Legal
Privacy policy
Last updated: 2026-11-10 · Applies to MindReset (mindresetmethod.com)
This full privacy notice explains which data MindReset processes, why, who we share it with and how you exercise your rights. We wrote it to be understood; if anything is unclear, write to hola@mindresetmethod.com.
1. Controller
Controller: Francisco Manuel Mier y Terán Almazán (individual (natural person)), Av. Vallendar 110, Colinas del Santuario, Querétaro, Qro., C.P. 76904, México. Privacy contact: hola@mindresetmethod.com. "MindReset" is the trade name of the service, not a company. More details in the Legal notice.
2. Data we process
| Category | Data |
|---|---|
| Account | E-mail, display name, password (hash only), language, country, time zone, sign-up date, your declaration of being 18 or older, reminder preferences and a record of your consents (what you accepted, text version and date). |
| Practice and playback | Sessions started and completed, credited listening minutes, player position, streaks and compliance. |
| Sensitive personal data | Health and habit data: your daily consumption logs (cigarettes, drinks or other units), your baseline, cravings beaten, your mood, your notes and "I did it" declarations with their testimonial. We process them only with your explicit, separate and revocable consent; without it the audio and the plan work the same. The program you choose or buy can also reveal your health (for example alcohol, cannabis, mood, anxiety, weight or sugar): we use it only to give you that program and for invoicing, and we never send it to Google, Meta or advertisers. |
| Security | Hash of your IP address (never the raw IP), user agent, technical browser fingerprint, playback anomaly counters and audit logs. |
| Payments | Handled by Stripe. We store the Stripe customer and subscription ids, amount, currency, country, order status and, if Stripe exposes them, the card brand and last four digits. We never store your full card number. |
| Attribution | Campaign parameters (utm_*), referrer and landing page and, when present, Google and Meta click identifiers (gclid, fbclid), which are online identifiers. Kept in the mr_attr cookie and on your order if you buy. |
| Analytics and advertising | Only if you accept optional cookies: Google Analytics 4, Google Ads tag and Meta Pixel. We never send them your check-ins, mood or notes. |
| Support | What you write to us through the form or by e-mail. |
3. Purposes
Primary purposes (needed for the service you sign up for): create and protect your account; provide the programs and the 30-day plan; show you your progress (sensitive data only with your consent); charge, invoice and handle refunds; answer support; prevent fraud, downloads and account sharing; meet legal obligations.
Secondary purposes (not needed): sending you practice tips and offers by e-mail, and measuring visits and ad performance with Google and Meta cookies. You can refuse at sign-up (the offers box is never pre-ticked), at any time in your profile or the cookie banner, or by writing to hola@mindresetmethod.com. Refusing does not affect the service.
4. Legal basis
Performance of the contract (account, playback, payments, support); legitimate interest (security and fraud prevention); legal obligations (tax); your consent for offers by e-mail, analytics and advertising; and your explicit consent for health data (sensitive personal data under Mexico's LFPDPPP, GDPR art. 9(2)(a) and LGPD art. 11 I).
5. Processors, recipients and international transfers
| Recipient | Country | Purpose | Needs your consent? |
|---|---|---|---|
| Microsoft Azure (Microsoft Corporation) | USA | Hosting, database, audio storage, technical monitoring (Application Insights). Processor. | No |
| Azure Communication Services (Microsoft) | USA | Sending transactional e-mails (confirmations, reminders you turn on). Processor. | No |
| Stripe | USA / Ireland | Payment processing and payment fraud prevention. | No |
| Zoho | USA / EU | Support and privacy mailbox. Processor. | No |
| USA | Sign in with Google, only if you choose it; Google Analytics 4 and Google Ads, only with accepted cookies. | Yes (analytics and ads) | |
| Meta Platforms | USA / Ireland | Meta Pixel to measure ads, only with accepted cookies. | Yes |
| Browser push services (Google FCM, Mozilla, Apple) | USA | Delivering the notifications you turn on. | Yes (when you turn them on) |
| Authorities | — | When a law or a court order requires it. | No |
We never share your health data, journal or listening history with Google, Meta or advertisers, and we do not sell your data. The controller is in Mexico and the data is hosted in the USA (Azure South Central US region). Transfers to processors rely on data processing agreements; for people in the European Union, on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (Decision 2021/914); for Brazil, on the ANPD standard clauses.
6. Retention
- Account and practice data: while the account exists.
- Health data: while the account exists and your consent is in force. If you withdraw or refuse it, we erase it immediately. The program you are enrolled in is kept while the account exists, because without it we cannot give you the plan.
- When you delete your account we immediately erase your journal, your health records and your enrolments. We keep orders and payments (product bought, amount, date and country) for the tax period (5 years in Mexico, CFF art. 30; 10 years for EU sales if we are registered in OSS). They contain neither your journal nor your health records, but the product name can reveal which program you bought, so we use them only for tax, accounting and payment disputes. We also keep the latest version of each consent, without the IP or the program, as legal proof.
- Technical playback identifiers (IP hash, user agent, fingerprint): 12 months. When you delete your account they are erased at once; only the listening counters (session and minutes), without any device data, remain to prevent fraud and settle payment disputes.
- Support e-mails: 24 months.
7. Your rights (ARCO, GDPR, LGPD)
You can access, rectify and erase your data, object to its processing, ask for portability and withdraw your consent. You can do most of it yourself in your profile: edit your data, download a copy (JSON), withdraw the health-data consent (and erase that data) and delete your account.
Procedure: write to hola@mindresetmethod.com from your account's e-mail address with your name, the right you are exercising and, where relevant, which data and why. If you do not write from your account address we may ask you to prove your identity. We answer within 20 business days (Mexico) or one month (EU); if you live in Brazil, confirmation and full access within 15 days. When the request is granted we carry it out within 15 business days of our answer.
If you are not satisfied you can complain to a data protection authority: in Mexico, the Secretaría Anticorrupción y Buen Gobierno, the supervisory authority under the LFPDPPP; in the EU, your country's authority (for example AEPD in Spain, CNIL in France, CNPD in Portugal or your Land authority in Germany); in Brazil, the ANPD; in the UK, the ICO.
8. Withdrawing consent and limiting use
At any time you can withdraw the health-data consent (Profile > Health data), the offers-by-e-mail consent (Profile, or the unsubscribe link in every e-mail), the cookie consent (cookie settings) and notifications (Profile > Reminders). Withdrawal does not affect processing carried out before.
9. Minors
The service is only for people aged 18 or older; you declare it when you sign up. If we detect an account of a minor we delete it.
10. Security
Encryption in transit (TLS) and at rest, hashed passwords, audio only through short-lived tokens, role-based access control, audit logs and lockout after failed attempts. If a breach significantly affects your rights we will tell you without delay by e-mail: what happened, which data was affected, what we did and what you can do.
11. Changes to this notice
Current version: 2026-11-10. We publish every change here with its date. If a change is material (new purposes, new sensitive data or new recipients) we will tell you by e-mail and in the app and, where the law requires it, ask for your consent again.