This page is read together with our Privacy Policy and Data Processing Agreement. We do not sell your personal data, and we use no third-party analytics provider.
Mind Friend AB (Sweden) · talk@mindfriend.com
1.
Providers
Stripe
(Stripe Payments Europe Ltd)
- Purpose
- Payment processing and payouts
- Location
- Ireland (EEA)
- Legal basis
- Art. 6(1)(b) contract
- International-transfer safeguard
- None needed (EEA) — Stripe DPA + EU SCCs
Cloudinary
- Purpose
- Storage of media files shared in chat (audio/image/video); deleted under the 14-day chat retention
- Location
- United States
- Legal basis
- Art. 6(1)(b) (on the Professional’s behalf)
- International-transfer safeguard
- SCCs + UK Addendum
Amazon Web Services (AWS)
- Purpose
- Platform hosting and data storage
- Location
- London, United Kingdom (eu-west-2)
- Legal basis
- Art. 6(1)(b) / 6(1)(f)
- International-transfer safeguard
- EU→UK adequacy decision; AWS Art. 28 DPA
Stream
(Stream.io, Inc.)
- Purpose
- Video/audio session infrastructure
- Location
- EU (Dublin, Ireland)
- Legal basis
- Art. 6(1)(b) (on the Professional’s behalf)
- International-transfer safeguard
- None needed (EEA) — Stream DPA
Mailjet / Sinch
- Purpose
- Transactional email (confirmations, reminders)
- Location
- France (EEA)
- Legal basis
- Art. 6(1)(b) contract
- International-transfer safeguard
- None needed (EEA)
Google reCAPTCHA
- Purpose
- Bot / abuse protection on our forms
- Location
- United States
- Legal basis
- Art. 6(1)(f) security & fraud prevention
- International-transfer safeguard
- SCCs + UK Addendum
OpenAI
- Purpose
- AI help assistant — answers product questions from our own help content and suggests Professionals via deterministic matching (not a clinical tool)
- Location
- OpenAI Ireland Ltd; processing in the US
- Legal basis
- Art. 6(1)(f) user support
- International-transfer safeguard
- SCCs + UK Addendum; Zero Data Retention
Analytics
- Purpose
- Understanding how the marketplace is used (search → profile → booking)
- Location
- First-party — operated by MindFriend
- Legal basis
- Art. 6(1)(f)
- International-transfer safeguard
- None — no third-party analytics provider
Identity / credential checks
- Purpose
- Administrative credential checks of professionals’ registration at onboarding (not a verification or endorsement — see Terms of Use §5)
- Location
- Manual — no third-party service
- Legal basis
- Art. 6(1)(c) / 6(1)(f)
- International-transfer safeguard
- n/a
| Provider | Purpose | Location | Legal basis | International-transfer safeguard |
|---|---|---|---|---|
| Stripe(Stripe Payments Europe Ltd) | Payment processing and payouts | Ireland (EEA) | Art. 6(1)(b) contract | None needed (EEA) — Stripe DPA + EU SCCs |
| Cloudinary | Storage of media files shared in chat (audio/image/video); deleted under the 14-day chat retention | United States | Art. 6(1)(b) (on the Professional’s behalf) | SCCs + UK Addendum |
| Amazon Web Services (AWS) | Platform hosting and data storage | London, United Kingdom (eu-west-2) | Art. 6(1)(b) / 6(1)(f) | EU→UK adequacy decision; AWS Art. 28 DPA |
| Stream(Stream.io, Inc.) | Video/audio session infrastructure | EU (Dublin, Ireland) | Art. 6(1)(b) (on the Professional’s behalf) | None needed (EEA) — Stream DPA |
| Mailjet / Sinch | Transactional email (confirmations, reminders) | France (EEA) | Art. 6(1)(b) contract | None needed (EEA) |
| Google reCAPTCHA | Bot / abuse protection on our forms | United States | Art. 6(1)(f) security & fraud prevention | SCCs + UK Addendum |
| OpenAI | AI help assistant — answers product questions from our own help content and suggests Professionals via deterministic matching (not a clinical tool) | OpenAI Ireland Ltd; processing in the US | Art. 6(1)(f) user support | SCCs + UK Addendum; Zero Data Retention |
| Analytics | Understanding how the marketplace is used (search → profile → booking) | First-party — operated by MindFriend | Art. 6(1)(f) | None — no third-party analytics provider |
| Identity / credential checks | Administrative credential checks of professionals’ registration at onboarding (not a verification or endorsement — see Terms of Use §5) | Manual — no third-party service | Art. 6(1)(c) / 6(1)(f) | n/a |
2.
International transfers
Where data leaves the UK/EEA, we rely on: the EU→UK adequacy decision for UK hosting; and EU Standard Contractual Clauses with the UK Addendum (plus the provider's Art. 28 DPA) for providers processing outside the UK/EEA. For UK→US transfers we rely on SCCs + UK Addendum — we do not rely on the EU-US Data Privacy Framework.