MentalyzeBack to home
Version 1.0Last updated: 4 June 2026

Privacy Policy

How Sueta FZE LLC collects, uses, secures, and discloses your personal data when you use Mentalyze. This edition applies to consumers in the European Economic Area, the United Kingdom, and Switzerland, and describes your rights under the GDPR and UK GDPR.

Region
United States & rest of worldEU, UK & Switzerland
Language

1Introduction and Scope

Welcome to Mentalyze

This Privacy Policy explains how Sueta FZE LLC, a United Arab Emirates entity ("Company", "we", "us", or "our"), collects, uses, secures, and discloses your personal data when you access or use our mobile applications, website, and AI-powered conversational services (collectively, the "Services").

Who We Are and What This Policy Covers

It is critical to understand that Mentalyze is designed solely for emotional support, self-reflection, and general wellness.

WE DO NOT PROVIDE MEDICAL ADVICE, PSYCHIATRIC DIAGNOSIS, LICENSED THERAPY, OR CLINICAL TREATMENT.

This Privacy Policy applies exclusively to individual consumers who download, access, and use the Services directly (B2C relationship). In this context, Company acts as the Data Controller of your personal information. If you are accessing the Services through an enterprise program, employer, school, or healthcare institution (B2B relationship), our processing of your data may be governed by a separate Data Processing Agreement (DPA) with that organization, which will take precedence over this Privacy Policy in the event of a conflict.

Given the core purpose of Mentalyze — providing emotional support and guided self-reflection — your Conversation Data will inherently contain sensitive information related to your mental well-being, emotions, and psychological state. Under the GDPR, this is considered a 'Special Category of Personal Data' (health data).

We fully acknowledge the highly sensitive nature of this information

We do not collect or process this data by default. We process your mental health and emotional data strictly and exclusively based on your explicit, affirmative consent provided during the onboarding process. You may withdraw this consent at any time via your account settings; however, please note that withdrawing consent for this core processing will result in the inability to use the conversational features of the Services.

Consequences of Withdrawing Consent

The processing of your mental health and emotional data is essential to the core functionality of Mentalyze's AI. If you withdraw your explicit consent for such processing, we will be unable to provide you with the conversational features of the Services. Consequently, withdrawing this consent will result in the deactivation of your account. To ensure your right to data portability, you will be provided with an opportunity to export a copy of your conversation history before it is permanently deleted in accordance with our data retention policy

IF YOU DO NOT AGREE WITH OUR POLICIES AND PRACTICES, YOUR CHOICE IS NOT TO USE OUR SERVICES.

2Information We Collect

We believe in data minimization and collect only the information necessary to provide, secure, and improve our Services. Depending on how you interact with Mentalyze, we collect the following categories of information:

Information You Provide to Us Directly

  • Account Information: When you register for an account, we collect identifiers such as your nickname or name, email address, password, age confirmation, and basic profile preferences (e.g., timezone, pronouns).
  • Conversation Data (Inputs): We collect the text, messages, mood check-ins, reflections, and any other content you submit to our conversational AI ("Inputs").
  • Multi-modal Conversation Data: In addition to text, depending on the features you choose to use, we may collect:
  • Audio Data: If you use the voice-chat feature, we capture your voice input. This audio is transiently processed to be transcribed into text for the AI to understand and respond.
  • Visual Content (Images): Any images or files you voluntarily upload and share within the chat interface.
  • Camera Data: If you use the video-avatar feature, the application requests access to your camera to enable a simulated video-call experience.

Information We Collect Automatically

  • Device and Network Data: When you access the Services, we automatically collect technical data, including your IP address, device type, operating system, browser type, mobile device identifiers (e.g., IDFA or Android Ad ID), and general geographic location (e.g., city or state level, not precise GPS tracking).
  • App Event and Usage Data: We collect information about how you interact with the Services to ensure they function properly and securely. This includes session duration, features utilized, screens visited, crash reports, and system error logs.
  • Cookies and Tracking Technologies: We may use essential and analytical cookies (or similar local storage technologies) to maintain your session state, remember your preferences, and analyze platform performance. You can manage, change, or revoke your cookie and tracking preferences at any time through the 'Settings' or 'Privacy' menu within the Application.
  • Clarification on Tracking and Attribution. We do not use tracking technologies to monitor your behavior across third-party websites for cross-context behavioral advertising. However, we utilize industry-standard attribution tools (such as AppsFlyer) solely to measure the effectiveness of our own marketing campaigns and to identify the source of app installations. Such processing is strictly based on your explicit consent (Opt-in) and is not used to build advertising profiles for third parties.

