Privacy Policy
Last updated: 9 October 2026
This Privacy Policy explains how DOTWORLD SA ("Dotworld", "we", "us") collects, uses, shares and protects your personal data when you visit the Mindeva website (getmindeva.com), take the Mindeva quiz, purchase a plan and use the Mindeva web application (together, the "Service"). It also explains the rights you have over your data and how to exercise them.
We wrote this policy to be read. If anything is unclear, write to us at support@getmindeva.com.
In short:
- We collect what you give us (quiz answers, email, first name, password), what your use of the Service generates (progress, technical data) and what our payment partner tells us about your subscription (never your full card number).
- Some quiz answers concern your wellbeing and may reveal information about your health. We process them only with your explicit consent, to build your profile summary and personalise your program.
- We use your data to provide the Service, process payments, communicate with you, keep the Service secure, measure and improve it, and, with your consent, for analytics and advertising measurement.
- We never sell your personal data.
- Your data is hosted with providers in Switzerland, the European Union and the United States, under appropriate safeguards.
- You can access, correct, export or delete your data at any time from your account settings or by contacting us.
1. Who is responsible for your data
The data controller is:
DOTWORLD SA Route des Flumeaux 40, 1008 Prilly, Switzerland Commercial register: CH-550.1.161.731-3 Email: support@getmindeva.com
Dotworld is a Swiss company. We apply the Swiss Federal Act on Data Protection (FADP) and, because we offer the Service to people in the European Union and the United Kingdom, the General Data Protection Regulation (GDPR) and the UK GDPR where they apply to you.
Dotworld sells the plans directly. Our payment service provider Stripe (Stripe Payments Europe, Limited, Ireland) processes payments on our behalf (see Section 6).
2. Data we collect
2.1 Data you provide
Quiz answers. When you take the quiz, you answer questions about yourself: gender, age range, your agreement with statements about how you feel physically and emotionally (for example tension, energy, sleep, mood, concentration, digestion, appetite), your current life circumstances (for example financial, relationship or family situation, health issues), symptoms you recognise, the areas you want to work on, how you would like to feel, your familiarity with cognitive behavioural therapy, and how you heard about Mindeva. Some questions offer a free-text field. During the loading screen you may also answer a few yes/no questions about your goals. Every question you answer is recorded.
Account data. Your email address, your first name, the language of the Service, and, after your first payment, a password (stored only in hashed form; we cannot read it). If you sign in with Google, we receive from Google your name, email address and Google account identifier.
Program and preferences data. In the web app: your onboarding choices, the frequency at which you want to receive lessons, your answers to in-lesson mini-quizzes and exercises, and any other information you enter.
Communications. The content of your emails and chat messages with our support team, your cancellation requests and, if you cancel, the reason you may choose to give us. Your reviews or testimonials if you choose to provide them.
You are not obliged to provide any information. However, without an email address we cannot create your account, and without quiz answers we cannot build your profile summary and program.
2.2 Data we derive
From your quiz answers we compute a stress-load score and a level (for example Normal, Medium, High) and a set of result labels displayed in your profile summary, using predefined rules and thresholds. These derived data are stored with your account and are used to personalise your program. They are indicative and are not a clinical assessment (see our Terms of Service).
2.3 Data collected automatically
Subscription data. When you purchase a plan, our payment partner sends us the information needed to activate and manage your subscription: the plan chosen, currency and price, any promotional code applied, the status of your subscription and its lifecycle events (active, past due, cancelled, refunded, disputed), period dates, and technical identifiers of your customer, subscription and orders at our payment partner. We do not receive or store your card number, expiry date or security code.
Usage data. Which pages and steps of the Service you visit and when, which lessons you open and complete, your progress, clicks on key buttons, and errors encountered.
Technical data. Your IP address, approximate location derived from your IP address (country, used to display the right currency), device type, operating system, browser type and language, screen size, the page that referred you to us and campaign parameters in the link you clicked (UTM parameters), timestamps, and identifiers stored in cookies or your browser (see our Cookie Policy).
