Privacy Policy

Privacy Policy

Last Updated: October 27, 2026
Version: 1.4.2
Effective Date: October 9, 2026

1. Introduction and Controller Information

Welcome to Jollido (formerly SocialNext; "we," "us," "our"). We are committed to protecting your personal data and respecting your privacy rights under the General Data Protection Regulation (GDPR) and other applicable data protection laws.

Data Controller

Company Name: MentalNext Ltd (MentalNext Oy)
Jurisdiction: European Union
Email: olli@mentalnext.com
Website: https://jollido.app

This Privacy Policy describes how MentalNext Ltd handles your personal data.

Data Protection Officer

We have designated a data protection contact person for privacy-related matters. For data protection inquiries, please contact us at olli@mentalnext.com.

Supervisory Authority

You have the right to lodge a complaint with the data protection supervisory authority in your country of residence. A list of EU/EEA supervisory authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

2. Scope and Application

This Privacy Policy applies to:

• Our website at https://jollido.app
• Our web application and all associated services
• All personal data we collect, process, and store
• Users in the European Economic Area (EEA), United Kingdom, and other jurisdictions

Important: By using our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our services.

3. Legal Basis for Processing and Data We Collect

Under GDPR Article 6, we process your personal data based on the following legal grounds:

3.1 Account and Profile Information

Legal Basis: Contract Performance (GDPR Article 6(1)(b)) and Consent (GDPR Article 6(1)(a))

Data Collected:

• Authentication Data: Email address
• Profile Information: First name, last name, timezone
• Account Status: Signup date, last login, onboarding completion status
• Technical Identifiers: User ID (UUID), session ID

Purpose: To create and manage your account, authenticate you, and provide our services.

Retention: Retained for the duration of your account plus up to 1 year after account deletion for legal obligations (contract fulfillment, dispute resolution).

3.2 Assessment and Survey Responses

Legal Basis: Consent (GDPR Article 6(1)(a)) and Contract Performance (GDPR Article 6(1)(b))

Data Collected:

• Survey Responses: Your answers to mental health assessment questions (survey 1-5)
• Anxiety Metrics: Calculated anxiety scores, levels, and categories
• Personality Profiles: Analyzed personality traits and patterns
• Safety Behaviors: Information about avoidance patterns and coping mechanisms
• Progress Data: Improvement scores, baseline measurements, confidence levels

Purpose:

• To provide personalized mental health support and recommendations
• To track your progress over time
• To deliver AI-generated feedback and coping strategies

Special Category Data: Survey responses may include information about mental health, which is considered "special category data" under GDPR Article 9. We process this data based on your explicit consent (Article 9(2)(a)).

Retention: Up to 1 year after account closure or until you request deletion, whichever comes first. This data is essential for providing our therapeutic services and may be retained longer if you continue using the service. Answers given without an account (before you sign up) are deleted 1 year after they were given.

3.3 Exercise and Practice Data

Legal Basis: Contract Performance (GDPR Article 6(1)(b))

Data Collected:

• Exercise Progress: Completion status, difficulty ratings, effectiveness ratings
• Practice Sessions: Scheduled dates/times, completion status, duration
• Exercise Notes: Your personal notes and reflections
• Performance Metrics: Streak counts, completion times, customizations

Purpose: To deliver therapeutic exercises, track your progress, and improve service effectiveness.

Retention: Up to 1 year after account closure or until you request deletion, whichever comes first.

3.4 Payment and Subscription Information

Legal Basis: Contract Performance (GDPR Article 6(1)(b)) and Legal Obligation (GDPR Article 6(1)(c))

Data Collected:

• Subscription Details: Plan type, subscription status, expiration dates
• Payment Transactions: Amount, currency, payment status, transaction dates
• Stripe Identifiers: Customer ID, payment intent ID, session ID (processed by Stripe)

Purpose:

• To process payments and manage subscriptions
• To comply with tax and accounting legal obligations
• To prevent fraud and protect against unauthorized transactions

Data Processor: Stripe, Inc. (see Section 5 for details)

Retention: Our app database keeps your payment and subscription records while you have an account. When you delete your account, they are deleted with it, or by the automatic deletion job no later than 1 year later (see Section 7). A record of a purchase that was moved between two accounts is kept while either account exists. A website payment that we could not link to an account at checkout (email, amount and checkout ID) is kept in our app database until we remove it; the automatic deletion job does not delete it. Technical copies of payment events that no longer belong to an active account are deleted 1 year after they were made. The payment and accounting records that tax and bookkeeping laws require are kept by our payment providers (Stripe for payments on our website, Apple for the App Store, Google for Google Play) and in our accounting, for as long as those laws require.

3.5 AI-Generated Content and Feedback

Legal Basis: Consent (GDPR Article 6(1)(a)) and Contract Performance (GDPR Article 6(1)(b))

Data Collected:

• AI Prompts: Input data sent to Google Vertex AI for feedback generation
• Generated Responses: AI-generated feedback, recommendations, coping strategies
• User Ratings: Your ratings and feedback on AI content helpfulness
• Usage Metadata: Feedback type, trigger events, view/action status

Purpose:

• To provide personalized AI-powered mental health feedback
• To improve AI response quality
• To monitor AI content appropriateness

Data Processor: Google Vertex AI (EU multi-region) - see Section 5 for details

EU Data Residency: AI processing occurs within the European Union to ensure GDPR compliance and data residency requirements are met.

