Privacy policy

This version: 7 November 2026 · Copy to save or print · Earlier: 6 November 2026

The short version

Mynd GmbH in Frankfurt runs Wunderblick and is responsible for website and account data.
Files and comments in a workspace belong to the customer who owns that workspace. We process them on the customer’s behalf.
No analytics, no advertising, no tracking cookies, and so no cookie banner.
The app and database run in Germany. Some providers outside the EU help with specific features, listed below.
You can ask what we hold about you and have it corrected or deleted at any time.

1. Who is responsible

Mynd GmbH, Leipziger Straße 8, 60487 Frankfurt am Main, Germany
Phone +49 69 90 28 72 59 00, email beratung@mynd.com

Our data protection officer: Dominik Fünkner, PROLIANCE GmbH, Leopoldstr. 21, 80802 München. Phone +49 89 2500 392 20, email dsb@datenschutzexperte.de

2. Our two roles

Controller. We decide how data is used for this website, for accounts, billing, security, support and contact requests. This policy covers those.
Processor. For everything inside a workspace (files, comments, drawings, screenshots, review decisions, and the names and emails of invited reviewers), the workspace owner decides and we act on their instructions under our data processing agreement.

Invited to review something? The organisation that invited you is responsible for your review data. Contact them first. If you write to us instead, we will pass your request on.

3. What we process and why

Our customers are businesses, so most people we hold data about work for a customer and aren’t our contract partner themselves. Where the table names two legal bases, Art. 6(1)(b) applies if you are the customer yourself, for example as a sole trader. Art. 6(1)(f) applies if you act for an organisation: running the service for the people that organisation has signed up is in its legitimate interest and ours. You can object to that (section 9).

Data: IP address, browser details and time of a request
Purpose: Delivering pages, limiting abuse such as password guessing
Legal basis (GDPR): Art. 6(1)(f): a secure, working service
How long: In memory for up to an hour. We keep no access logs. Technical error logs stay at most 30 days, and go sooner with each software update.

Data: Name, work email, company or workspace name, profile settings, roles, password (stored only as a salted scrypt hash)
Purpose: Creating and running your account
Legal basis (GDPR): Art. 6(1)(b) or (f)
How long: Until the account is deleted, by you or when the contract ends. We don’t delete inactive accounts automatically. Database backups age out after 30 days.

Data: Sign-in sessions and one-time email codes
Purpose: Keeping you signed in, confirming it is you
Legal basis (GDPR): Art. 6(1)(b) or (f)
How long: Sessions 30 days, codes 10 to 30 minutes

Data: Name, work email, company, the time, and which versions of the terms and data processing agreement were accepted
Purpose: Being able to show what was agreed, with whom and when
Legal basis (GDPR): Art. 6(1)(f), and (b) if you are the customer
How long: As long as the contract runs, then 3 years (§§ 195, 199 BGB)

Data: Email address, name and message content
Purpose: Service emails: codes, invitations, mentions, review updates and reminders that a free trial is ending. We send no newsletters.
Legal basis (GDPR): Art. 6(1)(b) or (f)
How long: Our email provider, Resend, stores each email and its delivery log for 30 days, and its backups for 7 more.

Data: Name, contact details and your message
Purpose: Answering when you email or call us
Legal basis (GDPR): Art. 6(1)(b) or (f)
How long: Until the matter is closed. Business letters are kept for 6 years (§ 257 HGB, § 147 AO).

