Privacy Policy

Mindvest (mindvest.consulting) is operated by Steffen Hetzel, Germany. We are the data controller for personal data collected through this platform. Contact: connect@mindvest.company

We collect the following categories of personal data:

• Account data: email address and password hash when you create an account.
• Assessment responses: your answers to assessment questions. These are self-reported and are used to compute your confidence score and generate your report.
• Report data: your computed scores, top bottleneck, recommended path and cross-border summary — stored linked to your email address.
• Payment data: if you purchase a paid product, Stripe processes your payment. We receive a Stripe customer ID and subscription status but do not store full card details.
• Usage data: anonymised analytics events (e.g. assessment started, report opened) to improve the platform. These include a session identifier but no precise location or device fingerprint.

We process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): to provide the service you have requested.
• Legitimate interest (Art. 6(1)(f) GDPR): for platform analytics and fraud prevention.
• Consent (Art. 6(1)(a) GDPR): for marketing communications, where applicable.

• To deliver your assessment results, financial confidence check and paid report.
• To send you your report link and relevant educational content by email (Resend).
• To process payments and manage subscription status (Stripe).
• To improve the platform through aggregated analytics.
• To comply with legal obligations.

We do not sell your data to third parties.

We use the following sub-processors:

• Supabase (database and authentication) — EU region.
• Stripe (payment processing) — EU and US, with appropriate safeguards.
• Resend (transactional email) — US, with appropriate safeguards.
• Vercel (hosting and edge functions) — EU and US regions.

All processors are bound by data processing agreements and handle your data only as necessary to provide their service to us.

We retain your assessment results and report data for as long as your account is active or as needed to provide the service. If you delete your account, we delete or anonymise your personal data within 30 days, unless retention is required by law (e.g. financial records for tax purposes).

Under applicable EU data protection law you have the following rights:

• Access: request a copy of the data we hold about you.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your data ("right to be forgotten").
• Portability: request your data in a machine-readable format.
• Restriction: request that we restrict processing in certain circumstances.
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: withdraw consent for marketing at any time.

To exercise any of these rights, contact connect@mindvest.company. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

Mindvest uses strictly necessary cookies for authentication (session management). We do not use advertising cookies or cross-site tracking. Our analytics use server-side event logging to a first-party database — no third-party pixel or script is loaded.

We use industry-standard measures to protect your data including HTTPS encryption, role-based database access control and hashed password storage. No system is completely secure; please use a strong unique password for your account.

We may update this Privacy Policy from time to time. Material changes will be communicated by email or a notice on the platform. The updated policy will be effective from the date it is published.

Questions about privacy or data handling: connect@mindvest.company