Privacy Policy

Data Controller

The entity responsible for processing your personal data (the "controller" in the meaning of Art. 4 No. 7 GDPR) is:

Data We Collect and Why

We collect only what is necessary to provide the Mentro service. We do not collect location data, contacts from your address book, microphone or camera input, or any behavioral tracking data.

App content (people and topics) is stored solely to provide the service. We never read or use your conversation notes for advertising, analytics, or any purpose other than displaying them back to you.

Legal Basis (GDPR Art. 6)

• Art. 6(1)(b) — Performance of a contract: Processing your account information and app content is necessary to fulfil the service agreement you enter when you create an account.
• Art. 6(1)(a) — Consent: We send push notifications only when you explicitly grant permission on your device. You may withdraw this at any time through device settings.
• Art. 6(1)(f) — Legitimate interests: We maintain session tokens to keep your account secure and prevent unauthorized access.

Third-Party Processors

We use the following sub-processors, each bound by a Data Processing Agreement (DPA):

Data Retention

• Account data (email, name, authentication records) is kept for as long as your account exists. Upon deletion it is permanently erased within 30 days, except where longer retention is required by law.
• Conversation topics marked as done are automatically and permanently deleted after 5 days. This is a core product feature designed to keep your data minimal.
• Active topics and people are retained until you delete them or delete your account.
• Push notification tokens are removed when you revoke notification permission, sign out, or delete your account.
• Session tokens expire automatically per Supabase's session management settings and are invalidated on sign-out.

Your Rights Under GDPR

As a data subject you have the following rights. Contact info@vasterminds.com to exercise any of them. We will respond within 30 days.

• Right of access (Art. 15): Request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): Correct inaccurate or incomplete data via app settings or by contacting us.
• Right to erasure (Art. 17): Request deletion of your account and all associated data. See Section 7 for in-app deletion.
• Right to data portability (Art. 20): Request an export of your personal data in a structured, machine-readable format.
• Right to restriction of processing (Art. 18): Ask us to restrict processing of your data in certain circumstances.
• Right to object (Art. 21): Where we rely on legitimate interests, you may object to the processing.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent (e.g., push notifications), you may withdraw at any time without affecting prior lawful processing.

Account and Data Deletion

• In the app: Open Settings → "Delete Account". This permanently removes your account, all people, topics, and push notification token. Deletion is immediate and irreversible.
• By email: Send a deletion request from your account email to info@vasterminds.com. We will complete deletion within 30 days and confirm by email.

We Do Not Sell Your Data

Vaster Minds GmbH does not sell, rent, license, or otherwise commercially share your personal data with any third party for that party's own marketing or commercial purposes. Your conversation topics and the names of people you track are private to you and are never shared with advertisers, data brokers, or analytics platforms.

Children's Privacy

Mentro is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact info@vasterminds.com and we will delete the data promptly.

Changes to This Privacy Policy

We may update this policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will notify you by email and display an in-app notice at least 14 days before the changes take effect. The "Last updated" date at the top of this page always reflects the current version.

Contact and Right to Lodge a Complaint

For any privacy-related question or to exercise your rights:

Right to lodge a complaint with a supervisory authority:

You may also contact the supervisory authority in your EU member state of habitual residence, place of work, or place of the alleged infringement.