Legal
Legal notice
Information pursuant to § 5 DDG (Germany)
Till Kost
Postfach · August-Wessels-Str. 12
86154 Augsburg, Deutschland
E-Mail: hello@mindbutton.app
Responsible for content (§ 18 (2) MStV)
Till Kost, address as above.
Dispute resolution
The European Commission provides a platform for online dispute resolution: ec.europa.eu/consumers/odr. We are neither obliged nor willing to take part in dispute resolution proceedings before a consumer arbitration board.
Liability for content
Places, notes and recommendations in mindbutton come from users themselves or from public sources (e.g. Google Places, OpenStreetMap). We accept no liability for accuracy, completeness or timeliness.
Privacy policy
Version 23.10.2026
1. Controller
Till Kost
Postfach · August-Wessels-Str. 12
86154 Augsburg, Deutschland
E-Mail: hello@mindbutton.app
2. What data we process
When you create an account we store your e-mail address, display name, city and language and the time of registration. While you use the app we store the places (“buttons”) you create with notes, photos, visit dates, tours, vouchers, friendships and shared content, plus counters for AI usage and searches. Your location is processed only if you grant it in your browser and is not stored permanently.
3. Purposes and legal bases
Providing the service and your account (Art. 6 (1) (b) GDPR), security and abuse prevention (Art. 6 (1) (f) GDPR), billing of subscriptions (Art. 6 (1) (b) GDPR), statutory retention of invoice data (Art. 6 (1) (c) GDPR).
4. Recipients and third-party services
We use the following providers. Each receives only the data required for its function.
| Service | Purpose | Data, legal basis, third country |
|---|---|---|
| Vercel Inc. (USA) | Hosting of the app and API routes | Technical access data (IP address, timestamps, user agent) in server logs. Legal basis Art. 6 (1) (f) GDPR. Transfer to the USA under the EU-US Data Privacy Framework. |
| Supabase Pte. Ltd. | Database, login (auth), photo storage | Account data, saved places, photos, friendships, usage counters. The data is held in a data centre in Frankfurt am Main, Germany. Legal basis Art. 6 (1) (b) GDPR (contract). Standard contractual clauses. |
| Google LLC (Places API) | Place search and address enrichment | Your search text and, where applicable, a place/city name are sent to Google; Google receives no account data. Legal basis Art. 6 (1) (b) GDPR. Transfer to the USA (Data Privacy Framework). |
| Anthropic PBC (USA) | AI search, link import, photo analysis, voucher recognition, pre-selection at partner brands (section 7) | Only when an AI feature is triggered: the text entered or the photo uploaded is sent to Anthropic and is not used for training; Anthropic deletes inputs and outputs within 30 days. No account data, no name, no e-mail address. Legal basis Art. 6 (1) (b) GDPR. Transfer to the USA (standard contractual clauses, Art. 46 GDPR; Anthropic is not certified under the EU-US Data Privacy Framework). |
| Esri (ArcGIS Location Platform) | Map tiles | When the map loads, your browser fetches tiles from Esri, transmitting your IP address. Legal basis Art. 6 (1) (f) GDPR. |
| OpenStreetMap Foundation (Nominatim) / Komoot (Photon) | Address and place lookup, region assignment | Search text or coordinates of a place and your IP address. Legal basis Art. 6 (1) (b) GDPR. |
| Cloudflare Inc. (Turnstile) | Protecting sign-up from bots | During sign-up your browser loads a verification script from Cloudflare, processing your IP address and technical browser characteristics. Legal basis Art. 6 (1) (f) GDPR (abuse prevention). |
| Resend Inc. (USA) | Sending e-mails (invitations, customer onboarding, notices) | Recipient address, subject, content. Legal basis Art. 6 (1) (b) GDPR. Transfer to the USA (EU-US Data Privacy Framework). |
| Stripe Payments Europe Ltd. (Ireland) | Payment processing for subscriptions (from 1 Jan 2027) | E-mail address, payment data (collected exclusively by Stripe, never by us), subscription status. Legal basis Art. 6 (1) (b) GDPR. Stripe is an independent controller for payment data. |
5. Cookies and local storage
mindbutton uses no tracking cookies and no analytics services. Your browser stores only what is technically necessary: your session login token, language and filter settings, an offline cache of your places, and drafts. This storage is required for the service you requested (§ 25 (2) no. 2 TDDDG) and needs no consent.
