Privacy Policy

Last updated: 10 July 2026

This policy explains what personal data Mandala collects, why, and who processes it, in line with Article 13 of the General Data Protection Regulation (GDPR).

Who is responsible

The data controller for this service is:

Jeffrey Long
2842 E. 50th Ct.
Des Moines, IA 50317
United States
Email: jeff@jlintelligence.net

What we collect and why

• Your email address and password. Used to create and secure your account and to sign you in. The password is never stored in readable form — only a one-way hash is kept.
• The content you create. The mandalas, grids, tiles and summaries you write are stored so the app can show them back to you.
• Session and security data. When you sign in we record the session's IP address and browser user-agent, and the server keeps standard request logs. This lets us keep the account secure and prevent abuse.
• Email verification and password-reset tokens. Short-lived tokens sent to your email address to confirm it or reset your password.

Legal basis

We process your account data and content to provide the service you signed up for (performance of a contract, GDPR Art. 6(1)(b)). We process session and log data to keep the service secure (legitimate interests, GDPR Art. 6(1)(f)).

Who processes your data

The service runs entirely on EU-resident infrastructure. We use the following processors:

• Hosting: Hetzner Online GmbH, Germany — runs the application server and database.
• Transactional email: Scaleway SAS, France — delivers verification and password-reset emails.
• Backup and file storage: Scaleway Object Storage (Paris region), France — holds database backups and any files you upload.

Cookies

Mandala sets a single, strictly necessary session cookie so you stay signed in. It is not used for analytics or advertising, and no consent banner is required for it. We use no third-party analytics or tracking cookies.

How long we keep it

Account data and content are kept for as long as your account exists. Database backups are retained for 30 days. Server logs are kept only as long as needed for security and troubleshooting.

Your rights

Under the GDPR you have the right to access, correct, export, restrict, or delete your personal data, and to object to its processing. To exercise any of these, email jeff@jlintelligence.net and we will action the request. You also have the right to lodge a complaint with a data protection supervisory authority.

Changes

If this policy changes, the updated version will be posted on this page with a new date above.