Controller and contact
Mindbloom determines why and how personal data connected with the public website, accounts, and application is used. For questions or data-rights requests, contact [email protected].
Data we handle
Depending on how you use Mindbloom, we may handle your name, email address, account and sign-in information, beta-access request, content you choose to submit, security signals, and technical logs needed to operate the service.
Graphs and contributions that you make public can be viewed by other people. Private account information is not published with those contributions.
Purposes and legal bases
We use this data to review beta requests, create and protect accounts, provide requested features, answer messages, prevent abuse, and improve service reliability.
Depending on the activity, processing is based on steps taken at your request, performance of the service, legal obligations, and Mindbloom’s legitimate interest in operating and securing the beta.
Recipients and providers
Access is limited to people who need it and technical providers that host, secure, authenticate, or deliver the service, including OVH, Cloudflare, and sign-in or email providers when you use those features.
Mindbloom does not sell personal data.
Retention
Data is kept only for as long as needed for the relevant purpose, operation of your account, security, and legal obligations. Beta requests, repeat submissions and visit-source information are retained after a decision for beta management and acquisition analysis. A decision does not automatically erase them; you can request deletion.
Account deletion and contributions
Deletion removes personal profile information, login identities and sessions. Private graphs to which you are the sole contributor can be deleted with the account. Public graphs may remain without your account identity; shared graphs, groups and templates may require transfer or review to protect other people’s contributions.
Deleting an account does not automatically remove personal information written inside public content: contact us to request review and erasure. Minimal security and moderation records may remain to prevent abuse; backup copies expire through rotation rather than disappearing immediately.
Your rights
You may request access, correction, deletion, restriction, or portability of your data and object to certain processing by writing to [email protected].
You may also complain to the CNIL if you believe your data-protection rights have not been respected.
Cookies and embedded services
For beta requests, session storage remembers visit sources in the current tab, expiring after 30 minutes of inactivity. Landing-page paths, referring domains, campaign labels and screen-size category accompany the request. No tracking identifier, search term or full URL is added. This collection respects Do Not Track and Global Privacy Control signals.
The website uses storage needed for sign-in, security, and essential preferences. Third-party services, such as Google sign-in or an embedded map, may load when you use the corresponding page or feature.
Updates
This policy may be updated when the product, providers, or legal requirements change. The version published on this page is the current version. Last updated: 27 September 2026.