Privacy policy

Myndel ("we", "us") is a digital loyalty platform operated from Helsinki, Finland. We act as a data controller for shop owner account data, and as a data processor for customer data collected on behalf of shops.

Contact us at hello@myndel.app for any privacy-related questions.

We process personal data under the following lawful bases:

• Contract — processing necessary to provide the Myndel service to shop owners
• Consent — loyalty and marketing emails sent to participants, based on explicit opt-in at registration
• Legitimate interests — security logging, fraud prevention, platform improvement, and contacting businesses that may want to use Myndel (see section 10)
• Legal obligation — retaining certain records as required by Finnish and EU law

We use the data we collect to:

• Operate the Myndel platform and provide the loyalty card service
• Send loyalty emails (stamp updates, reward alerts, reminders) — with loyalty consent, which is required to join a card
• Send marketing emails (promotions, news, win-back messages) — only with the separate marketing consent, which is optional and can be withdrawn at any time
• Allow shop owners to manage their customer relationships
• Contact businesses that may want to use Myndel, and keep track of those conversations
• Improve the platform and fix technical issues
• Comply with legal obligations

Apart from contacting businesses as section 10 describes, we do not use your data for advertising, profiling, or automated decision-making that has legal or significant effects.

We share data only with the following categories of recipients:

• Supabase — our database and authentication provider. Data is stored in their EU (Ireland) region. Supabase is GDPR-compliant and has a Data Processing Agreement in place.
• Resend — our email delivery provider. Email content and recipient addresses are shared only to deliver the emails the platform sends. Resend is GDPR-compliant.
• Vercel — hosts the platform. As the host it necessarily receives the ordinary requests your browser makes, but it is sent no visitor analytics: we removed Vercel Analytics and Speed Insights along with Google Analytics and Microsoft Clarity.
• Microsoft — our mailbox for hello@myndel.app is on Microsoft 365, so the messages you send to that address, and the emails we write to you by hand from it, pass through Microsoft and are kept there.
• Shop owners — shops can see the data of their own customers. They cannot see data from other shops.

We do not sell, rent, or share your data with advertisers or data brokers. Ever.

Our database, which holds the data the platform collects, is hosted in the European Union (Ireland). We use industry-standard security measures including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Row-level security ensuring shops can only access their own customers' data
• Hashed passwords — we never store passwords in plain text
• Access controls limiting which team members can access production data

Under the General Data Protection Regulation, you have the following rights:

• Right of access — you can request a copy of the data we hold about you. Loyalty participants can also download it themselves from their card page: we email a download link to the address on the card, and it works for one hour
• Right to rectification — you can correct inaccurate data
• Right to erasure — you can request deletion of your data. For loyalty participants, this can be done directly via the "delete my data" link on your card page or in any email we send you. We then email you a confirmation link, valid for 24 hours, and your data is deleted once you confirm
• Right to restrict processing — you can ask us to limit how we use your data
• Right to data portability — you can request your data in a machine-readable format
• Right to object — you can object to processing based on legitimate interests
• Right to withdraw consent — you can unsubscribe from emails at any time using the link in any email. To stop only the marketing emails (promotions, news, win-back messages) and keep the emails about your card, choose "Stop offers only" on your card page or on the page the unsubscribe link opens

To exercise any of these rights, contact us at hello@myndel.app. We will respond within 30 days.

You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) if you believe your rights have been violated.

Myndel sets two cookies, and they are the only ones:

• Authentication cookie — keeps shop owners and their staff signed in, between visits too, until they sign out; it expires after 400 days without use. This is essential for the platform to function and does not require consent under ePrivacy rules.
• Language cookie (NEXT_LOCALE) — remembers which language version of the site you last viewed. It holds only a language code, expires when you close your browser, and does not require consent under ePrivacy rules.

There are no analytics cookies, because there is no third-party analytics left to set them. Our own measurement of the public website stores nothing at all on your device — no cookie and no browser identifier — which is why you are not asked to approve anything and why this site shows no cookie banner. Google Analytics (_ga, _ga_*) and Microsoft Clarity (_clck, _clsk) used to be set here after consent; both have been removed, along with Vercel Analytics and Speed Insights. If you accepted or declined the old banner, the preference it saved is no longer read by anything.

We do not use advertising cookies and we do not sell or share your data for advertising.

We retain data for the following periods:

• Shop owner accounts — kept until the account is deleted, which you can ask us to do at any time. Deleting an account deletes its shop with it, along with that shop’s customer records, support requests and sign requests
• Setup applications and guide requests — free-setup applications, and the email addresses kept for guide and punch card requests, are not deleted automatically; ask us and we will remove them
• Customer loyalty data — retained while the shop account is active. Deleted as soon as a customer confirms an erasure request, or when the shop deletes the customer; entries about the customer in the shop’s audit log are kept with their name and contact details removed
• Email logs — the record of each email sent to a customer, including the message as sent, is kept with that customer’s record and deleted with it; the record of emails we send shop owners is kept with their account
• Technical logs — abuse-prevention counters are deleted after 7 days and website measurement records after 400 days; records of sign-ins and pages opened in the dashboard are kept with the account
• Businesses we contact — what we keep is deleted 90 days after our first message if the business never answers; while we are in touch, it is kept for as long as the conversation is useful, for example until the business starts using Myndel or says no; after a "no", we keep only the business’s name and a note not to contact it again (see section 10)

We may contact cafés, shops, salons and similar businesses by email, by phone or with a message on Instagram, to offer them Myndel. If we have contacted yours, this is what we keep about it, and why. We are the controller of this data.

• What we keep — the business’s name; its public contact details (business email address, phone number, Instagram account, website and town); the name of the person we deal with, when it is published as a contact for the business or you give it to us; where we found these details; and short notes of our exchanges
• Where it comes from — public business listings and directories, the business’s own website and social media, public registers such as the Finnish business register (YTJ), or a person who suggested we get in touch
• Legal basis — our legitimate interest in offering our service to businesses (Article 6(1)(f) GDPR)
• How we contact you — every time we get in touch, we say who we are and how to tell us no. In Finland we email only companies, never sole traders, and only at their business email address
• Saying no — reply "no" or "stop", or write to hello@myndel.app, and we will not contact you again. From then on we keep only the business’s name and a "do not contact" note, so that we can keep that promise
• How long we keep it — if you never answer, we delete it 90 days after our first message. While we are in touch, we keep it for as long as the conversation is useful, for example until the business starts using Myndel or says no
• Who sees it — we never sell it or pass it on to anyone for their own use, and it is kept in our own records. Emails pass through Microsoft, which runs our mailbox (see section 5), and a conversation on Instagram is also held by Instagram, under its own privacy policy

Your rights in section 7 apply to this data too, including the right to object at any time.

Myndel is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. Material changes will be communicated to shop owners by email at least 30 days before they take effect. The current version is always available at myndel.app/legal/privacy.

For any privacy-related questions or to exercise your rights:

hello@myndel.app

Myndel · Helsinki, Finland

Finnish Data Protection Ombudsman: tietosuoja.fi