Data: Name, billing address, VAT ID, plan and payment status, for customers we invoice directly
Purpose: Selling and invoicing Enterprise plans
Legal basis (GDPR): Art. 6(1)(b) and (c), and (f) for contact people at a company
How long: Invoices and accounting records 8 years, books and annual accounts 10 years (§ 147 AO, § 14b UStG, § 257 HGB)

Data	Purpose	Legal basis (GDPR)	How long
IP address, browser details and time of a request	Delivering pages, limiting abuse such as password guessing	Art. 6(1)(f): a secure, working service	In memory for up to an hour. We keep no access logs. Technical error logs stay at most 30 days, and go sooner with each software update.
Name, work email, company or workspace name, profile settings, roles, password (stored only as a salted scrypt hash)	Creating and running your account	Art. 6(1)(b) or (f)	Until the account is deleted, by you or when the contract ends. We don’t delete inactive accounts automatically. Database backups age out after 30 days.
Sign-in sessions and one-time email codes	Keeping you signed in, confirming it is you	Art. 6(1)(b) or (f)	Sessions 30 days, codes 10 to 30 minutes
Name, work email, company, the time, and which versions of the terms and data processing agreement were accepted	Being able to show what was agreed, with whom and when	Art. 6(1)(f), and (b) if you are the customer	As long as the contract runs, then 3 years (§§ 195, 199 BGB)
Email address, name and message content	Service emails: codes, invitations, mentions, review updates and reminders that a free trial is ending. We send no newsletters.	Art. 6(1)(b) or (f)	Our email provider, Resend, stores each email and its delivery log for 30 days, and its backups for 7 more.
Name, contact details and your message	Answering when you email or call us	Art. 6(1)(b) or (f)	Until the matter is closed. Business letters are kept for 6 years (§ 257 HGB, § 147 AO).
Name, billing address, VAT ID, plan and payment status, for customers we invoice directly	Selling and invoicing Enterprise plans	Art. 6(1)(b) and (c), and (f) for contact people at a company	Invoices and accounting records 8 years, books and annual accounts 10 years (§ 147 AO, § 14b UStG, § 257 HGB)

You need to give us the account details to use the service. We make no automated decisions with legal or similar effect on you (Art. 22 GDPR).

Online checkout. Online orders are sold by Polar Software Inc., our reseller and seller of record. For checkout, payment, tax and invoices Polar decides how it handles your data, under its own privacy policy. It isn’t acting on our instructions there. When you start a checkout we send Polar your email address, the workspace’s ID and the plan you chose. We get back a customer reference, the plan and add-on packs, their status, the billing period and renewal date. We never receive card details, and we don’t store your name or address from Polar.

4. AI features

All of these are optional and start only when someone uses them. We don’t use customer content to train AI models. What each provider does with it is below.

Voice comments. While you record, audio goes to AssemblyAI’s EU servers and comes back as text. We store only the text. AssemblyAI says it does not use audio sent to its EU servers for model training.
Translation. When a team member clicks translate, the comment text goes to Google’s Gemini API, with emails, phone numbers and web addresses replaced first. Under its paid-service terms Google does not use it to improve its products. Google keeps it for up to 55 days to detect abuse and for legally required disclosures. Authorised Google staff can read what its systems flag, and it can train the models that do this checking, but no others.
AI brief. The brief replaces the names, email addresses and phone numbers it finds in the comments you select, and shows you what it replaced before you create the link. That is not anonymisation: what a comment says can still point to a person, and screenshots, quoted document text and the file name are not changed. A screenshot can show a face, a signature or a customer record, so check the brief before sharing it. Anyone with the link can open it until it expires or you revoke it. We run no AI on it. What the tool you paste it into does with the content is between you and its provider.

5. Live websites and HTML courses

When you open a website or uploaded course for review, its code runs in your browser, in a sandbox on a separate address. It can load content from other servers and set its own cookies on that sandbox address, as it would on the original site. The customer who added it is responsible for that content.

6. Cookies and browser storage

We only store what a function you asked for needs (§ 25(2) no. 2 TDDDG), which requires no consent. Fonts and scripts on these pages come from our own server, and nothing is loaded from other sites until you open a file, course or website for review or go to checkout.

