Privacy Policy | Mindfulness Inc.

This policy explains what personal data Mindfulness Inc. collects when you use our website, our events and our AI companions (on WhatsApp, on the web and in our iOS apps), why we collect it, who helps us process it, how long we keep it, and what you can do about it.

Who we are

Mindfulness Inc. is operated by Buddha in the Boardroom, a Dutch sole proprietorship of Koen van den Biggelaar, registered with the Netherlands Chamber of Commerce (KvK) under number 96493798. We are the controller of the personal data described here. For anything about your data, write to koen@mindfulnessinc.org.

What we collect

Your account. Your email address, your name, and your phone number when you use a companion on WhatsApp or add it to your account. Sign-in is handled by Amazon Cognito; we never see your password.
Your conversations. The messages you send a companion and its replies, plus short summaries and notes the companion keeps so it can remember you between conversations. Conversations are stored encrypted.
Voice. When you speak to a companion in our app, your speech is turned into text by Amazon Transcribe in Frankfurt as you talk. The audio is never stored; only the resulting text becomes part of the conversation. WhatsApp voice notes are transcribed the same way and the audio is deleted once the text exists. Spoken replies are generated by Amazon Polly from the reply text and are not stored either.
Photos and documents. If you send a photo or a document, the companion reads it to answer you. The text of a document, or a short description of a photo, becomes part of the conversation. The file itself is held in temporary storage and deleted automatically within one to three days, unless the companion offers to keep a photo and you ask it to. A kept photo stays until you ask the companion to let it go, delete your data, or twelve months pass.
Payments. Subscriptions are paid through Stripe. We receive whether your subscription is active, not your card details. Paid sessions with a teacher are paid through Stripe to that teacher's own account; we keep the booking (time, name, payment status).
Notifications. If you allow notifications in our app, we store the device token Apple provides so we can let you know a reply has arrived.
Website and events. What you submit through our contact form or an event registration: usually your name and email address. The website uses essential cookies only and no marketing or analytics trackers.
Technical records. Technical logs that record requests to our services and whether they succeeded, used for security and troubleshooting. They are deleted after at most 90 days.

Sensitive information

Conversations with a companion about meditation, wellbeing or your inner life can contain sensitive information, such as details about your health or your beliefs. You decide what you share. We use it only to hold the conversation you asked for. We never use it for advertising, we never sell it, and we do not build profiles of you for anyone else.

Private conversations and groups

Some companions can also take part in a group. What you say to a companion in a private conversation never reaches a group: the companion does not quote it, summarise it or draw on it there, in any group and on any channel. If you want something from your private conversation in a group, you copy it in yourself. Nothing said in a group before you joined is brought up once you are in it.

Why we use it

To provide the service you signed up for (performance of a contract): holding conversations, remembering context, voice, notifications, bookings and subscriptions.
To keep the service safe and fair (legitimate interest): security, preventing abuse, and fair-use limits so one account cannot exhaust a companion for everyone.
To meet legal obligations: keeping payment and invoice records as Dutch tax law requires.
With your consent, where we ask for it, for example to keep a photo. You can withdraw consent at any time.

We do not make decisions about you by automated means that have legal or similarly significant effects.

Who processes your data for us

Amazon Web Services hosts our services, database, sign-in, speech processing and notifications, in the Frankfurt region (Germany).
Anthropic provides the AI model that writes the companion's replies. To answer you, your message and the relevant conversation context are sent to Anthropic in the United States. Under its commercial terms Anthropic does not use this data to train its models and keeps it only for a limited period. When a companion searches the web for you, the search runs through Anthropic's search service.
Meta (WhatsApp), if you talk to a companion on WhatsApp. WhatsApp's own privacy policy applies to your use of WhatsApp.
Apple, if you use our iOS app: app distribution (App Store and TestFlight) and push notifications.
Stripe for payments.
Microsoft for our email, if you write to us.

Where data goes to a provider outside the European Economic Area, such as Anthropic in the United States, the transfer is covered by the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework.

How long we keep it

Conversations: each message and summary is deleted automatically twelve months after it was written, unless a companion has a different period agreed for its setting (you can ask us which applies).
Temporary files (photos, documents, voice notes): deleted within one to three days, or at once after transcription for voice notes.
Kept photos: until you let them go or delete your data, and never longer than twelve months.
Your account: for as long as you have one.
Technical logs: at most 90 days.
Payment and invoice records: seven years, as Dutch tax law requires.

Your rights

Under the GDPR you have the right to access your data, to correct it, to have it deleted, to restrict or object to its use, to receive it in a portable form, and to withdraw consent. Much of this you can do yourself:

Export your conversations from your account settings on the web or in the app.
Forget a companion's conversations with you, or delete your account, from your account settings. On WhatsApp, send "forget me" to the companion and confirm.
For anything else, write to koen@mindfulnessinc.org. We answer within one month.

If you are not satisfied with how we handle your data, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Security

Data is encrypted in transit and at rest, conversations with their own encryption key. Access to production systems is limited to the people who run the service.

Age

Our services are intended for people aged 18 and over.

Changes

When we change this policy we update this page and the date below. If a change matters for how we use your data, we tell you in the companion or by email before it takes effect.

Last updated: 8 October 2026