6. Sharing with friends
When you share places, recipients see your display name and the shared content. Anyone who knows a share link can open it. Friend requests show the other user your display name and city.
7. When your account comes through a partner brand
Some accounts are not created by the user but by a partner agency — for example a relocation provider that offers mindbutton to its clients under its own name. In that case the following also applies.
The agency creates your account and enters your name, e-mail address, destination town and language. You receive an invitation e-mail with a link and set your own password. To get you started, the agency fills a collection of places (a “welcome set”) into your account; those places come from the agency’s own account.
AI pre-selection. So that the collection fits your family, the agency records a short questionnaire during your first conversation: where you will live, where you will work, whether you already have a home, the country you are moving from, the ages of your children, car and commute, what you need first, groceries, sport, culture — and a free-text field for anything else. From these answers a profile is formed without your name and without your e-mail address and sent once to Anthropic (USA). The model pre-selects places and writes one sentence for each; the agency then decides. The legal basis is Art. 6 (1) (b) GDPR; for the transfer to the USA see the table in section 4. We do not ask for health, religion or ethnic origin and do not want them in the free-text field either — the field carries a note to that effect.
What the agency can see. It appears in your list as a connection, like a friend. It can see which places it gave you, when you last signed in and how many buttons of your own you have created — but not which ones, and not your notes or photos. Whatever you deliberately share with the agency it sees like any other recipient.
Who is responsible for what. For the details the agency collects about you and enters here, the agency is the controller; we process them on its behalf under a contract pursuant to Art. 28 GDPR. For running mindbutton itself we remain the controller. If you do not want the agency to keep your details, contact the agency; you can delete your mindbutton account yourself at any time regardless.
8. Retention
Your data is kept as long as your account exists. You can delete your account yourself in the app at any time (Profile → Delete account); this removes all buttons, photos, tours and friendships. Invoice data from subscriptions is retained for the statutory period (10 years).
9. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). Write to hello@mindbutton.app. You may also lodge a complaint with a supervisory authority; the competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Ansbach.
10. Changes
We update this policy when the service or the legal situation changes. The version published here applies.
Right of withdrawal
Applies to paid subscriptions (Plus, Pro) taken out by consumers.
Right of withdrawal
You have the right to withdraw from this contract within fourteen days without giving any reason. The withdrawal period is fourteen days from the day the contract was concluded. To exercise the right, inform us (Till Kost, Postfach · August-Wessels-Str. 12, 86154 Augsburg, Germany, e-mail hello@mindbutton.app) of your decision by an unequivocal statement (e.g. an e-mail). You may use the model form below, but it is not obligatory. Sending your notice before the period expires is sufficient.
Effects of withdrawal
If you withdraw, we will reimburse all payments received from you without undue delay and no later than fourteen days from the day we receive your notice, using the same means of payment you used. If you requested that the service begin during the withdrawal period, you shall pay us an amount proportionate to what has been provided until you informed us of the withdrawal.
Early expiry
When subscribing you confirm that the subscription should start immediately. Your right of withdrawal expires once we have fully performed the service, provided you expressly agreed beforehand that we begin performance and acknowledged that you lose your right of withdrawal upon full performance (§ 356 (4) German Civil Code).
Model withdrawal form
To Till Kost, Postfach · August-Wessels-Str. 12, 86154 Augsburg, Germany, hello@mindbutton.app: I hereby withdraw from my contract for the mindbutton subscription (Plus/Pro). Ordered on: ____________ Name: ____________ Account e-mail: ____________ Date, signature (only if on paper): ____________
Cancel contracts here
You can cancel your mindbutton subscription (Plus or Pro) at any time with effect from the end of the current billing period, without logging in (§ 312k German Civil Code). Enter the e-mail address of your account. You will receive a confirmation here on this page and by e-mail right away.
When logged in you can also use Profile → Manage subscription (Stripe customer portal). Until 31 Dec 2026 (founding phase) there are no paid subscriptions.