Frozen copy of this document as of 2026-11-06. It doesn’t change, and links in it go to the current pages.
Privacy policy
Last updated: 6 November 2026
The short version
- Mynd GmbH in Frankfurt runs Wunderblick and is responsible for website and account data.
- Files and comments in a workspace belong to the customer who owns that workspace. We process them on the customer’s behalf.
- No analytics, no advertising, no tracking cookies, and so no cookie banner.
- The app and database run in Germany. Some providers outside the EU help with specific features, listed below.
- You can ask what we hold about you and have it corrected or deleted at any time.
1. Who is responsible
Mynd GmbH, Leipziger Straße 8, 60487 Frankfurt am Main, Germany
Phone +49 69 90 28 72 59 00, email beratung@mynd.com
Our data protection officer: Dominik Fünkner, PROLIANCE GmbH, Leopoldstr. 21, 80802 München. Phone +49 89 2500 392 20, email dsb@datenschutzexperte.de
2. Our two roles
- Controller. We decide how data is used for this website, for accounts, billing, security, support and contact requests. This policy covers those.
- Processor. For everything inside a workspace (files, comments, drawings, screenshots, review decisions, and the names and emails of invited reviewers), the workspace owner decides and we act on their instructions under our data processing agreement.
Invited to review something? The organisation that invited you is responsible for your review data. Contact them first. If you write to us instead, we will pass your request on.
3. What we process and why
| Data | Purpose | Legal basis (GDPR) | How long |
|---|---|---|---|
| IP address, browser details and time of a request | Delivering pages, limiting abuse such as password guessing | Art. 6(1)(f): a secure, working service | In memory only. We keep no access logs. Technical error logs are discarded with the next software update. |
| Name, work email, company or workspace name, profile settings, roles, password (stored only as a salted scrypt hash) | Creating and running your account | Art. 6(1)(b): contract | Until you delete the account. Database backups age out after 30 days. |
| Sign-in sessions and one-time email codes | Keeping you signed in, confirming it is you | Art. 6(1)(b) and (f) | Sessions 30 days, codes 10 to 30 minutes |
| Email address, name and message content | Service emails: codes, invitations, mentions, review updates and reminders that a free trial is ending. We send no newsletters. | Art. 6(1)(b) | As for the account. Our email provider keeps delivery logs for a limited time. |
| Name, contact details and your message | Answering when you email or call us | Art. 6(1)(b) or (f) | Until the matter is closed, unless retention rules apply |
| Name, billing address, VAT ID, plan and payment status | Selling and invoicing paid plans | Art. 6(1)(b) and (c) | Up to 10 years where tax and commercial law require it (§ 147 AO, § 257 HGB) |
You need to give us the account details to use the service. We make no automated decisions with legal or similar effect on you (Art. 22 GDPR).
Online checkout runs through Polar, which acts as reseller and seller of record. Polar handles payment data, tax and invoices. We only receive your plan, status and a customer reference. See Polar’s privacy policy.
4. AI features
All of these are optional and start only when someone uses them. Customer content does not train AI models.
- Voice comments. While you record, audio goes to AssemblyAI’s EU servers and comes back as text. We store only the text. AssemblyAI does not use audio sent to its EU servers for model training.
- Translation. When a team member clicks translate, the comment text goes to Google’s Gemini API, with emails, phone numbers and web addresses replaced first. Under its paid-service terms Google does not use it to improve its products, and logs it for a limited time only to detect abuse.
- AI brief. Names, emails and phone numbers are removed from the comments you select, and you get an expiring link to paste into an AI tool of your choice. We run no AI on it. What that tool does with the content is between you and its provider.
5. Live websites and HTML courses
When you open a website or uploaded course for review, its code runs in your browser, in a sandbox on a separate address. It can load content from other servers and set its own cookies on that sandbox address, as it would on the original site. The customer who added it is responsible for that content.
6. Cookies and browser storage
We only use what the service needs to work (§ 25(2) no. 2 TDDDG), which requires no consent. Fonts and scripts on these pages come from our own server.
| Name | Purpose | Lifetime |
|---|---|---|
wunderblick_session | Keeps you signed in | 30 days |
wunderblick_guest_… | Remembers an external reviewer who confirmed their identity | 90 days |
wunderblick_rpw_…, _dpw_…, _tpw_… | Remembers that you entered a link's password | 90 days |
wunderblick_theme | Your light or dark setting | 1 year |
| Browser storage | Panel sizes, sort order, notices you dismissed, your name and email on review forms. Stays on your device. | Until you clear it |
| Browser storage in the demo | Comments you write in the demo on our home page. They stay in your browser and are never sent to us. | Until you close the tab |
7. Who else receives data
We use the service providers on our subprocessor list, each under a data processing contract. Some are based in the USA. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified (Art. 45 GDPR) and on the EU standard contractual clauses (Art. 46(2)(c) GDPR). Ask us for a copy. We share data with authorities only when the law requires it.
The help centre and bug report form linked inside the app are at userdock.mynd.com, a separate mynd service you only reach by opening those links.
8. Deletion
Owners can delete files, projects, workspaces and accounts themselves, and the stored data goes with them. Deleted comments disappear from view at once and are erased with their file or project, or earlier on request. Backups age out after 30 days.
9. Your rights
You can ask for access (Art. 15 GDPR), correction (Art. 16), deletion (Art. 17), restriction (Art. 18) and a portable copy of your data (Art. 20). Where we rely on consent, you can withdraw it at any time for the future.
You can object at any time, on grounds relating to your situation, to processing based on legitimate interests (Art. 21 GDPR).
Write to beratung@mynd.com or to our data protection officer. You can also complain to a supervisory authority. Ours is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany, datenschutz.hessen.de.
10. Changes
We update this policy when the service or the law changes. The date at the top shows the current version.