Information from Third Parties

  • Single Sign-On (SSO): If you choose to log in using a third-party service (such as Google or Apple), we receive limited information from that service (such as your email address, name, or a unique encrypted identifier) as permitted by your account settings with that third party. We do not receive or store your passwords for these third-party services.

Audio and Visual Data Processing

We process audio and camera data solely to provide conversational features and a simulated video-interaction experience.

  • No Biometric Identification: We do not use your voice or video to uniquely identify you, nor do we analyze biometric identifiers to categorize your physical or mental characteristics.
  • Local Processing: Real-time video stream for avatar interaction is processed locally on your device and is not recorded or stored on our servers.
  • Transcription: Voice inputs are converted to text (transcription) for AI processing. The raw audio recordings are not retained longer than necessary to complete the transcription process.

3Legal Bases for Processing

Pursuant to the GDPR, we process your personal data only when we have a valid legal basis to do so. Depending on the purpose, we rely on the following grounds:

  • Performance of a Contract: To create and maintain your account, provide the conversational AI interface, sync your chat history, and process your subscriptions. Without this data, we cannot fulfill our agreement with you.
  • Explicit Consent: Because our AI service involves emotional support, your conversations may contain sensitive mental health data. We process such information — including the automated detection of crisis-related keywords to provide you with emergency resources — strictly on the basis of the explicit consent you provide during the onboarding process. You may withdraw this consent at any time via the 'Privacy Settings' menu within the App.
  • Legitimate Interests: To ensure the security and integrity of our Services, troubleshoot technical issues, and improve our product.
  • Legal Obligation: To comply with applicable laws, such as financial record-keeping for subscriptions or responding to valid law enforcement requests.
  • Consent: For the use of non-essential cookies and analytical tools (like AppsFlyer or PostHog), as well as for sending you marketing communications. You may withdraw or manage your consent for these technologies at any time via the Application’s settings.

4Safety and Crisis Response

Crisis-Response Protocol

We operate a crisis-response protocol that detects expressions of suicidal ideation, self-harm, disordered eating, or threats of violence, directs you to appropriate crisis resources, and prevents the generation of content that encourages such harm. This processing rests on the explicit consent you give during onboarding, and it is described here so that you know it happens before it does.

Emergency Resources Differ by Country

Mentalyze is not an emergency service and cannot contact emergency services on your behalf. If you are in immediate danger, call 112, the single European emergency number, which reaches emergency services in every EEA country and in the United Kingdom. Mental-health crisis support differs from one country to the next, and a national helpline is often better placed to help than a general emergency number, so where we can tell which country you are in we show the local helpline alongside 112.

Human Review of Automated Safety Decisions

Automated filters may pause a conversation or restrict access to certain features when they detect a situation outside what the Services are for. Where such a decision significantly affects you, you may obtain human intervention, express your point of view, and contest the decision — see Your Privacy Rights under the GDPR and UK GDPR, below.

5AI Processing and Data Training Limitations

We are transparent about how Artificial Intelligence interacts with your data to provide and improve our Services.

To improve the empathy and safety of Mentalyze, we may use your Conversation Data to train and refine our internal models. This processing is strictly optional and is performed only if you have provided your explicit, granular consent for this specific purpose (separate from the general consent to provide the Service).

If you consent, your data will undergo rigorous pseudonymization and 'contextual scrubbing' to remove identifiers. While we employ advanced technical safeguards to minimize re-identification risks, we treat this data with the same high level of security as your active chat logs. You can withdraw your consent for AI training at any time in the 'Privacy Settings' without any loss of service functionality. If you do not opt-in, your Conversation Data will never be used to train our AI models.

Optional AI Model Improvement (Internal)

Our AI is capable of processing multi-modal inputs, including text, voice transcriptions, and user-generated images, to provide context-aware emotional support. All such processing is subject to the security and anonymization protocols outlined in this Policy.

To power our core conversational capabilities and generate real-time responses, we share your Inputs (prompts) with trusted third-party Large Language Model providers (e.g., OpenAI, Google) via secure APIs. We enforce strict contractual agreements with these providers to ensure your privacy:

Sharing with Third-Party Large Language Models (LLMs)

  • No Third-Party Training: These external LLM providers are strictly contractually prohibited from using your Conversation Data to train, retrain, or improve their own generalized AI models.
  • Data Minimization: We transmit only the data necessary to generate a response and do not send persistent account identifiers to these external providers.