Name: __Host-wunderblick_session
Purpose: Keeps you signed in. Set when you log in.
Lifetime: 30 days, or until you log out

Name: wunderblick_signed_in
Purpose: Tells our website to take you straight to the app while you’re signed in. It holds no identity. Set when you log in, for wunderblick.com and its subdomains.
Lifetime: 30 days, or until you log out

Name: wunderblick_guest_…
Purpose: Remembers an external reviewer who confirmed their identity, so a review can continue over several visits. Set when they enter their code or name.
Lifetime: 90 days

Name: wunderblick_rpw_…, _dpw_…, _tpw_…
Purpose: Remembers that you entered a link’s password. Set when you enter it.
Lifetime: 90 days

Name: wunderblick_requested_workspace, wunderblick_signup_owner
Purpose: Finish a sign-up: the workspace you asked for, and which browser may keep the password you chose. Set when you sign up.
Lifetime: 1 hour and 1 day, gone once your email is confirmed

Name: wunderblick_theme
Purpose: Your light or dark setting. Set when you choose one.
Lifetime: 1 year

Name: Browser storage
Purpose: Panel sizes, sort order, your comment shortcut, the view of a project’s grid, the review you last opened, which workspace your tabs are on, notices you dismissed, your name and email on review forms. Stays on your device and is never sent to us.
Lifetime: Until you clear it

Name: Browser storage in the demo
Purpose: Comments you write in the demo on our home page. They stay in your browser and are never sent to us.
Lifetime: Until you close the tab

Name	Purpose	Lifetime
`__Host-wunderblick_session`	Keeps you signed in. Set when you log in.	30 days, or until you log out
`wunderblick_signed_in`	Tells our website to take you straight to the app while you’re signed in. It holds no identity. Set when you log in, for wunderblick.com and its subdomains.	30 days, or until you log out
`wunderblick_guest_…`	Remembers an external reviewer who confirmed their identity, so a review can continue over several visits. Set when they enter their code or name.	90 days
`wunderblick_rpw_…, _dpw_…, _tpw_…`	Remembers that you entered a link’s password. Set when you enter it.	90 days
`wunderblick_requested_workspace, wunderblick_signup_owner`	Finish a sign-up: the workspace you asked for, and which browser may keep the password you chose. Set when you sign up.	1 hour and 1 day, gone once your email is confirmed
`wunderblick_theme`	Your light or dark setting. Set when you choose one.	1 year
Browser storage	Panel sizes, sort order, your comment shortcut, the view of a project’s grid, the review you last opened, which workspace your tabs are on, notices you dismissed, your name and email on review forms. Stays on your device and is never sent to us.	Until you clear it
Browser storage in the demo	Comments you write in the demo on our home page. They stay in your browser and are never sent to us.	Until you close the tab

7. Who else receives data

We use the service providers on our subprocessor list, each under a data processing contract. Polar is listed there too, as an independent seller rather than a processor (section 3). Some are based in the USA. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified (Art. 45 GDPR) and on the EU standard contractual clauses (Art. 46(2)(c) GDPR). Ask us for a copy. We share data with authorities only when the law requires it.

The help centre and bug report form linked inside the app are at userdock.mynd.com, a separate mynd service you only reach by opening those links.

8. Deletion

Owners can delete files, projects, workspaces and accounts themselves, and the stored data goes with them.

Deleting a comment hides it. It does not erase it yet. It disappears from view at once and stays in the database as part of the project’s review record, until its file or project is deleted. There is no fixed time limit, because a project can stay open for as long as you use it. If a comment has to go sooner, the workspace owner can ask us and we erase it, normally within 30 days.

Backups age out after 30 days, so anything deleted is gone from them after that.

9. Your rights

You can ask for access (Art. 15 GDPR), correction (Art. 16), deletion (Art. 17), restriction (Art. 18) and a portable copy of your data (Art. 20). Where we rely on consent, you can withdraw it at any time for the future.

You can object at any time, on grounds relating to your situation, to processing based on legitimate interests (Art. 21 GDPR).

Write to beratung@mynd.com or to our data protection officer. You can also complain to a supervisory authority. Ours is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany, datenschutz.hessen.de.

10. Changes

We update this policy when the service or the law changes. The date at the top shows the current version.