Last updated 24 September 2026 · In force from 24 September 2026
This policy explains how Mindixwell handles personal data when you visit https://www.mindixwell.com, buy a program or receive our emails. It is written to meet the Brazilian General Data Protection Law (LGPD, Law 13.709/2018), the EU General Data Protection Regulation (GDPR), the UK GDPR, and the privacy rules of US states such as California, because we sell internationally.
Who is responsible
The controller of your personal data is João Vitor Ferreira da Silva, trading as Mindixwell, CPF 401.806.308-30, Avenida Domingos Sorbo, 1013, 14840-260 Araraquara - SP, Brazil. Write to privacy@mindixwell.com about anything in this policy. Given the size of this business we have not appointed a formal data protection officer; João Vitor Ferreira da Silva handles these requests personally and acts as the point of contact for the purposes of LGPD article 41.
The short version
- We ask only for your name and email address. We never ask about your mental health.
- We never see your card number. Stripe handles payment.
- We do not sell personal data and never will.
- We do not tell advertising platforms which program you bought.
- No analytics or advertising scripts run unless you accept them in the cookie banner. At the time of writing none are installed.
- Our daily lesson emails are sent without open or click tracking.
What we collect and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Name and email address | Create your access link, deliver the lessons, send your daily lessons and receipts, answer support | Performance of a contract (GDPR art. 6(1)(b); LGPD art. 7, V) | 5 years after your last purchase |
| Order record: plan, amount, currency, date, country, card brand and last four digits, Stripe reference, consent record from checkout | Take payment, issue refunds, handle disputes, keep tax and consumer records | Contract and legal obligation (GDPR art. 6(1)(b) and (c); LGPD art. 7, II and V) | 5 years |
| Email delivery status (sent, delivered, bounced) and your daily email preference | Make sure lessons arrive, stop sending when you ask | Contract and legitimate interest (GDPR art. 6(1)(f); LGPD art. 7, IX) | For as long as you receive our emails, then 12 months |
| Messages you send us | Resolve your request and keep a record of what was agreed | Contract and legitimate interest | 24 months |
| Technical logs: IP address, date and time, page requested, browser | Security, abuse prevention, fixing faults. Brazilian law (Marco Civil, Law 12.965/2014, art. 15) requires application providers to keep access logs | Legal obligation and legitimate interest | 6 months |
| Measurement and advertising data, only if you accept | Understand which pages help people and whether an ad led to a purchase | Consent (GDPR art. 6(1)(a); LGPD art. 7, I) | As set by the provider, never more than 14 months |
About sensitive information
The fact that someone bought a program about anxiety, relationships or grief could suggest something about their life or health. We treat all order information as confidential. We never ask for health information, we do not build profiles, we do not share the name of the program you bought with advertising platforms, and only João Vitor Ferreira da Silva can see order records. If you choose to tell us something personal in an email, we use it only to answer you, and you can ask us to delete it at any time.
Please do not send us details about your health or crises by email. We are not a health service and cannot respond to emergencies. See where to get help.
Where your answers to the exercises go
Nowhere. The lessons ask you to write in your own notebook. Your library can remember which lessons you marked as read, and that mark is stored only in your own browser.
Who processes data for us
| Provider | What it does | Location |
|---|---|---|
| Stripe (Stripe, Inc. and Stripe Payments Europe, Ltd.) | Payment processing, refunds, fraud prevention. Stripe is also an independent controller for its own legal and fraud-prevention duties | United States, Ireland |
| Vercel Inc. | Hosts the website and the functions that deliver your library | United States, with worldwide delivery |
| Resend (Plus Five Five, Inc.) | Sends the access email and the daily lessons | United States |
| Our email mailbox provider | Receives and stores the messages you send to our addresses | Depends on provider |
Each is bound by a data processing agreement and may act only on our instructions.
International transfers
We are based in Brazil and our providers are mainly in the United States and the European Union, so your data crosses borders. Transfers from the EEA and the UK rely on the European Commission's standard contractual clauses, the UK addendum, or the EU-US Data Privacy Framework where the provider is certified. Transfers from Brazil rely on the mechanisms of LGPD article 33, including the standard contractual clauses approved by the ANPD. You can ask us for a copy of the relevant safeguards.
Emails we send
After you buy, we send your access link and receipt, then one lesson a day until you have received every lesson in your plan. Every daily lesson includes a link to stop the daily emails immediately; stopping them never affects your access. We do not add you to a marketing list without asking and we never pass your address to anyone else.
Your rights
Wherever you live, you can ask us to:
- confirm whether we process your data and give you a copy;
- correct incomplete, inaccurate or outdated data;
- delete data, or anonymise or block data that is unnecessary or processed unlawfully;
- send your data to you or another provider in a portable format;
- tell you who we have shared your data with;
- withdraw a consent you gave, and explain the consequences of not giving it;
- object to or restrict a particular use, and review decisions made solely by automated means (we make none).
Write to privacy@mindixwell.com from the address you bought with. We answer within 15 days, as LGPD article 19 requires, which is also within the GDPR's one-month limit. It is free. Residents of California and other US states with privacy laws have equivalent rights to know, delete and correct, and we do not sell or share personal information for cross-context behavioral advertising.
If you ask us to delete your data, we can no longer verify your purchase or resend your access link, and we will tell you so before acting. Records we must keep by law (for example for tax) are kept for the legal period only.
Complaints
Tell us first, and we will try to put it right. You may also complain to a supervisory authority: in Brazil, the Autoridade Nacional de Proteção de Dados (gov.br/anpd); in the EU, the data protection authority where you live; in the UK, the Information Commissioner's Office (ico.org.uk).
Security
The site is served only over HTTPS. Access links are signed with HMAC-SHA256 and cannot be guessed or altered. Lessons you have not bought are never sent to your browser. Card data never reaches our servers. Our accounts with Stripe, Vercel and our email provider are protected with two-factor authentication. If a security incident is likely to put your rights at risk, we will notify the ANPD, any other competent authority and the people affected within the legal deadlines.
Children
Our programs are sold only to adults. We do not knowingly collect data from anyone under 18. If you think a child has given us data, write to privacy@mindixwell.com and we will delete it.
Changes
If we change this policy in a way that matters to you, we will email buyers at least 30 days before the change takes effect. The date at the top of this page shows the current version.