What we collect, and what we do not

Exiatoma Nikos Drosakis, Warzywnicza 31, 84-240 Reda, Poland, trading as MindHeaven®, is the controller of the data described here. Questions, requests and complaints about it go to hello@mindheaven.life and are answered by a person.

The newsletter form and the five product waiting lists collect one thing you type: your email address. Alongside it we record the context in which you gave it — the type of signup, the product if it was a waiting list, the page and the position of the form on that page, your browser language, the referring page, any campaign parameters in the link you arrived through, and the version and timestamp of the consent you ticked.

Nothing is added to any list until you confirm it. Signing up sends one email with a confirmation link; if you never click it, the address is never subscribed. The legal basis is your consent under art. 6(1)(a) GDPR, and you can withdraw it at any time — see section 7.

The consent text is versioned, so that a record of your consent points at wording you can still read:

• MH-NL-1.0 — the consent shown on the newsletter form, in force:I want to receive MindHeaven® research, editorial and selected product updates by email. I can unsubscribe at any time.
• MH-WL-2.0 — the consent shown on the product waiting list form, in force:I want to join the MindHeaven® [product name] waiting list and receive early-access, availability and launch updates by email. I can unsubscribe at any time.I want to join the MindHeaven® [product name] waiting list and receive progress updates by email, and availability updates if it is made. I can unsubscribe at any time.
• MH-WL-1.0 — the consent shown on the product waiting list form, superseded on 25 August 2026:I want to join the MindHeaven® [product name] waiting list and receive early-access, availability and launch updates by email. I can unsubscribe at any time.

Email addresses and the fields listed above are held in Brevo, a European email service that processes them on our instructions and for no purpose of its own. We do not sell, rent or trade this data, and we do not pass it to advertisers, data brokers or partners. Every email we send carries an unsubscribe link that works without contacting us.

Each form is protected by Cloudflare Turnstile, which decides whether a submission came from a person or an automated script. Making that decision involves your IP address being seen by Cloudflare. We do not store your IP address and it is never written to the mailing list. The basis is our legitimate interest under art. 6(1)(f) GDPR in not having the list filled by bots.

We use Umami only if you choose to allow analytics in the privacy centre. Until that choice is made — or if you choose necessary-only settings — the analytics script is not loaded. Umami is configured without cookies and without a cross-site identifier; it reports aggregate page use and approximate traffic source, not an advertising profile or a cross-site identity.

Necessary site functions remain available without analytics. We set no advertising or marketing category because this site does not use one. Cloudflare Turnstile is loaded only when you interact with a protected form and may set a short-lived technical cookie when an actual challenge is required. You can reopen Privacy settings from the footer at any time. Your language preference is stored separately from your analytics choice.

Our hosting provider keeps standard web server logs — time of request, address requested, response code, IP address, browser string — as every web server does. They exist for security and fault diagnosis, are not used to build any profile, and are not combined with the mailing list.

Your address stays on the list until you unsubscribe or ask us to delete it, and it is removed when you do. What remains afterwards is the record that consent was given and withdrawn — the fact, the version and the dates — because that record is the only proof that we had permission in the first place.

Under the GDPR you can ask for a copy of the data we hold about you, have it corrected, have it deleted, have its processing restricted, object to it, or receive it in a portable form. You can withdraw consent at any time, which does not affect anything done before you withdrew it. Write to hello@mindheaven.life and we will act on it.

If you think we have handled your data badly, you can complain to the data protection authority in the EU country where you live, where you work, or where the problem occurred. You do not need our agreement to do so.

When this policy changes materially, the consent versions in section 2 change with it, so a record of consent always points at the text that was actually shown. Earlier versions are available on request.