Data Protection, Responsibility, and Scope
We respect the privacy of our customers and other interested parties and comply with applicable laws to protect your privacy. These laws include, in particular, the General Data Protection Regulation of the European Union (“GDPR”).
This Privacy Notice applies to:
The following categories of data subjects are covered by this data protection notice:
The controller responsible for the processing of your personal data within the scope of this data protection notice is:
Mindvoll GesbR
David Jöch & Daria Travnytska
3830 Waidhofen an der Thaya
Schlossergasse 12
Austria
In the following, we explain:
CappyMind mobile application – AI-supported journaling – Purposes for processing personal data
App-Hosting
Data collected and processed:
Legal basis:
Involved data processors:
Further information:
Providing the offered service
Through using our app, the following service is provided:
Data collected and processed:
Legal basis:
Involved data processors:
Further information:
Managing a customer relationship database (CRM)
Data collected and processed:
Legal basis:
Involved data processors:
Further information:
Customer registration and login
We are using the services of Supabase to provide you our registration and login service.
In addition to direct registration and login through our app, you can also do this via your Apple or Google account. If you use your Google or Apple account for registration or login, the respective providers are involved in the registration and login process.
Data collected and processed:
Legal basis:
Involved data processors:
Further information:
Payment and invoicing
For processing payments, we use the services of:
To process web-payments, we use the service “Paddle”, provided by the US company „Paddle.com, Inc.
To manage your subscriptions, we use the services of „RevenueCat“.
Data collected and processed:
Legal basis:
Involved data processors:
Further information:
Push Notifications
We use push notifications to show you relevant messages quickly and effectively directly on your device.
For push notifications on Android devices, we use “Firebase Cloud Messaging” from Firebase, a Google subsidiary.
For push notifications on iOS devices, we use the Apple Push Notification Service (APNS) from Apple.
Data collected and processed:
Legal basis:
Involved data processors:
Further information:
Error detection and correction
We use the “Sentry” service from the US company “Functional Software, Inc” to detect and rectify errors that could impair our service.
Data collected and processed:
Legal basis:
Involved data processors:
Further information:
Analysis of the user behavior in the app
Data collected and processed:
Legal basis:
Involved data processors:
Further information:
Processing support requests
You can send us e-mail support inquiries about problems or other concerns relating to our services.
Data collected and processed:
Legal basis:
Further information:
Further information
Data Transfer to the USA and the Data Privacy Framework
We would like to inform you that on July 10, 2023, the EU Commission issued an adequacy decision under Article 45(1) of the GDPR for the EU-US Data Privacy Framework (Data Privacy Framework). Consequently, organizations or companies (as data importers) in the USA that are registered in a public list as part of the Data Privacy Framework’s self-certification process provide an adequate level of protection for data transfers. This, therefore, constitutes a valid legal basis for using certified US services.
For all purposes mentioned in this Privacy Policy that utilize services from US providers with an adequate level of protection, the legal basis “Data Privacy Framework” is specified. You can directly verify whether a service provider is certified on the Data Privacy Framework website.
Should a provider not be certified under the Data Privacy Framework, this will be explicitly mentioned for the respective purpose, along with a valid alternative legal basis.
Standard Contractual Clauses (SCC)
In order to enable data transfer to countries without an adequacy decision, the EU Commission has drawn up standard contracts (standard contractual clauses). These standard contractual clauses require contractual partners to adhere to a level of data protection comparable to that in the EU. These contractual texts are made available on the European Union’s website. Standard contractual clauses are abbreviated to “SCC”.
Cookies and local storage
Personal data and information may be stored in cookies, session storage, and/or local storage by our services. Processing takes place on the legal basis specified for the respective service.
You can specify how the web browser handles cookies and local storage, which storage processes are permitted or rejected, and for how long the data processing takes place in the web browser settings.
Data retention
We only store your personal data for as long as it is necessary to fulfill the purposes mentioned or as long as contractual or legal retention periods require.
Transfer of data
We will only disclose your personal data to third parties if this is legally required, if this is necessary for the provision of our services or if you have consented to the transfer. We will never sell your data to third parties without your explicite consent.
Data may, if necessary, be passed on to the following categories of recipients:
Protection of Personal Data
We protect personal data through appropriate technical and organizational measures that comply with current industry standards and best practices. This includes, as reasonable, pseudonymization as well as the encryption of personal data during transmission and storage.
Withdrawal of consent
If you have given your consent to the processing of your personal data for a specific purpose based on Art. 6 para. 1 lit. a GDPR, you can withdraw this consent at any time. The lawfulness of processing personal data until withdrawal is not affected by the withdrawal.
Mandatory provision of data and consequences of non-provision when using services
There is no legal or contractual obligation to provide personal data. Failure to provide personal data means that no offer can be made, or no contract concluded, and the services offered therefore cannot be provided.
For the use of our services, the provision of personal data is partly required by law (e.g. tax regulations) or may result from contractual regulations (e.g. information on the contractual partner).
In the case of consent to the processing of personal data, there is no legal or contractual obligation to provide this data. Failure to provide consent may, depending on the consent given, mean that no contract can be concluded or that the service cannot be used to its full extent.
Rights of Data Subjects
Right of Access
You have the right to request at any time information about the personal data we store about you and to receive a copy of that information. Furthermore, you have the right to obtain confirmation as to whether the personal data in question is being processed.
Right to Rectification
Should your data be inaccurate or incomplete, we will rectify it upon request.
Right to Data Portability
If we process your personal data in an automated way based on your consent or based on a corresponding agreement, you have the right to request a copy of your data in a structured, commonly used, and machine-readable format, which can be sent to you or another party. This right applies only to the personal data that you have provided to us.
Right to Restriction of Processing
You have the right to request that we restrict the processing of your personal data under certain circumstances.
Right to Erasure
You have the right to have the personal data processed by us deleted, insofar as this is legally permissible.
Withdrawal of Consent/Objection to Processing
Additionally, you may withdraw your consent to the use of your data or object to its processing at any time. The lawfulness of the processing of your personal data up until the time of withdrawal shall not be affected by that withdrawal.
Right to Lodge a Complaint
If you believe that we are not processing your personal data correctly, you can contact us. You also have the right to lodge a complaint with supervisory authority. For more information on the supervisory authorities in the European Union, please click here.
All rights can be exercised by sending an e-mail to the contact named at the beginning of this privacy notice.
Changes to this privacy policy
We will update this notice from time to time. Any changes will be posted on this page, accompanied by an updated revision date.
Date of publication of the current version: 10.07.2025
This privacy notice is generated and provided by the Metasoul privacy notice generator.