Consent records. Your cookie choices and the date you made them; your acceptance of the Terms at checkout.
2.4 Data from third parties
Our payment partner (subscription data, Section 2.3), Google if you use Google sign-in (Section 2.1), and our advertising partners, which may inform us that a visit or purchase followed one of our advertisements, in aggregated or pseudonymised form, subject to your cookie consent.
3. Special categories of data: your wellbeing answers
Some of your quiz answers and program data relate to your mental and physical wellbeing and may reveal information about your health (for example that you experience stress, exhaustion, sleep issues, low mood, or that you are healing from trauma). Under the GDPR and the Swiss FADP, this is sensitive data that enjoys extra protection.
We process this data only on the basis of your explicit consent, which you give when you submit your email address to unlock your profile summary, after having been informed by the notice displayed at that step and by this policy. We use this data solely to build your profile summary, personalise your program and improve the relevance of our lessons. We never use your wellbeing answers for advertising, we never share them with advertising partners, and we never sell them.
You may withdraw your consent at any time by deleting your account (Section 9) or by writing to us. Withdrawal does not affect the lawfulness of processing carried out before it, but it means we can no longer provide you with a personalised program.
4. Why we use your data and on what legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Run the quiz, compute and display your profile summary, save your progress so that you can resume it | Quiz answers, derived data, technical identifiers | Performance of the contract (pre-contractual steps you request); explicit consent for wellbeing data |
| Create and manage your account, authenticate you, let you sign in with Google | Account data | Performance of the contract |
| Process your purchase, activate and manage your subscription, handle renewals, cancellations, refunds and payment failures | Account data, subscription data | Performance of the contract; legal obligation (accounting, tax) |
| Provide and personalise your program in the web app | Quiz answers, derived data, program data, usage data | Performance of the contract; explicit consent for wellbeing data |
| Send service emails: welcome, order and subscription confirmations, cancellation confirmation, password and email changes, important notices | Account data, subscription data | Performance of the contract |
| Answer your questions and support requests | Communications, account data, subscription data | Performance of the contract; legitimate interest in providing customer support |
| Keep the Service secure, prevent fraud, abuse and multiple accounts, enforce our Terms | Technical data, account data, subscription data, usage data | Legitimate interest in the security of the Service and in protecting our rights; legal obligation |
| Measure the audience of the Service, understand how the quiz and the program are used, fix errors and improve the Service | Usage data, technical data | Consent (cookies and identifiers), or legitimate interest for strictly aggregated, cookieless statistics |
| Measure the effectiveness of our advertising campaigns and show you relevant advertising on other platforms | Technical data, events such as quiz start or purchase (never your answers) | Consent |
| Send you marketing emails about Mindeva (news, offers, reminders to complete your purchase) | Account data | Consent, or, for existing customers, legitimate interest in promoting similar services, with an easy way to opt out |
| Invite you to give feedback or a review, publish your review | Account data, communications | Consent |
| Comply with legal obligations, respond to lawful requests from authorities, establish and defend our rights | All categories, as necessary | Legal obligation; legitimate interest |
| Produce anonymised statistics and research about how people use Mindeva | All categories, anonymised so that you can no longer be identified | Legitimate interest (anonymised data is no longer personal data) |
Where we rely on legitimate interest, we have checked that our interest is not overridden by your interests or fundamental rights. You may object at any time (Section 9).
5. Profiling and automated processing
Your profile summary and your program are generated automatically from your quiz answers using rules defined by our team (a scoring grid and thresholds). This is a form of profiling. It has no legal or similarly significant effect on you: it only determines which self-development content is shown to you, and you can change your answers at any time by going back in the quiz. No decision about your access to the Service or its price is based on your answers. If you have questions about how your profile was built, contact us.
