Privacy Policy

This Privacy Notice ("Notice") has been prepared by Mindlee Software and Information Technologies Inc. ("Company"), acting as data controller under: • The Law on the Protection of Personal Data of Türkiye (KVKK) • The EU General Data Protection Regulation (GDPR) • The California Consumer Privacy Act & Privacy Rights Act (CCPA/CPRA) • Other applicable international data protection laws Company Details: Mindlee Software and Information Technologies Inc. Email: team@mindlee.co Website: www.mindlee.ai Your security is important to us. The personal data you share with us is protected with care in accordance with this Notice.

Identity Data: Name, date of birth, gender Contact Data: Address, email, mobile phone number Location Data: Location information User Transaction Data: Purchased services, purchase history, special date records Marketing Data: Cookie records, behavioral logs, interests, targeting Legal Transaction Data: Request/complaint records, legal file records Transaction Security Data: IP address, passwords, traffic data, login/log-out data Special Categories of Personal Data: Therapy notes, emotional state logs, psychological assessments Collection Methods: • Cookies and similar technologies • Automated/non-automated methods • Third-party providers such as analytics services, advertising networks, and technology suppliers

1. Verifying user identity for website/mobile transactions 2. Enabling purchases and communications about services 3. Managing user transactions and membership rights 4. Preparing records and documentation 5. Improving and developing services 6. Responding to official authority requests 7. Providing service-related information and campaign notifications (with explicit consent) 8. Conducting advertising, marketing, profiling, and analytics (with explicit consent) 9. Enhancing user experience and customer satisfaction 10. Sending commercial electronic messages (with explicit consent) 11. Evaluating requests, suggestions, and complaints 12. Ensuring information and transaction security 13. Conducting legal affairs 14. Conducting business operations and audits 15. Fulfilling legal obligations 16. Processing special category data and automated decision-making (with explicit consent)

• Special category data (therapy notes, emotional logs, behavioral analysis) may be used only with explicit consent. • AI algorithms are used to provide personalized insights and improve service quality. • Automated decisions do not produce legal or similarly significant effects. • Users may request human review of automated decisions. • All AI data used for analytics is fully anonymised.

Personal data may be transferred to: • Company shareholders, employees, business partners • Service providers (website, mobile app, infrastructure) • Marketing agencies, analytics providers, survey companies • Cloud storage providers (domestic and international) • Legal advisors, audit firms, and authorities • Judicial/administrative bodies upon request • AI service providers (only anonymized or safeguarded sensitive data) All transfers are subject to strict technical and administrative safeguards.

We retain personal data only for: • As long as necessary to fulfill the processing purposes • The periods mandated by law • Statute of limitations for potential legal claims After the retention period expires, data is: • Deleted, • Destroyed, or • Irreversibly anonymised Aggregated anonymous data may be retained for analytics and service development.

We use cookies to: • Provide personalized user experiences • Analyze website and app performance • Support marketing and targeting efforts For detailed information, see our Cookie Policy: www.mindlee.ai/cookies

You may apply to the data controller to exercise the following rights: • Learn whether personal data is processed • Request information on processing • Learn the purpose of processing • Know domestic/international recipients • Request correction • Request deletion or destruction • Request notification to third parties • Object to automated decisions • Request compensation for damages Contact to exercise your rights: team@mindlee.co We respond within 30 days.

Under GDPR, users have the right to: • Be informed • Access data • Rectify inaccuracies • Erase data ("right to be forgotten") • Restrict processing • Data portability • Object to processing • Human review of automated decisions • Object to profiling and targeting International Transfers: • Standard Contractual Clauses (SCCs) • Adequacy decisions • Additional security measures If you request full deletion, your data is erased within 30 days.

California residents have the right to: 1. Know what personal data is collected 2. Request deletion 3. Opt out of sale/sharing of personal data 4. Limit sensitive data use 5. Data portability 6. Non-discrimination 7. Use an authorized agent to exercise rights Do We Sell Personal Data? We do not sell or share personal data as defined by CCPA/CPRA.

1. In-App Deletion (Immediate): Profile → Settings → Delete Account 2. Email Request (30 Days): Email: team@mindlee.co Subject: Account Deletion Request 3. Facebook Login Users: https://www.facebook.com/your_information Data Deleted Includes: • Profile information • Usage history • Message history • Preferences • All personal data (except legally mandated retention copies) Anonymised Data: Non-identifiable data may continue to be used for analytics.

Our services are not intended for children under 13 (or 16 where applicable). We do not knowingly collect personal data from minors. If detected, such data is deleted immediately.

You are free to accept or reject the processing of personal data required for service use. If you do not accept, please uninstall the application. For questions: team@mindlee.co