Privacy Policy

Last updated: 20 June 2026

This policy explains what data MindBoost (“we”, “us”) collects, why, and the rights you have over it. We aim to collect as little as possible and to be honest about our Cognitive Profile: it measures how you perform on short games — it is not a clinical or official IQ.

1. Who we are (data controller)

MindBoost (mindboost.tech), operated by [registered legal entity & address to confirm]. Questions or requests: hello@mindboost.tech.

2. What we collect

• Account data: your name or username, email (optional), a hashed password (we never store it in plain text), role, plan, and which sign-in method you used (email/password, Google or GitHub).
• Learning data: your lesson and exercise progress and your Boosts/XP.
• Cognitive Profile data: your scores on the Mind Gym games, your domain scores and MindBoost Index, and dated snapshots of them. If you take the test without an account, the results stay on your device and are only stored by us if you create an account to save them.
• Family & school data: a parent/guardian can create dependent profiles for their children; schools and teachers can manage student accounts and class membership.
• Security & technical data: sign-in attempts, sessions and security events, used to protect accounts and prevent abuse.
• Payment data: payments are processed by Stripe. We store a Stripe customer/subscription reference — never your card number.

3. Why we use it (lawful basis)

• To provide the service (your account, courses, progress, billing) — performance of a contract.
• To save and show your Cognitive Profile — your consent, given when you choose to create an account and save results. You can withdraw it by deleting your data (section 6).
• To keep accounts secure — our legitimate interest in preventing fraud and abuse.

[final mapping of purpose → lawful basis to be confirmed by legal/DPO]

4. Children & minors

MindBoost is an educational product used by students in France. Accounts for children are created and managed by a parent/guardian, or by a school acting under appropriate authority, and that adult provides consent on the child’s behalf. We do not knowingly allow a child under the French digital-consent age ([15 — confirm handling]) to create an independent account without guardian involvement. A child’s Cognitive Profile is framed as strengths and learning style, never as a ranking or label.

5. Who we share it with

We do not sell your data. We share it only with the processors needed to run the service:

• Stripe — payment processing.
• Google / GitHub — only if you choose to sign in with them.
• Our hosting and email providers — [hosting provider/region & SMTP provider to confirm].

6. Your rights

Under the GDPR you can access, correct, export, restrict, object to, or delete your data, and withdraw consent at any time. You can:

• Export your data yourself from your account page.
• Delete your account and data from the same page, or by emailing us.
• Email hello@mindboost.tech for any other request.

If you are in France/the EU, you may also lodge a complaint with your supervisory authority (in France, the CNIL).

7. How long we keep it

We keep your account, learning and Cognitive Profile data while your account is active. When you delete your account we remove it, and we delete inactive-account data after [retention period to confirm].

8. Changes

We will update this page when our practices change and revise the “last updated” date above.

This policy is being finalised. For any question about your data, contact hello@mindboost.tech.