6. Who we share your data with
We share your personal data only with the following categories of recipients, and only to the extent necessary.
Our payment service provider. Stripe (stripe.com), through Stripe Payments Europe, Limited (Ireland), processes your payments on our behalf as our processor. Your payment details (card number, expiry date, security code and, depending on the payment method, your billing country or postal code) are entered in a secure form provided by Stripe and embedded in our checkout page, and are transmitted directly to Stripe. We pass to Stripe your email address and the technical identifiers needed to link the payment to your account. Stripe sends us the subscription data described in Section 2.3. For its own legal obligations, such as fraud prevention and anti-money-laundering checks, Stripe may also process some of this data as a separate controller under its own privacy policy. Stripe processes data in the European Union and in the United States, under the safeguards described in Section 7.
Service providers (processors) acting on our instructions, bound by contracts that restrict how they may use your data:
| Provider | Role | Location of processing |
|---|---|---|
| Vercel Inc. | Hosting of the Service | United States, with edge delivery worldwide |
| PostHog | Product analytics and audience measurement (subject to your cookie choices) | European Union (Germany) |
| CookieYes | Cookie consent management and record of your choices | European Union / United Kingdom |
| Resend | Sending of service and marketing emails | United States |
| Front | Customer support (email and live chat) | United States / European Union |
| Sign-in with Google (at your request) | United States |
Advertising partners, only if you accept advertising cookies: Meta (Facebook, Instagram) and Google (Google Ads, YouTube) may receive information that you visited the Service, started the quiz or made a purchase, together with identifiers stored in cookies, so that we can measure our campaigns and show you relevant ads. We never transmit your quiz answers, your profile summary or your program data to advertising partners. These partners process this data under their own privacy policies, in some cases as independent or joint controllers. You can refuse or withdraw this at any time in the cookie settings.
Professional advisers and authorities. Our accountants, lawyers and auditors where necessary; courts, regulators and law enforcement where we are legally required to do so or to protect our rights or the safety of any person.
Business transfers. If Dotworld or the Mindeva business is involved in a merger, acquisition, restructuring or sale of assets, your data may be transferred to the successor, which will remain bound by this policy. We will inform you of any such change.
We do not share your data with anyone else, and we never sell it.
7. International transfers
Dotworld is based in Switzerland, a country recognised by the European Commission and the United Kingdom as offering an adequate level of data protection. Some of our providers process data in the United States or elsewhere outside Switzerland, the EU and the UK. When this is the case, we rely on one of the following safeguards: the provider's certification under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework; the Standard Contractual Clauses approved by the European Commission (and their Swiss and UK addenda); or an adequacy decision covering the destination country. You can request a copy of the relevant safeguards by contacting us.
8. How long we keep your data
We keep your data only as long as necessary for the purposes described above, then delete or anonymise it. Our main retention periods:
| Data | Retention |
|---|---|
| Quiz answers and account of a visitor who did not purchase a plan ("lead account") | 12 months after your last activity, then deletion. You may request earlier deletion at any time. |
| Account, quiz answers, derived data, program data of a subscriber | For the duration of your account. After deletion of your account or 3 years of inactivity after your last subscription ended, deletion or anonymisation, subject to the periods below. |
| Subscription, order and billing records | 10 years from the end of the financial year concerned (Swiss accounting and tax obligations). |
| Support communications | 3 years after the closure of your request. |
| Marketing consent and email preferences | Until you withdraw consent or unsubscribe, and at most 3 years after your last interaction with us. |
| Cookie consent record | 12 months (see Cookie Policy). |
| Server logs and security data | 12 months, longer only if needed for an ongoing investigation. |
| Analytics data | Up to 24 months, then aggregated or deleted. |
Data needed to establish, exercise or defend legal claims may be kept for the duration of the applicable limitation period.
