Privacy Policy (App)
1. Privacy at a Glance
General Information
The following provides a simple overview of what happens to your personal data when you use our app. Personal data refers to all data that can personally identify you. Detailed information about data protection can be found in our privacy policy below.
Data Collection in Our App
Who is responsible for data collection in this app?
Data processing in this app is carried out by the app operator. Their contact details can be found in the imprint of this app.
How do we collect your data?
Your data is collected when you provide it to us, for example, by entering it into a contact form.
Other data is automatically collected by our IT systems when you use the app. This primarily includes technical data (e.g., the operating system, device type, or time of access). This data is collected automatically as soon as you use our app.
What do we use your data for?
Some of the data is collected to ensure the app is provided error-free. Other data may be used to analyze your usage behavior.
What rights do you have regarding your data?
You have the right to obtain information about the origin, recipient, and purpose of your stored personal data at any time without charge. You also have the right to request the correction, restriction, or deletion of this data. You can contact us at any time at the address provided in the imprint for further questions on data protection. Additionally, you have the right to lodge a complaint with the competent supervisory authority.
You also have the right to request the restriction of the processing of your personal data under certain circumstances. Details can be found in the privacy policy under "Right to Restrict Processing."
2. General Information and Mandatory Details
Data Protection
The operators of this app take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.
When you use this app, various personal data is collected. Personal data is data that can personally identify you. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.
Please note that data transmission over the internet (e.g., communication by email) may have security vulnerabilities. Complete protection of data from access by third parties is not possible.
Notice About the Responsible Entity
The responsible entity for data processing in this app is:
Jens Zihsler
Mentalee UG (limited liability)
Silcherstraße 4
89561 Dischingen
Phone: +49 152 07887438
Email: info@mentalee.com
The responsible entity is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (e.g., names, email addresses).
Withdrawal of Your Consent to Data Processing
Many data processing operations are only possible with your express consent. You can withdraw consent at any time by sending an informal email to us. The legality of the data processing carried out until the withdrawal remains unaffected by the withdrawal.
Right to Object to Data Collection in Specific Cases and to Direct Advertising (Art. 21 GDPR)
If the data processing is based on Art. 6 para. 1 lit. e or f GDPR, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions. The respective legal basis on which a processing is based can be found in this privacy policy. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims (Objection under Art. 21 para. 1 GDPR).
If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such advertising purposes; this also applies to profiling, insofar as it is related to such direct marketing. If you object, your personal data will subsequently no longer be used for direct advertising purposes (Objection under Art. 21 para. 2 GDPR).
Right to Lodge a Complaint with the Competent Supervisory Authority
In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, particularly in the Member State of their habitual residence, place of work, or the place of the alleged infringement. The right to lodge a complaint is without prejudice to other administrative or judicial remedies.
Right to Data Portability
You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract delivered to you or a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another responsible party, this will only be done to the extent technically feasible.
SSL or TLS Encryption
This app uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as requests you send to us as the app operator. An encrypted connection is indicated by the browser's address line switching from "http://" to "https://" and the lock symbol in your browser line.
If SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.
Information, Blocking, Deletion, and Correction
Within the scope of the applicable statutory provisions, you have the right to free information about your stored personal data, its origin and recipient, and the purpose of the data processing and, if necessary, a right to correct, block, or delete this data. For this purpose, as well as for further questions regarding personal data, you can contact us at any time at the address provided in the imprint.
Right to Restrict Processing
You have the right to request the restriction of the processing of your personal data. You can contact us at any time at the address provided in the imprint. The right to restrict processing applies in the following cases:
- If you contest the accuracy of your personal data stored with us, we usually need time to verify this. During the verification period, you have the right to request the restriction of the processing of your personal data.
- If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of deletion.
- If we no longer need your personal data but you need it to exercise, defend, or assert legal claims, you have the right to request restriction of the processing of your personal data instead of deletion.
- If you have filed an objection pursuant to Art. 21 para. 1 GDPR, a balance must be struck between your and our interests. As long as it has not been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.
If you have restricted the processing of your personal data, this data – apart from being stored – may only be processed with your consent or to assert, exercise, or defend legal claims or to protect the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.
3. Data Collection in App Requests
Server Log Files
The provider of the app automatically collects and stores information in so-called server log files, which your device automatically transmits to us. These include:
- Device type and version
- Operating system used
- Referrer URL
- Hostname of the accessing device
- Time of the server request
- IP address
A merging of this data with other data sources does not take place.
The collection of this data is based on Article 6(1)(f) GDPR. The app operator has a legitimate interest in the technically error-free presentation and optimization of its app – for this purpose, server log files must be recorded.
