Privacy policy

Deutsche Fassung

1. Controller

Mindcaptain Services OÜ, Ahtri tn 12, 15551 Tallinn, Harju County, Estonia. Represented by Thomas Wiens (Managing Director / juhatuse liige). Email: hello@mindcaptain.com

This policy covers Smallwerk and every app operated under it:

• Formlane: a form backend that receives, stores and forwards form submissions from customer websites. Free $0/month · Starter $8/month · Pro $19/month

All apps share one account (single sign-in). We only process personal data as far as needed to run the service.

2. Purposes and legal bases

• Account and subscriptions: email address, apps used, plan and payment status to provide the account and bill it (Art. 6(1)(b) GDPR) and to meet statutory retention duties (Art. 6(1)(c) GDPR).
• Content you or your users submit to an app (e.g. form submissions): to provide that service (Art. 6(1)(b) GDPR); for third-party data we act as a processor (section 3).
• Strictly necessary cookies: a session cookie for sign-in. No consent is needed (§ 25(2) no. 2 TTDSG/TDDDG); further processing is based on our legitimate interest in secure sign-in (Art. 6(1)(f) GDPR). Dismissing the cookie notice is stored only in your browser (localStorage).
• Server logs and abuse protection: IP address, time and requested URL for secure operation; for rate limits we store IP addresses only as a salted hash (Art. 6(1)(f) GDPR).
• Product updates (optional): only if you tick the box at sign-in or subscribe on your account page, we send occasional product updates and offers (incl. upgrade tips) and sync email, apps used, plan and usage level to our CRM (ActiveCampaign) for this purpose (consent, Art. 6(1)(a) GDPR). We store the time and the wording version of your consent. You can withdraw at any time on your account page or via the unsubscribe link; without consent no data is sent to the CRM.
• Sign-up source: when you create an account we store how you found us (campaign parameters such as utm_source from the link you followed, a referral code or the referring website) to understand which channels work (Art. 6(1)(f) GDPR). No cookies or tracking scripts are used for this.
• Live demos: demo forms on our pages are processed only to show you the result; nothing is stored or emailed.

3. Processing on behalf of customers

For data that third parties send to our customers through an app (Formlane: names, email addresses and messages that visitors enter into customer forms), the customer is the controller. We process it as a processor under Art. 28 GDPR, strictly on the customer's instructions. A data processing agreement (DPA) including the list of subprocessors is available on request at hello@mindcaptain.com.

4. Hosting and service providers

• Supabase (Supabase Inc., USA): database and sign-in, stored in the EU, Frankfurt region (eu-central-1).
• Vercel (Vercel Inc., USA): delivery and execution of the application, compute region Frankfurt (fra1).
• Stripe (Stripe Payments Europe Ltd., Ireland): payment processing. You enter payment details directly with Stripe; we never receive them.
• Transactional email (Resend, Plus Five Five Inc., USA): sign-in links, form notifications and service emails about your account (welcome, usage limits, plan changes; contract basis, Art. 6(1)(b) GDPR, sent regardless of marketing consent); content: recipient address and message text.
• ActiveCampaign (ActiveCampaign LLC, USA): customer management and product-update emails, only with your consent (email, apps used, plan, usage level).

Data processing agreements are in place or will be concluded with all providers. Transfers to the USA rely on the EU-US Data Privacy Framework or EU standard contractual clauses (Art. 45, 46 GDPR).

5. No AI, no advertising trackers

We do not pass data to AI services. There are no analytics, advertising or marketing trackers and no social media plugins.

6. Retention

• Content in the apps (e.g. submissions): until the customer deletes it, at the latest 30 days after their account ends.
• Account data: for the lifetime of the account, deleted within 30 days afterwards.
• Invoices and payment records: per statutory retention periods (up to 10 years).
• Server logs and IP hashes: usually no longer than 30 days.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability/export (Art. 20) and to object (Art. 21 GDPR). Write to hello@mindcaptain.com. If your request concerns data you sent to one of our customers, we forward it to that customer.

You may also lodge a complaint with a data protection authority (Art. 77 GDPR), e.g. the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the authority where you live or work.