Privacy Policy

Data Controller: MINDLINK TEC LTD, a company registered in England and Wales (Company No. 15278705).

Registered Address: 50 Princes Street, Ipswich, Suffolk, United Kingdom, IP1 1RJ.

Contact Email: service@mindlink.tools

If you are in the EEA or the UK, you have the right to lodge a complaint with your local data protection supervisory authority. In the UK, this is the Information Commissioner's Office (ico.org.uk).

We collect the following categories of personal data:

Device Information — Browser fingerprint (UUID), User Agent string, IP address. Collected automatically on first visit. Legal basis: legitimate interest (service security, fraud prevention).

Account Information — Email, phone number, hashed password, nickname, avatar. Collected from user registration. Legal basis: performance of contract.

User Content — Photographs uploaded for processing. Collected from user upload. Legal basis: performance of contract.

Generated Content — AI-generated images, style selections, timestamps. Generated during use. Legal basis: performance of contract.

Usage Data — Generation history, operation timestamps, quota usage. Generated during use. Legal basis: legitimate interest (service improvement).

Order Data — Product name, amount, currency, payment status, timestamps. Collected when payment completes via Stripe. Legal basis: performance of contract.

Language Preference — Selected language (zh/en). Collected from user selection or browser detection. Legal basis: consent.

Communication Data — Any information you provide when contacting us. Collected from user correspondence. Legal basis: legitimate interest (customer service).

We collect information through:

3.1 Information you provide directly: Registration forms, image uploads, payment information submission (via Stripe), and communications with us.

3.2 Automatically collected information: Device fingerprint and token generated and stored in your browser's localStorage; IP address via server logs; language preference via localStorage.

3.3 Third-party sources: Stripe provides us with payment confirmation data (product purchased, amount, timestamp) but NOT your full payment card details.

We use your personal data for the following purposes:

Provide AI image generation — Uses Account, User Content, and Generated Content. Lawful basis: contract performance.

Process payments and issue credits — Uses Account and Order Data. Lawful basis: contract performance.

Maintain account and history — Uses Account and Usage Data. Lawful basis: contract performance.

Fraud prevention and abuse detection — Uses Device Info, IP address, and Usage Data. Lawful basis: legitimate interest.

Service improvement (aggregate analytics) — Uses Usage Data (anonymized). Lawful basis: legitimate interest.

Customer support — Uses Communication Data. Lawful basis: legitimate interest.

Google Ads conversion tracking — Uses anonymous event data (no personal identifiers). Lawful basis: consent.

Internal operational notifications via Slack — Uses anonymous event names only. Lawful basis: legitimate interest.

We do NOT use your content or data for AI model training or improvement.

We share data only with essential service providers:

Stripe, Inc. (USA) — Email and order details (product, amount) for payment processing. Safeguards: Standard Contractual Clauses (SCCs).

Supabase / Zapatos, Inc. (USA) — Account info, usage data, and order history for database and authentication hosting. Safeguards: SCCs.

tzylab.com (custom backend) — All service-related data for core hosting and processing. Safeguards: contractual data processing agreement.

Google LLC (USA) — Anonymous conversion events (no personal identifiers) for advertising conversion measurement. Safeguards: SCCs.

Slack / Salesforce (USA) — Anonymous event names only for internal notifications. Safeguards: SCCs / DPA.

We do not sell your personal data to third parties.

We may also disclose data if required by law, court order, or to protect our legal rights.

As a UK-based company serving a global user base, your personal data may be transferred to and processed in countries outside the UK and EEA, including the United States (where our service providers Stripe, Supabase, Google, and Slack are based).

When transferring data outside the UK/EEA, we ensure appropriate safeguards are in place, including: - Standard Contractual Clauses (SCCs) adopted by the European Commission and UK Addendum - Data Processing Agreements with our service providers

By using the Service, you acknowledge these international data transfers.

7.1 Storage. Your data is stored on Supabase (PostgreSQL) and custom backend (tzylab.com) servers with industry-standard security measures.

7.2 Encryption. All data transmitted between your device and our servers is encrypted using HTTPS/TLS.

7.3 Passwords. Passwords are hashed and salted — we never store plain-text passwords.

7.4 Retention Periods: - Account data: Retained for as long as your account is active. Upon deletion request, data is deleted within 30 days unless retention is required by law. - Generated images: Accessible through your account history. Upon account deletion, images are no longer accessible. - Device fingerprint data: Stored in your browser's localStorage — you can clear it at any time via browser settings. - Payment data: Stripe retains payment records per its own retention policy. We retain only order metadata.

Depending on your jurisdiction, you may have the following rights under applicable data protection law (UK GDPR, EU GDPR, China's PIPL):

Right of Access — Request a copy of your personal data. Exercise via Account page or contact us.

Right to Rectification — Correct inaccurate data. Exercise via Account page (nickname) or contact us.

Right to Erasure ("Right to be Forgotten") — Request deletion of your data. Contact us at service@mindlink.tools.

Right to Restrict Processing — Limit how we use your data. Contact us.

Right to Data Portability — Receive your data in a machine-readable format. Contact us.

Right to Object — Object to processing based on legitimate interest. Contact us.

Right to Withdraw Consent — Withdraw consent where processing is based on consent. Contact us or update preferences.

Right to Complain — Lodge a complaint with your local supervisory authority. ICO (UK): ico.org.uk.

We will respond to your request within 30 days. We may require proof of identity before processing your request.

9.1 Browser LocalStorage. We use browser localStorage rather than traditional cookies for core functionality: - bobi_token: Authentication token (essential, until cleared) - bobi_fp: Device fingerprint (functional, until cleared) - bobi_lang: Language preference (functional, persistent)

9.2 Google Ads Cookies. We use Google Ads conversion tracking, which may place _gcl_* cookies for conversion measurement. Google Ads cookie usage is governed by Google's Privacy Policy. You can manage Google Ads settings at adssettings.google.com.

9.3 Opt-Out. You can clear all localStorage data at any time via your browser settings. This may affect service functionality (e.g., you will need to log in again).

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has provided us with personal data, we will delete it promptly. If you believe a child under 13 has provided us with personal data, please contact service@mindlink.tools.

For users in China: The minimum age for using the Service is 14, consistent with the Personal Information Protection Law (PIPL).

We may update this Privacy Policy from time to time. Material changes will be notified via the Service (website notice or email). We encourage you to review this policy periodically.

Data Controller: MINDLINK TEC LTD Email: service@mindlink.tools Address: 50 Princes Street, Ipswich, Suffolk, United Kingdom, IP1 1RJ

Supervisory Authority: Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF ico.org.uk