Privacy Policy & Data Protection

Mistikist ("we", "our", or "us") is deeply dedicated to safeguarding your personal data and upholding transparency. This Privacy Policy details how we collect, process, store, and protect your personal information when you use the Mistikist mobile application (iOS / Android), our website (mistikist.com), and related digital services, in strict compliance with the General Data Protection Regulation (GDPR), the UK GDPR, and the Turkish Law on the Protection of Personal Data (KVKK).

1. Joint Data Controllers & Legal Entities

Your personal data is jointly controlled and processed by the operating corporate entities comprising Mistikist:

🇬🇧 UK Controller & Global Operations:

Mistikist LTD

Company Number: 15705777

Registered Address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

Data Protection Officer (DPO): [email protected]

🇹🇷 Turkish Entity & Intellectual Property:

Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat Anonim Şirketi

Mersis No: 0769152927300001

Address: Kötekli Mah. Denizli Yolu Blv. No:4B/23 Menteşe / MUĞLA, Turkey

Privacy Inquiries: [email protected]

2. Categories of Personal Data We Process

To provide personalized auditory brainwave entrainment and maintain synchronized account progression, we collect specific data points:

Identity & Account Data: Full name, email address, salted password hash, language preference, and avatar photo (if voluntarily uploaded).
Health, Sleep & Mental Wellbeing Data: Self-reported stress indicators, mood and emotional state logs, target sleep quality/duration goals, completed audio and visual brainwave session durations, frequency ladders (ramps), and personalized mind affirmations/intentions.
Session Progress & Neural Preferences: Target goals (Focus, Sleep, Anxiety Relief, Clarity), session playback history, and bookmarked sessions.
Device & Diagnostics Telemetry: Device hardware model, operating system version, unique installation identifier (UUID), anonymized IP address, and system crash logs.
Payment & Subscription Status: Tokenized transaction identifiers generated by Apple App Store, Google Play, or Stripe, along with subscription tier and renewal timestamps. (We NEVER store or process raw payment card numbers; all transactions are handled by PCI-DSS Level 1 compliant processors.)

3. Health, Wellness & Sensory Data Disclosures (Google Play Health Data Policy Compliance)

Access & Collection Methodology: To facilitate personalized cognitive relaxation, laser focus, and restorative sleep protocols, Mistikist accesses and collects only the wellness information you voluntarily provide in the app (such as self-reported daily stress levels, subjective mood logs, and sleep goals), alongside your completed audio-visual session telemetry (session timestamps, chosen frequency modes, and playback durations). We do NOT access external biometric sensors or third-party health databases without your explicit, voluntary affirmative action.

Purposes of Processing Health Data: Your health and wellness data is processed strictly to: (1) synthesize tailored audio-visual frequency protocols aligned with your cognitive state; (2) render personal wellness progress and historical trends within your private profile; and (3) refine our neuro-regulation frequency generation algorithms.

Explicit Non-Medical Device Disclaimer: Mistikist is a personal development, relaxation, and cognitive wellbeing software platform. Mistikist is NOT a certified medical device, diagnostic tool, or clinical treatment provider. Content, frequencies, and session logs provided by Mistikist do not constitute medical advice or psychiatric treatment. Users experiencing clinical psychiatric conditions, major depressive disorders, or photosensitive epilepsy must consult a licensed healthcare practitioner.

Strict Prohibition on Third-Party Advertising & Data Sales: Your health, sleep, and mental wellbeing data is treated as sensitive personal data. We NEVER sell, rent, license, or share your health, mood, or session data with third-party advertising networks, data brokers, or commercial marketing platforms. Health data is never used for targeted cross-app advertising or consumer profiling.

4. Purposes and Legal Bases for Data Processing

We process personal data in strict adherence to Article 6(1) of the GDPR and Article 5 of the Turkish KVKK:

Performance of Contract (GDPR Art. 6(1)(b)): To authenticate user accounts, deliver tailored frequency sessions, process Premium subscriptions, and synchronize session data across devices.
Legitimate Interests (GDPR Art. 6(1)(f)): To maintain application stability, diagnose memory leaks or crashes, defend against fraud, and optimize audio synthesis algorithms.
Legal Compliance (GDPR Art. 6(1)(c)): To satisfy tax, accounting, and consumer protection statutory mandates.
Explicit Consent (GDPR Art. 6(1)(a)): For non-essential analytics cookies and optional marketing notifications.