6Data Security and Retention

Commitment to Reasonable Security

We employ commercially reasonable administrative, technical, and physical safeguards designed to protect your personal information against accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, or use. Our security architecture is explicitly designed to balance the highest standards of user privacy with the operational necessity of providing a seamless, synchronized user experience.

Encryption and Key Management

  • In Transit: All communications between your device and our servers, including your Conversation Data, are securely encrypted in transit using industry-standard cryptographic protocols (e.g., TLS/SSL).
  • At Rest: Your Conversation Data is stored in encrypted databases. To prevent unauthorized mass data extraction, the cryptographic keys required to decrypt this data are isolated and maintained in a secure, separate key management system, independent of the primary databases.

We enforce the principle of least privilege

General staff members do not have access to your readable Conversation Data. In the rare and exceptional event that senior technical personnel require access to decrypt specific chat logs (e.g., for critical bug resolution, safety interventions, or legal compliance), such access is strictly governed by internal confidentiality agreements and operational protocols.

Deletion from Production Systems

Upon receiving a valid account deletion request, your personal information and Conversation Data are removed as soon as possible from our active production systems, or irreversibly anonymized so that they can no longer be associated with you.

Data Retention and Deletion

  • Backup Retention Period: For the purposes of disaster recovery and business continuity, encrypted residual copies of your data are maintained in our daily system backups. These backups are stored in a secure, isolated environment and are automatically overwritten after a period of 30 days.
  • Technical Logs and Analytics: As previously stated, technical data (such as device info and app usage) is retained for a maximum of 12 months to ensure security and platform stability, after which it is deleted or aggregated.

Inherent Risks

While we implement robust, industry-standard security protocols, no method of transmission over the Internet or electronic storage is entirely secure. Therefore, we cannot guarantee the absolute security of your data. You are equally responsible for safeguarding your account credentials and maintaining the physical and digital security of your own devices.

7Information Sharing and Disclosure

We treat your highly personal information with the utmost confidentiality.

WE DO NOT SELL YOUR PERSONAL DATA, CONVERSATION DATA, OR HEALTH DATA TO ANY THIRD PARTIES.

We do not share the contents of your conversations, your messages, your mood data, or the topics of your conversations with advertising networks or data brokers. To measure and optimize our own marketing campaigns, and only after you have given your consent, we share limited device identifiers and non-content engagement events (such as installs, registrations, purchases, and the completion of a chat session, identified only by a sequential number) with our attribution and advertising partners. You can withdraw this consent at any time via the Application's settings. We never share your health or emotional data for these purposes.

To deliver our Services, we work with trusted service providers who process your data strictly under our instructions and in compliance with Data Processing Agreements (DPAs). Our current sub-processors include:

Sharing with Service Providers

  • Core AI Infrastructure: OpenAI Ireland Ltd. and Google Cloud (USA). They provide the Large Language Models used to generate conversational responses. We utilize specific API configurations that explicitly opt-out of using your Conversation Data for third-party model training. Data retention by these providers (e.g., OpenAI, Google) is restricted to the technical minimum required for security and abuse monitoring, after which it is automatically deleted in accordance with their enterprise-grade privacy standards.
  • Database and Hosting: Firebase (Google Cloud). Used for secure encrypted storage of your account and conversation data.
  • Analytics and Performance: AppsFlyer, PostHog, and Firebase Analytics. These tools help us analyze app performance and marketing effectiveness. For advertising optimization, we may transmit non-content engagement events (such as installs, registrations, purchases, and the fact that a chat session was completed, identified only by a sequential number) to advertising partners. We never transmit the contents of your conversations, your mood data, or the subject matter of your sessions. These tools are activated ONLY after your express consent.
  • Error Monitoring: Sentry and Firebase Crashlytics. Used to identify and fix technical bugs.
  • Subscription Management: Adapty and Apphud. These platforms manage in-app purchases and subscription statuses.

All sub-processors are contractually prohibited from using your data for their own purposes or sharing it with any third parties.

Emergency Situations and Human Review

To ensure the integrity of our safety protocols, we utilize a hybrid monitoring model. If automated filters flag a potential 'Out-of-Scope Situation' (e.g., risk of self-harm), restricted and anonymized logs may be reviewed by our safety personnel retrospectively. The purpose of this review is to evaluate and improve our safety algorithms and ensure that the system correctly provided emergency resources to the user.

Business Transfers and Corporate Reorganization

If the Company is involved in a merger, acquisition, bankruptcy, reorganization, dissolution, or sale of all or a portion of its assets, your personal information may be shared or transferred as part of that transaction. In such an event, we will notify you via email and/or a prominent notice within the Services of any change in ownership or the governing privacy policies, and your data will remain subject to the promises made in the pre-existing Privacy Policy until you agree otherwise.