Registration in This App
You can register in our app to use additional features. The data entered for this purpose will only be used to utilize the respective offer or service for which you have registered. The mandatory information requested during registration must be provided completely. Otherwise, we will reject the registration.
For important changes, such as changes to the scope of the offer or technically necessary changes, we use the email address provided during registration to inform you in this way.
The processing of the data entered during registration is based on your consent (Article 6(1)(a) GDPR). You can revoke your consent at any time. An informal email to us is sufficient. The legality of the data processing already carried out remains unaffected by the revocation.
The data collected during registration will be stored by us as long as you are registered in our app and will then be deleted. Statutory retention periods remain unaffected.
Processing of Data (Customer and Contract Data)
We collect, process, and use personal data only to the extent necessary to establish, structure, or modify the legal relationship (inventory data). This is done based on Article 6(1)(b) GDPR, which permits the processing of data to fulfill a contract or pre-contractual measures. Personal data about the use of our app services (usage data) is collected, processed, and used only to the extent necessary to enable the user to use the service or to bill the user.
The customer data collected will be deleted after the order has been completed or the business relationship has ended. Statutory retention periods remain unaffected.
4. Third-Party Services and SDKs
Google Cloud Services (Speech Synthesis and Speech Recognition)
Our app uses Google Cloud Services, specifically the Google Cloud Text-to-Speech (speech synthesis) and Speech-to-Text (speech recognition) APIs. These services enable the virtual trainer to read texts aloud and understand your voice inputs. For this purpose, your voice inputs and text data are transmitted to and processed on Google servers. The use of these services is based on Art. 6 para. 1 lit. f GDPR (legitimate interest in providing an interactive and accessible app experience) or your consent pursuant to Art. 6 para. 1 lit. a GDPR.
For more information on data protection at Google, please visit: https://policies.google.com/privacy.
Abuse Prevention and App Integrity (Firebase App Check, Google Play Integrity & Apple App Attest)
To protect our backend systems against denial-of-service attacks, tampering, and unauthorized access by bots or manipulated app versions, we use the security service Firebase App Check provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").
Firebase App Check verifies during network connections to our servers whether the request originates from an authentic, unmodified version of our Mentalee app and is running on a trusted device:
- On Android devices (Google Play Integrity): The app uses Google's Play Integrity API. Purely technical device characteristics (e.g., operating system version, device integrity status, app signature checksum) are transmitted to Google to generate a cryptographic attestation certificate.
- On iOS devices (Apple App Attest): The app uses the hardware-backed App Attest service (part of the Apple DeviceCheck framework) provided by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland ("Apple"). Using the Apple device's security processor (Secure Enclave), a cryptographic key is generated that confirms the authenticity of the app without allowing any conclusions about your identity.
- Generation and Validation of the App Check Token: Based on the respective attestation, Google issues a time-limited security token (App Check token). This token is transmitted in the header of requests to our servers and verified purely technically by our servers.
Only cryptographic verification tokens and purely technical telemetry and attestation data are processed. In this process, no sensitive training data, health data, names, or email addresses are transmitted to Google or Apple or used for advertising purposes.
Processing is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR in ensuring the IT security of our infrastructure, protecting against abuse, and maintaining high security standards. Access to device-based security features is technically strictly necessary pursuant to applicable national telecommunications and digital services laws (such as § 25(2) No. 2 TDDDG) to ensure the security of the service requested by you.
Insofar as data is transferred to the USA, this is done on the basis of EU Standard Contractual Clauses and the EU-US Data Privacy Framework, for which both Google LLC and Apple Inc. are certified. For more information, please visit: https://firebase.google.com/docs/app-check.
Push Notifications (Firebase Cloud Messaging)
We use Firebase Cloud Messaging (FCM), a service provided by Google Ireland Limited, to send you push notifications (e.g., reminders for your daily training, streak notifications, or important app updates). For this purpose, a pseudonymous device token (FCM token), device model, system language, and the subscribed notification topic are transmitted to Firebase and stored on our servers.
Data processing is based on your consent (Art. 6(1)(a) GDPR), which you grant when first activating notifications via your operating system's permission dialog (Android / iOS). You can revoke this consent at any time in the app settings or in the system settings of your device.
For more information, please refer to the Firebase privacy policy: https://firebase.google.com/support/privacy.
Google Ads (AdMob)
In the challenge version of our app, we use Google AdMob, an advertising service provided by Google Ireland Limited, to display personalized or non-personalized advertisements (e.g., to earn extra lives in challenge mode). For this purpose, advertising IDs of your device (e.g., IDFA on iOS or Advertising ID on Android) as well as usage data may be processed. This processing is based on your consent (Art. 6 para. 1 lit. a GDPR), which you can grant or deny via the consent banner when first launching the app.
For more information on Google's use of data, please visit: https://policies.google.com/technologies/ads.