# Privacy (last updated July 2026)

Feedmind is based in Luxembourg and operates under the GDPR. This page is written to be read, not to be survived. If anything here is unclear, write to privacy@getfeedmind.com and we will fix the wording.

## 01 — What a scan processes
The store URL you type, and the publicly available content of the pages we fetch from it — the same pages any browser or search crawler can load, without executing JavaScript. We do not log in, we do not bypass access controls, and we never touch order, customer or payment data.
## 02 — What we store about you
Nothing until you unlock the AI simulation. At that point we store the email address you enter and link it to the scan you ran, plus an optional marketing-consent flag that defaults to off. No password, no profile, no tracking pixels on this page. Submitter IPs are stored only as salted hashes, used to rate-limit abuse — never the raw IP.
## 03 — Why we process it
To run the check you asked for, to show you your scorecard, and — if you unlock the simulation — to follow up once about it. Legal basis: performance of a service you requested, and our legitimate interest in following up about a check you deliberately started.
## 04 — What we never do
We do not sell, rent or share your email with advertisers or data brokers. We do not enrich it against third-party databases. We do not add you to an unrelated newsletter, and marketing email only happens if you tick the consent box.
## 05 — Analytics
We measure aggregate usage with Plausible, a cookieless, EU-hosted analytics tool. It sets no cookies, stores no personal data, and does not track you across sites or build a profile — just anonymous page views and a handful of funnel counts. There is nothing to consent to and nothing to opt out of.
## 06 — Sub-processors
Cloud hosting on Google Cloud (EU, europe-west1); our database on Supabase (EU, Frankfurt); the configured large-language-model API for the simulation (Anthropic, OpenAI or Google), which processes public storefront content only; Scaleway Transactional Email (EU, France) to send your results link and any booking confirmation; and Google Calendar — only if you book a walkthrough — to hold the 15-minute slot and invite you as an attendee. Transfers outside the EEA rely on Standard Contractual Clauses.
## 07 — Retention
Scan results are kept so a scorecard link keeps working; email addresses are kept until you ask us to remove them. One request is enough — no retention appeal, no dark pattern.
## 08 — Your rights
Access, rectification, erasure, restriction, portability and objection, under Articles 15 to 21 GDPR. Write to privacy@getfeedmind.com and we answer within 30 days, usually the same week.
## 09 — Supervisory authority
Commission nationale pour la protection des données (CNPD), Luxembourg. You may lodge a complaint with them at any time, and we would rather you told us first so we can fix it.
## 10 — Contact
Feedmind, Luxembourg, Grand Duchy of Luxembourg · privacy@getfeedmind.com

_Draft — pending legal review._