8Your Privacy Rights under the GDPR and UK GDPR

Applicability and Scope

If you are a resident of the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, you have specific rights regarding your personal data under the General Data Protection Regulation (GDPR) and the UK GDPR.

  • Right to Access: You have the right to request confirmation as to whether we are processing your personal data and to obtain a copy of the data we hold about you.
  • Right to Rectification: You have the right to request the correction of inaccurate or incomplete personal data.
  • Right to Erasure / Right to be Forgotten: You have the right to request the deletion of your personal data, subject to certain legal exceptions (e.g., if retaining the data is necessary to comply with a legal obligation or defend against legal claims).
  • Right to Restriction of Processing: You have the right to request that we temporarily restrict the processing of your personal data under certain circumstances (e.g., if you contest its accuracy).
  • Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller.
  • Right to Object: You have the right to object to the processing of your data based on our legitimate interests. You also have the absolute right to object to the processing of your data for direct marketing purposes at any time.
  • Right to Withdraw Consent: Where we rely on your explicit consent to process your data (including health data), you can withdraw this consent at any time. Withdrawal will not affect the lawfulness of processing based on consent before its withdrawal.
  • Right Not to be Subject to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects. Automated safety interventions (such as pausing a chat during a crisis) are protective measures and do not constitute a "significant effect" or a restriction of your rights, as they are intended solely to provide immediate safety information in emergency situations. While our AI generally provides support without legal or similarly significant effects, certain automated safety interventions (such as pausing a conversation during a detected crisis) may be considered significant under law. If your session is paused by our automated filters, you have the right to request a human review of this decision, express your point of view, and contest the restriction by contacting us at sueta.llc@gmail.com. We will process such requests diligently and without undue delay.

How to Exercise Your Rights

You can exercise these rights directly through the privacy settings in your account or by contacting us at sueta.llc@gmail.com. We will respond to your request without undue delay and at the latest within one month of receipt.

Right to Lodge a Complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. For users in the UK, you may contact the Information Commissioner’s Office (ICO).

9Minors’ Privacy

Age Verification and Data Minimization

We verify user age through an active Age-Gate mechanism requiring the input of your full date of birth during registration. We do not permit individuals under 18 to access the Services. All Conversation Data is protected using industry-standard encryption in transit (TLS/SSL) and at rest. Access to decrypted logs is strictly limited to authorized personnel under specific safety protocols, monitored by secure audit trails.

Account Deletion for Minors

We do not knowingly collect or solicit personal data from anyone under the age of 18. If we learn that we have inadvertently collected personal information from a minor without verified age confirmation, we will deactivate the account and delete all associated data as required by law. If you believe that a minor is accessing our Services in violation of our age restrictions, please notify us immediately at sueta.llc@gmail.com.

10International Data Transfers

Sueta FZE LLC is a United Arab Emirates entity, and our servers are primarily located in the United States. When you use our Services, your personal data will be transferred to and processed in countries outside of the EEA and the UK.

To ensure your data remains protected, we implement appropriate safeguards as required by the GDPR:

  • Standard Contractual Clauses: We use the Standard Contractual Clauses approved by the European Commission for transfers to service providers (such as Google/Firebase and OpenAI) located in countries without an adequacy decision.
  • Data Privacy Framework: For transfers to the US, we prioritize providers that are certified under the EU-U.S. Data Privacy Framework, where applicable.

11Changes to This Privacy Policy

We reserve the right to modify, amend, or update this Privacy Policy at any time to reflect changes in our operational practices, new technology, or evolving legal requirements.

If we make material changes to how we process your personal data (particularly regarding the strict No AI Training policy or Conversation Data security), we will notify you by:

Notification of Changes

  • Sending an email to the address associated with your account.
  • Posting a prominent notification within the App or on our Website before the changes take effect.
  • Updating the Last Updated date at the top of this Privacy Policy.

Your continued use of the Services after the effective date of the revised Privacy Policy constitutes your acknowledgment and agreement to the updated terms.

12Contact Information

Data Controller

The Services are provided by Sueta FZE LLC, a company registered in the United Arab Emirates.

Data Protection Officer (DPO)

We have appointed a Data Protection Officer to oversee our privacy practices. If you have questions about our data processing or wish to exercise your rights, you can contact our DPO at: privacy@sueta.co.

Email

sueta.llc@gmail.com

Postal Address

Sueta FZE LLC, Office No. BLA-BR3-471, 3rd Floor, Ajman Boulevard Commercial, Ajman, United Arab Emirates.