Privacy

Last updated 9 September 2026

Before publishing: replace [LEGAL ENTITY], [ADDRESS], [NIF] and [CONTACT EMAIL] throughout, and have a Portuguese data protection lawyer review this. You process special-category health data, which is the most heavily regulated category there is. This draft is accurate about what the software does; it is not legal advice.

Who we are

Mindalva is operated by [LEGAL ENTITY], [ADDRESS], Portugal (NIF [NIF]). We are the data controller for the processing described here. You can reach us at [CONTACT EMAIL].

The short version

Your answers never reach us. Everything you type or say during an assessment is held in your own browser and is sent to our servers only at the moment you ask for a report — and even then we do not keep it. We store no assessments, no reports, and no accounts.

What we actually hold

Data	Where it lives	How long
Your answers and your report	Your browser only (local storage)	Until you clear your browser data
Your email address	Stripe, and inside a signed cookie in your browser	Cookie expires after 30 days
Payment details	Stripe only — we never see your card	Per Stripe’s retention
An opaque link identifier	Our storage	Indefinitely, until you ask us to delete it

That last row is the only thing we store on a server, and it is a random identifier recording that a resume link has been used. It contains no name, no email address, no answers, and nothing clinical.

Health data

What you tell an assessment is special-category data under Article 9 of the UK and EU GDPR. Our lawful basis for processing it is your explicit consent, given when you begin an assessment. You may withdraw that consent at any time by closing the tab and clearing your browser data, which erases everything, because your browser is the only place it was.

Speaking your answers

If you use the microphone rather than typing, transcription is performed by your browser, not by us. In Google Chrome and Microsoft Edge this means your recorded audio is sent to Google’s servers for speech recognition, under Google’s own terms. In Safari it is handled by Apple. We never receive the audio, only whatever text appears in the box — but the audio does leave your device, and given what you may be describing, you should know that before you use it.

If that is not acceptable to you, type your answers instead. Typed answers never leave your browser until you request a report, and are never sent to Google or Apple at all. Firefox does not offer speech recognition, so the option does not appear there.

When your data does leave your browser

When you ask for a report. Your answers are sent to our server, scored, and returned. On the paid tier, the parts you wrote in your own words are also sent to a language model provider so they can be read against the diagnostic criteria. Nothing is written to disk at either step.
When you ask us to email your report. The report is passed to our email provider to deliver. It then sits in your inbox until you delete it. We keep no copy — that email is the only one.

Who processes data for us

Processor	Purpose	Where
Netlify	Hosting and running the site	United States
Stripe	Payments; holds your email and card details	Ireland and United States
Brevo	Sending your resume link and, if requested, your report	European Union (France)
OpenRouter	Reading your written answers against the criteria (paid tier only)	United States

Transfers to the United States rely on the EU–US Data Privacy Framework or on Standard Contractual Clauses. We do not sell your data, we do not advertise, and we run no analytics or tracking of any kind.

Open item: free language-model tiers commonly reserve the right to train on submitted content. Confirm your provider’s terms and, if that is the case, either move to a paid tier with training disabled or say so plainly here. Health disclosures in a training set is the single worst outcome available to this product.

Cookies

We set one cookie, after payment or after you redeem an access code. It records that you are entitled to the assessment you paid for, is signed so it cannot be altered, and expires after 30 days. It is strictly necessary for the service to work, so we do not ask for consent to set it. We use no analytics, advertising, or tracking cookies.

Your rights

You have the right to access, correct, erase, restrict, and port your data, and to object to processing. In practice most of these are immediate and in your hands: your assessment lives in your browser, and clearing your browser data erases it completely.

For anything we do hold — your email address at Stripe, or the opaque link identifier — write to [CONTACT EMAIL] and we will act within one month. You may also complain to the Portuguese supervisory authority, the Comissão Nacional de Protecção de Dados (cnpd.pt), or to the authority where you live.

Children

Mindalva is for adults. The instruments it uses are validated in adults, and it is not suitable for anyone under 18.

Changes

If we change how we handle your data we will update this page and the date at the top. Material changes affecting data we already hold will be notified by email where we have one.