Legal
Privacy
How MindsMelt handles your data. In a mental-health product, this is not boilerplate—it is the product.
Last updated: July 2026
What we collect
Only what a page needs to work: contact form fields, assessment results you ask us to send, account data if you create one, and anonymous answers to the working athlete survey. The survey does not ask for a name, email, exact team or exact location.
Survey and newsletter separation
The athlete survey and optional update-list form use separate endpoints and tables with no shared identifier. MindsMelt does not create, keep or use a link between survey answers and newsletter subscriptions. The survey privacy page explains the pilot in plain language.
Health-related information
Some athlete-survey answers may reveal health-related experiences even though the survey does not ask for a diagnosis. Raw responses are restricted and publication is aggregate. Longitudinal screening is a separate future, opt-in feature and is not part of this survey.
Your rights
You may request access, correction, export, restriction or erasure where applicable through the contact route. Athlete-account self-service controls are planned, not yet released. You may also complain to the CNIL or another competent supervisory authority.
Controller and processors
The final controller identity and GDPR contact will be inserted after the legal entity is incorporated; this is a public-launch blocker. The current development stack uses Supabase and Vercel and, where transactional email is enabled, Resend. Payment and monitoring processors will be listed only when activated and contracted.
Retention
Working survey responses receive a six-month retention-review date; the final retention period requires legal and privacy approval before public launch. Security logs: proposed 12 months. Certification decision records: 10 years for award traceability. Formal assessment answers and audit evidence: award cycle plus 3 years. Legal holds or active disputes may require a documented exception.