Privacy policy

Controller

The controller of your personal data is MINDSERSIT, a single-shareholder simplified joint-stock company (SASU) with a share capital of €100, registered office 155B rue Marcel Mérieux, 69007 Lyon, France, RCS Lyon 983 970 245, EU VAT FR 54 983 970 245. Contact: hello@mindsers.it.

What we collect

• Your account: your email address, your language, a hash of your password (never the password), and when you confirmed the address.
• Your sessions: a digest of the session cookie, your browser’s user agent and IP address, and when it was last used.
• The links we email you, to confirm your address or reset your password: kept as digests.
• Your provider keys, encrypted, and for some providers the region they work in and your statement that your allowances go only to adults.
• Your allowances: their name, budget, models, dates, owner and recipient. An invitation’s address, and the secret of its link as a digest.
• For each request made with an allowance: the model, the token counts, the cost, the provider’s request identifier and when it was made. Never the prompt, and never the answer.
• Claim links: their settings and the addresses or domains you list. For each claim: the claimant’s account, a digest of their mailbox, its domain, and whether it was granted. The owner of a link sees the address of each person who claims it.
• Places and payments: your places and their history, your customer and subscription identifiers at Stripe, and the identifiers of the payment events Stripe sends. Never your card details.
• At Stripe, for a purchase: your email address, the billing address you give, which sets the tax, and your company’s VAT number if you give one; your invoices.
• Server logs: what the service did, with account and allowance identifiers. Never a prompt, a key or a token.

What a recipient sends with an allowance passes through the service to the owner’s AI provider, and its answer back, without being stored. That provider processes it under its own terms and privacy policy.

Purposes

• Providing the service: your account, your keys, the allowances you give and receive, and the record of what each one spent.
• Billing: your places, and what you buy.
• Security: keeping you signed in, limiting repeated attempts, spotting abuse and checking that a new password has not appeared in a known data breach.
• Service emails: confirming your address, resetting your password, and what concerns your account or your places.

Hosting and retention

Everything is hosted in France, by OVHcloud.

• Your account is kept until you delete it. Deleting it erases your address, your password hash and your provider keys, and ends your sessions; the empty account stays only so the records that reference it hold together.
• A session lasts 7 days, or 90 if you stay signed in, and is renewed while you use it; it is deleted once it has expired. An emailed link is deleted once it has expired.
• Allowances, their requests and their costs are kept as the record of what was spent, after an account is deleted too, without the address that identified it.
• The addresses listed on a claim link are deleted 30 days after the link closes.
• Places and their history are kept as the record of what was bought and used.
• Your invoices and your customer record at Stripe are kept for ten years, as the French Commercial Code requires (article L123-22), after your account is deleted too. They hold only what billing needs.
• Repeated-attempt counters keep a digest of your address or IP, never the address itself, and only for the window they count.
• Server logs are kept 30 days.

Your rights (GDPR)

Under the GDPR, you have the following rights over your data: access, rectification, erasure, restriction of processing, portability and objection. You can exercise them:

• directly from the app, for most of them: removing a key, revoking an allowance, deleting your account;
• by writing to hello@mindsers.it.

You may also file a complaint with the CNIL, the French data protection authority (www.cnil.fr).

Cookies

Nothing is written to or read from your device for tracking, analytics or advertising. The cookies below are necessary for the service and your language preference, so no consent banner is needed.

• tom_session: keeps you signed in. Lifetime: the session.
• tom_csrf: protects your forms against requests forged by another site. Lifetime: the session.
• tom_language: remembers your selected language. Lifetime: one year.
• During a payment, Stripe’s pages and its customer portal set their own cookies, on their domain, for payment security and fraud prevention, under Stripe’s policy.

The site measures no audience.

Legal basis

• Performance of a contract (art. 6.1.b): your account, your keys, your allowances and their records, your places, and the service emails.
• Legal obligation (art. 6.1.c): your invoices, kept ten years.
• Legitimate interest (art. 6.1.f): security, the repeated-attempt counters and the breached-password check.

Processors

We use the following providers:

• OVHcloud (France): hosting for the application and the database, and their backups.
• Resend (Ireland): delivery of the service’s emails. Your email address is passed to it for that purpose only.
• Have I Been Pwned: checks a new password against known breaches. It receives the first five characters of the password’s SHA-1 hash, never the password.
• Stripe Payments Europe, Ltd. (Ireland): payments for places, invoices and the tax on them. Stripe may transfer some data to Stripe, Inc. in the United States; these transfers are covered by the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.

Where any other of these providers handles data outside the European Union, the transfer is covered by the safeguards the GDPR requires, such as the European Commission’s standard contractual clauses.

Governing law

This policy is governed by French law.