9. Your rights
Subject to the conditions set by applicable law, you have the right to:
- Access your personal data and obtain a copy of it;
- Rectify inaccurate or incomplete data (you can update your email, password and language directly in your account settings);
- Erase your data ("right to be forgotten"), in particular by deleting your account from your account settings;
- Restrict the processing of your data in certain circumstances;
- Object to processing based on our legitimate interests, and at any time to direct marketing;
- Port your data: receive the data you provided to us in a structured, commonly used, machine-readable format;
- Withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal, including your consent to cookies (via the "Cookie settings" link in the footer) and to the processing of your wellbeing answers (Section 3);
- Not be subject to a decision based solely on automated processing producing legal or similarly significant effects (we do not make such decisions, see Section 5);
- Lodge a complaint with a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch); in the European Union, the authority of the country where you live or work (for example the CNIL in France, the AEPD in Spain, the BfDI or your state authority in Germany); in the United Kingdom, the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concerns first.
To exercise your rights, use your account settings or write to support@getmindeva.com from the email address of your account, or by post to DOTWORLD SA, Route des Flumeaux 40, 1008 Prilly, Switzerland. We may ask you to confirm your identity to protect your data. We respond within one month, extendable by two further months for complex requests, and free of charge except for manifestly unfounded or excessive requests.
Deleting your account. Deleting your account removes your quiz answers, profile, program data and account data from our active systems within 30 days, except for the billing records and other data we must keep by law (Section 8). Deleting your account does not by itself cancel an active subscription: please cancel it first so that no further payment is taken.
10. Marketing communications
We may send you emails about Mindeva (for example to invite you to complete your purchase, to tell you about new lessons or offers, or to ask for your feedback) if you have consented to it or, where the law allows, because you are a customer. Every marketing email contains an unsubscribe link, and you can also opt out by contacting us. Service emails (receipts, renewal, cancellation, security notices) are not marketing and continue as long as you have an account. We do not send marketing communications to people who only took the quiz without consenting to them.
11. Cookies and similar technologies
We use cookies and similar technologies (local storage, pixels) to run the Service, remember your choices, measure our audience and, with your consent, measure our advertising. Strictly necessary cookies are set without consent; all others require your consent, which you give or refuse through the consent banner displayed on your first visit and can change at any time via the "Cookie settings" link in the footer. If you refuse analytics cookies, our analytics tool runs in a cookieless mode that does not use any persistent identifier. Our Cookie Policy describes each cookie, its purpose and its duration.
12. Security
We implement technical and organisational measures appropriate to the sensitivity of your data: encryption of data in transit (HTTPS) and at rest, hashed passwords, access controls and least-privilege access for our team, logging and monitoring, secure development practices, contractual obligations for our providers, and regular reviews. Payment data is handled exclusively by our PCI-DSS compliant payment partner. No system is completely secure; if we become aware of a personal data breach likely to result in a high risk to you, we will inform you and the competent authority as required by law. Help us protect your account by using a strong, unique password.
13. Children
The Service is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe that a minor has provided us with personal data, please contact us and we will delete it promptly.
14. Residents of the United States
If you reside in a U.S. state whose privacy law applies to us, you may have the right to know what personal information we collect and how we use and share it, to access, correct and delete it, to opt out of the "sale" or "sharing" of personal information for targeted advertising, and to non-discrimination for exercising your rights. We do not sell personal information. The use of advertising cookies described in Section 6 may qualify as "sharing" under some state laws: you can opt out via the "Cookie settings" link in the footer or by contacting us. Authorised agents may submit requests on your behalf with proof of authorisation. If we deny your request, you may appeal by replying to our response.
15. Changes to this policy
We may update this policy to reflect changes in the Service, in our providers or in the law. The date at the top indicates the latest revision. For material changes, we will notify you by email or through a notice in the Service before they take effect. Earlier versions are available on request.
16. Contact
For any question about this policy or your personal data:
DOTWORLD SA, Route des Flumeaux 40, 1008 Prilly, Switzerland support@getmindeva.com