Privacy Statement

Elite Startups Management GmbH is responsible for the processing described here. Full operator details are in the imprint. For privacy questions, write to hello@xminds.app.

• Account data — email address, first name if you provide it, sign-in method (magic link or Google sign-in) and account timestamps.
• Conversation data — the messages you send and the mentor replies, the selected mentor and language, and voice-call metadata such as duration and turn count. During a voice call your microphone audio is streamed to Google (Gemini Live) in real time to produce the reply; we do not record or store the audio, but the resulting transcript can be saved to your conversation history so you can continue in text.
• Feedback — ratings, reported issues and comments you submit after a chat or call.
• Usage and diagnostics — pages viewed, actions such as starting a chat or call, referrer and campaign parameters, coarse device/browser information, and error logs.

Please do not enter sensitive personal data (health, financial, government identifiers) or personal data about other people into conversations.

• To provide the service — generating replies, saving your conversations and favourites, keeping you signed in (performance of a contract, Art. 6(1)(b) GDPR).
• To keep it working and secure — error monitoring, abuse prevention, rate limiting (legitimate interest, Art. 6(1)(f) GDPR).
• To improve quality — aggregated product analytics and voice/quality reviews on a sampled basis (legitimate interest).
• To communicate — transactional emails such as magic links and confirmations (contract). Marketing emails only with your consent, Art. 6(1)(a) GDPR.

We use a small number of providers who process data strictly on our instructions:

• Hosting, database and authentication — Lovable Cloud for application hosting and Supabase for authentication, database and media storage.
• AI model providers — the content of your messages is sent to Google (realtime voice calls via Gemini Live, mentor content, images and intro videos) and OpenAI (chat replies and speech-to-text) to generate output. They act as processors and are contractually restricted from using your content to train their models.
• Email delivery — Resend (Resend, Inc., USA) sends our sign-in links and transactional emails from notify.xminds.app; Supabase Auth triggers them.
• Payments — Paddle.com Market Ltd. (UK) acts as our Merchant of Record for Xminds Pro. If you subscribe, Paddle collects your payment and billing data (name, email, billing address, tax status, payment method) as an independent controller and sends us the subscription status, plan and billing period so we can unlock your plan. See the Paddle privacy policy.
• Advertising measurement — Google Ads (Google Ireland Ltd.), only with your consent to marketing cookies, to measure which campaigns lead to a chat, call or sign-up. Click identifiers (gclid/wbraid) and conversion events may also be sent to Google server-side via the Measurement Protocol.
• Web analytics — Google Analytics 4 (Google Ireland Ltd.), loaded only with your consent, for channel attribution and conversion measurement. Data may be transferred to Google LLC in the USA on the basis of the EU standard contractual clauses and the EU-US Data Privacy Framework.
• Social login providers — Google, and only if you choose that sign-in method. In that case Google confirms your identity to us and we receive your email address and, where available, your name.

Some providers operate outside the EU/EEA. Such transfers are covered by the EU Standard Contractual Clauses or an adequacy decision.

We do not sell your personal data and do not use it for third-party advertising.

We use strictly necessary storage to keep you signed in and to remember preferences such as language, filters and whether hero videos are muted. Product analytics is based on first-party events stored in our own database. In addition, with your consent, we use Google Analytics 4 (Google Ireland Ltd.) to understand which channels and campaigns bring visitors to Xminds and whether they start a chat, a call or an account. Google Analytics is loaded only after you accept analytics cookies, runs with IP anonymisation and Google Consent Mode v2. Advertising and personalisation storage stay switched off unless you additionally accept marketing cookies; in that case we also measure Google Ads conversions, including click identifiers such as gclid/wbraid, partly server-side. You can withdraw or change your choice at any time via the cookie settings in the footer.

Account and conversation data are kept while your account exists and are deleted within 30 days of account deletion, unless a longer period is legally required. Anonymised analytics and error logs are retained for up to 24 months. Guest conversations are held in your browser and on our servers only for as long as needed to run the session.

Subject to the conditions of applicable law, you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time with effect for the future. Account and conversation deletion is self-serve under settings and takes effect immediately. For all other requests write to hello@xminds.app — we respond within one month. You also have the right to lodge a complaint with your local data protection supervisory authority.

Xminds is not directed at children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

We update this statement when our processing changes. The current version always appears on this page with its last-updated date; material changes are announced in the app or by email. See also our Terms of Service.