Privacy Policy.

1. Who we are

Mente S.A. ("Mente Flow", "we", "us", "our"), Plac Zwycięstwa 2, 90-312 Łódź, Poland, is the controller of personal data collected through this website and in connection with our services.

Contact: hello@menteflow.io

2. What data we collect and why

We collect personal data only when you provide it directly or when it is generated by your use of this website.

• Contact form & email. Name, work email, company name, and message content — to respond to your enquiry. Legal basis: legitimate interest (responding to a business enquiry) or pre‑contractual steps.
• Book‑a‑call flow. Name, email, and calendar slot — to schedule the meeting. Legal basis: performance of a contract / pre‑contractual steps.
• Website analytics. Anonymous usage data (pages visited, session duration, referrer) via Microsoft Clarity and Google Analytics 4 — to understand how visitors use the site and improve it. Legal basis: legitimate interest; you may withdraw consent at any time via the cookie banner.
• Newsletter. Email address — if you subscribe. Legal basis: consent. You can unsubscribe at any time via the link in any newsletter.

3. Client engagement data

When you become a client, we process data as described in your engagement letter and our Data Processing Agreement (DPA). Client data is processed as a processor acting on your instructions, not under this policy. See our DPA page for details.

4. Cookies and tracking

We use strictly necessary cookies (session state, theme preference) without consent, and optional analytics cookies (Microsoft Clarity, Google Analytics) only after you accept via the cookie banner. You can change your choice at any time by clicking "Cookie settings" in the footer.

5. How long we keep your data

• Contact form submissions: 24 months from last contact.
• Newsletter subscribers: until you unsubscribe, plus 30 days.
• Analytics data: 14 months (GA4 default), then automatically deleted.
• Booking records: 12 months from the meeting date.

6. Who we share data with

We do not sell personal data. We share it only with sub‑processors necessary to operate the services:

• Supabase — form submission storage (EU region)
• Google LLC — Google Analytics 4, Google Calendar (booking)
• Microsoft Corporation — Microsoft Clarity (analytics)
• Calendly Inc. — meeting scheduling

All transfers outside the EEA are covered by Standard Contractual Clauses or an adequacy decision.

7. Your rights

Under GDPR you have the right to: access your data, correct it, erase it, restrict processing, data portability, and to object to processing based on legitimate interest. You also have the right to lodge a complaint with the Polish supervisory authority (UODO, uodo.gov.pl).

To exercise any right, email hello@menteflow.io. We respond within 30 days.

8. Security

We use TLS in transit and AES‑256 at rest for all stored personal data. Access is restricted to team members who need it to perform their role. See our security page for the full picture.

9. Changes to this policy

We post updates here with a revised "last updated" date. Material changes are notified by email to newsletter subscribers and active clients.

10. Contact

hello@menteflow.io
Mente S.A. · Plac Zwycięstwa 2 · 90-312 Łódź · Poland