voodoo Group for the purposes described in this policy.
• Service providers who help us provide the App (e.g., hosting, analytics, processing inputs to generate learning paths, etc.).
• Legal authorities if required by law or to protect safety.
• Business transfers in connection with a merger, sale, or acquisition.

3. How long we keep information about you

We retain your information only for as long as your account is active and as needed to provide our services to you.

We will delete your personal data upon your request, unless we are required to retain certain information to comply with our legal obligations or for security purposes.

4. How we protect your data

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, or destruction.

5. International transfers

Some of our partners are located outside the European Union/EEA. In such cases, we ensure the transfer is secured by recognized protection mechanisms, such as the European Commission's Standard Contractual Clauses (SCCs).

6. Your rights

If you are located in the European Economic Area (EEA) or France

You benefit from specific protections under the GDPR:

• Access & Portability: You can request a copy of your personal data in a structured, commonly used format.
• Rectification & Erasure: You have the right to correct inaccurate information or request the permanent deletion of your account and data.
• Objection & Restriction: You may object to the processing of your data for legitimate interests or request that we temporarily limit its use.
• Digital Legacy (France): In accordance with French law, you have the right to define instructions regarding the storage, deletion, and communication of your personal data after your death.

If you reside in California, Virginia, or other U.S. states with applicable privacy laws

You are granted the following additional rights:

• Right to Know & Access: You can request to know what specific pieces of personal information we have collected, used, or disclosed about you.
• Right to Correct & Delete: You may request that we correct inaccuracies in your information or delete personal data collected from you.
• Opt-out of "Sale" or "Sharing": You have the right to opt-out of the "sale" of your data or the "sharing" of your information for cross-contextual behavioral advertising.
• Limit Sensitive Information: You can request that we limit the use of sensitive personal information to what is necessary to perform our services.
• Non-Discrimination: We will not discriminate against you (e.g., through price increases or reduced service quality) for exercising any of your privacy rights.

7. Children

The App is not intended for individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected such data, we will delete it immediately. If you believe we might have any information from or about a child, please contact us at dpo@voodoo.io.

8. Contact