5. Third-Party Subprocessors & Infrastructure

We partner with industry-leading cloud infrastructure providers who adhere to rigorous international security certifications:

Cloud Hosting & Primary Database: Microsoft Azure (Frankfurt / Dublin, EU West) and Google Cloud Platform.
Authentication: Google Firebase Authentication & Firestore.
In-App Subscription Validation: Adapty.io (subscription status receipt checking).
Payment Gateways: Stripe Inc., Apple In-App Purchase, Google Play Billing.
Analytics & Telemetry: Google Analytics 4 (with Advanced Consent Mode v2), Firebase Crashlytics.
AI Cognition (Mistik AI): Google Gemini / OpenAI API (contextual prompt synthesis only; user personal data is NEVER retained to train foundational LLMs).

6. CRITICAL: Account Deletion & Complete Data Erasure (Google Play & Apple Compliant)

🛡️ ACCOUNT & DATA PURGE PROCEDURES

Mistikist provides all users with absolute control over their personal data. In strict accordance with Google Play Developer Policy and Apple App Store Review Guidelines, you can permanently delete your account and all associated personal data via two immediate mechanisms:

A. In-App Instant Self-Service Deletion: Launch the Mistikist Mobile App > Navigate to Profile > Tap the Settings gear icon > Select "Delete Account" > Confirm deletion. This immediately and irreversibly wipes your authentication credentials, session history, and personal profile from our active production database.

B. Web & Email Request: Send an email from your registered account address to [email protected] or [email protected] with the subject line "Delete My Account". Your request will be verified and executed within 30 days.

7. Data Retention Policy & Disposal Schedule (Google Play Data Retention Compliance)

Mistikist strictly observes data minimization principles. Personal and health-related data is retained only for the duration necessary to deliver our services. Below is our formal data retention schedule:

Active Account & Profile Records: Retained throughout the active lifecycle of your registered account to ensure service continuity.

Health, Sleep & Wellbeing Telemetry: Retained while your account is open to allow you to review personal progress and historic trends.

Diagnostic & System Telemetry Logs: Retained for a rolling maximum period of 90 days for cybersecurity defense and bug resolution, then automatically erased.

Encrypted Database Backups: Retained in encrypted cold storage for up to 30 days before automated cyclic overwriting.

Data Disposal Upon Account Deletion: When an account deletion is initiated (either via the in-app deletion button or written email request), all personal identifiers, health records, wellness logs, and credentials are permanently and irreversibly deleted or cryptographically anonymized across all production databases and storage systems within thirty (30) calendar days. Only anonymized transaction receipts strictly required by statutory tax and corporate accounting regulations are preserved for the legally prescribed duration.

All data communications are encrypted in transit via TLS 1.3, and data at rest is encrypted with AES-256.

7. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA) or the UK, we ensure appropriate safeguards are implemented, specifically European Commission Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum.

8. Your Statutory Rights (GDPR & KVKK)

Under GDPR Articles 15-22 and KVKK Article 11, you maintain the right to:

Request confirmation of whether your personal data is being processed,
Access a portable copy of your personal data,
Request rectification of inaccurate or incomplete information,
Request erasure ("right to be forgotten") of your records,
Object to or restrict the processing of your data,
Withdraw previously granted consent at any time without penalty,
Lodge a complaint with a supervisory authority (e.g., the UK ICO or your local EU Data Protection Authority).

9. Cookies & Google Analytics 4 Advanced Consent Mode v2

Our website deploys Google Analytics 4 with Advanced Consent Mode v2. If you decline analytics cookies, GA4 operates in a cookieless state and transmits anonymous, non-identifying telemetry pings to Google for aggregate behavioral modeling. No tracking cookies or persistent identifiers are placed on your device without your explicit consent.

10. Protection of Minors

Mistikist is not directed toward children under 16 years of age (or 13 where permitted by local law). We do not knowingly collect personal data from minors without verified parental consent.

11. Data Protection Officer & Inquiries

To exercise any of your privacy rights or contact our Data Protection Officer, please reach out to [email protected] or [email protected].