Privacy Policy

1. Who we are

MIND-IDIA ("we", "us") is a family-safe learning and games platform operated by ASM Professional Services, registered in the Netherlands (KVK 42137630, VAT NL005526019B33). We are the data controller for the personal data described here. Contact for all privacy questions, including our data protection contact: support@mind-idia.com.

This policy applies to the MIND-IDIA website and app. It takes into account the EU General Data Protection Regulation (GDPR), the Dutch GDPR Implementation Act (UAVG), the UK GDPR, and laws in other countries where MIND-IDIA is offered, including the US Children's Online Privacy Protection Act (COPPA), the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and the UAE Child Digital Safety law (Federal Decree-Law No. 26 of 2025). Referring to these laws does not mean any authority has approved MIND-IDIA.

Children's data and consent ages differ by country. Under GDPR Article 8, where data is processed on the basis of consent, a parent must consent for children below an age set by each EU country, between 13 and 16 (GDPR, EUR-Lex). The UK age is 13. COPPA protects children under 13 in the US (FTC COPPA Rule, amended April 2025). The UAE Child Digital Safety law requires explicit, documented and verifiable parental consent for children under 13 (Article 7) and treats everyone under 18 as a child (UAE Legislation). Rather than apply different rules per country, MIND-IDIA requires a parent or guardian for every player under 18. How that works is explained in our Children's Privacy & Safety policy.

2. Who can use MIND-IDIA

• Only adults aged 18 or over can create an account (the "account holder").
• An account holder can add one adult profile and up to two child profiles. Children never create their own account and never sign in with an email address.
• When an account holder adds a child profile they confirm they are that child's parent or legal guardian and give consent before the child can play. Each consent is recorded (purpose, policy version, method, date and time, status), can be withdrawn at any time in Parent controls, and is requested again when the children's policy changes. Account holders who sign in with Google confirm they are 18+ and accept the Terms on first sign-in. See our Children's Privacy & Safety policy for details.

3. What data we collect

We do not collect: a child's date of birth, surname, photo, voice, video, precise location, school, contacts, or any health information. We do not use microphone or camera. We do not collect special-category data.

4. Why we use your data and our legal basis

We do not send marketing newsletters. If we ever offer them, we will ask for your consent first.

5. Automated tools and AI

Game suggestions and difficulty are chosen by fixed rules we wrote, not by AI. AI-assisted tools helped us draft some questions in our fixed question library, and some marketing images, videos and voices are made with AI and labelled "Made with AI". We do not send players' or children's information to AI services, and we do not use it to train AI. No automated decision has legal or similarly significant effects on anyone (GDPR Art. 22). There is no chatbot, voice assistant or avatar that talks to players. See How MIND-IDIA Uses AI.

6. No advertising, no selling, no profiling for marketing

MIND-IDIA shows no advertising, contains no advertising trackers, and never sells, rents or trades personal data. We do not build marketing profiles of children.

7. Who we share data with

Only with service providers ("processors") that help us run MIND-IDIA, under written data-processing agreements, and only as far as needed:

• Lovable Cloud: hosting, database, sign-in and account emails (built on Supabase and served through Cloudflare's network). Our database is hosted in London, United Kingdom.
• Stripe: payments, fraud checks and invoices. Stripe is an independent controller for some payment data.
• Google: only if you choose "Continue with Google" to sign in.
• Zoho Mail: hosts our support@mind-idia.com inbox, where contact-form messages and support emails are received.

We may disclose data if required by law, a court order, or to protect the safety of a child or the public. How we report harmful content to the police and other authorities, including in the UAE, is explained in our Harmful Content Reporting Procedure. If MIND-IDIA is ever sold or merged, data would only transfer under this policy and you would be told first.

8. International transfers

Some providers may process data outside the European Economic Area. When that happens we rely on an EU adequacy decision or the European Commission's Standard Contractual Clauses, plus extra safeguards where needed. Our database is in the United Kingdom, which has an EU adequacy decision. Some providers are based in the United States; those transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses.

9. How long we keep data

10. Your rights

You (and a parent on behalf of their child) have the right to:

• Access — get a copy of your data.
• Rectification — correct wrong data (most can be changed yourself in the app).
• Erasure — have your account or a child profile deleted.
• Restriction and objection — limit or object to certain use.
• Portability — receive your data in a common machine-readable format.
• Withdraw consent at any time, including parental consent. Play stops straight away; progress is kept unless you also delete the profile.
• Complain to a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); you may also contact the authority in your own country. UK: Information Commissioner's Office (ico.org.uk). UAE: UAE Data Office. Elsewhere: your local data protection authority.

Email support@mind-idia.com from the address on the account. We reply within one month (extendable by two months for complex requests, in which case we tell you). We may ask you to confirm your identity. Exercising your rights is free.

How we handle requests

Support and privacy requests are accepted only from parents or legal guardians, or adults of legal age in their country. A child's request must come from the parent account holder. Send requests from the email address on the account; we may ask you to confirm by replying from that address, and for deletion or export involving a child we may ask you to use your parent PIN in Parent controls. We do not ask for ID documents unless we cannot otherwise confirm who you are. We log each request and reply within one month (extendable by two months for complex requests; 45 days for US state law requests). Exceptions: we keep invoices for tax law, and we may keep data needed to defend legal claims or prevent abuse.

California and other US states

We do not sell or "share" personal information for cross-context behavioural advertising. US residents may request to know, correct or delete their information using the same email address, and will not be treated differently for doing so.

11. Security

• Encrypted connections (HTTPS) everywhere.
• Passwords and parent PINs stored only as one-way hashes; PIN locks after repeated wrong attempts.
• Access rules checked on our servers for every request, so one family can never see another family's data.
• Play-time limits and scores enforced on our servers, not only in the browser.
• Staff access limited to what is needed, and logged.

If a data breach is likely to put your rights at risk, we will notify the supervisory authority within 72 hours and inform affected account holders without undue delay.

12. Cookies and local storage

We use only strictly necessary storage (sign-in session, preferences). Our fonts are served from our own website, so no font service receives your IP address. No advertising or tracking cookies. See our Cookie Policy.

13. Changes to this policy

If we make important changes we will notify account holders by email or in the app at least 30 days before they take effect, and ask for fresh consent where the law requires it. The version and date are shown at the top of this page.

14. Contact

ASM Professional Services, the Netherlands · KVK 42137630 · VAT NL005526019B33
Email: support@mind-idia.com

15. Version history and amendments

This version is the current and final policy. It replaces all earlier versions from its effective date. Effective date: 16 October 2026.