Retention: While you have an account, and no longer than 1 year after you close it, or until you request deletion. AI feedback given without an account (before you sign up) is deleted 1 year after it was created. AI feedback is stored to monitor response quality and improve future recommendations.

3.6 Social Diary Entries (NEW - Added Oct 2025)

Legal Basis: Contract Performance (GDPR Article 6(1)(b)) and Consent (GDPR Article 6(1)(a))

Data Collected:

• Situation Descriptions: Details about social situations you practiced
• Fears and Concerns: Anxieties anticipated before the situation
• Anxiety Levels: Self-reported anxiety ratings (1-10 scale)
• Outcomes: What actually happened during the situation
• Reflections: Positive surprises, perceived errors, areas for improvement
• AI-Generated Summaries: Lesson summaries created by our AI

Purpose:

• To track your real-world practice experiences
• To help you reflect on and learn from social situations
• To measure progress over time
• To provide personalized feedback and encouragement

Special Category Data: Social diary entries may contain mental health information. Processing is based on your explicit consent.

Retention: Duration of account + up to 1 year after account closure, as these entries have long-term therapeutic value.

Database Tables: social_diary_entries

3.7 Analytics and Usage Data

Legal Basis: Legitimate Interest (GDPR Article 6(1)(f)) with consent for non-essential cookies

Data Collected:

• Page Views: Pages visited, timestamps, referrer information
• Events: User actions, feature usage, interaction patterns
• Session Data: Session duration, device type, browser information
• Lead Captures: Email address (optional), interest level, source page
• Purchase Intents: Plan type, pricing interactions, checkout abandonment

Database Tables: page_views, events, lead_captures, purchase_intents

Purpose:

• To understand how users interact with our service
• To improve user experience and service functionality
• To identify and fix technical issues
• To make informed business decisions

Legitimate Interest Assessment: We have determined that processing this data serves our legitimate business interests in improving our service, and does not override your fundamental rights and freedoms. You can object to this processing at any time (see Section 11.5).

Retention: Analytics data is kept while you have an account, and no longer than 1 year after you close it. Analytics data collected without an account is deleted 1 year after it was collected. Aggregated/anonymized data is retained indefinitely for statistical purposes. Raw logs are retained for 90 days.

3.8 Consent and Policy Acceptance Records

Legal Basis: Legal Obligation (GDPR Article 6(1)(c))

Data Collected:

• Consent Type: Cookies, analytics, marketing, terms acceptance
• Consent Decision: Whether consent was given or denied
• Policy Version: Version number of policy accepted
• Timestamp: When consent was recorded
• IP Address: Anonymized IP address (last octet removed)
• User Agent: Browser/device information for authenticity

Purpose:

• To demonstrate GDPR compliance with consent requirements
• To maintain an audit trail of policy acceptances
• To enable withdrawal of consent
• To track policy version acceptance for update notifications

Retention: Duration of account + up to 1 year, to demonstrate compliance. Consent records made without an account are deleted 1 year after they were made.

Database Tables: consent_records, policy_versions

Note: IP addresses are automatically anonymized before storage using our anonymize_ip() function, which removes the last octet of IPv4 addresses for privacy.

3.9 Technical and Security Data

Legal Basis: Legitimate Interest (GDPR Article 6(1)(f)) and Legal Obligation (GDPR Article 6(1)(c))

Data Collected:

• IP Addresses: Anonymized/truncated IP addresses (last octet removed for IPv4)
• User Agent: Browser and device information
• Security Audit Logs: Authentication attempts (login success/failure), password changes, password reset requests, session creation, account deletion requests
• Error Reports: Technical errors and crash reports (via Sentry, with PII scrubbing enabled)
• Session Tokens: JWT tokens for authentication (short-lived, not stored permanently)

Database Tables: security_audit_log

Purpose:

• To ensure service security and prevent fraud
• To comply with legal obligations for security incident logging
• To troubleshoot technical issues
• To protect against abuse and unauthorized access

Retention: Security logs are kept while you have an account, and no longer than 1 year after you close it, for incident investigation and compliance audits. Security logs that belong to no account are deleted 1 year after they were created. Error reports retained for 90 days, after which they are automatically deleted from Sentry.

3.10 Voice Simulation Data

Legal Basis: Consent (GDPR Article 6(1)(a)) and Contract Performance (GDPR Article 6(1)(b))

Data Collected:

• Real-time Voice Audio: Streamed during voice simulation exercises (not stored or recorded)
• Exercise Scenario Context: The scenario parameters and settings used during the voice exercise

Special Note: Audio is streamed in real-time to Google Gemini Live API for conversational voice simulation and is not persisted by us or by Google. No audio recordings are stored at any point.

Data Processor: Google Vertex AI (EU multi-region)

Retention: No audio retention -- voice data is streamed in real-time only and is not stored. Exercise metadata (scenario type, completion status) is retained per Section 3.3 retention periods.

3.11 AI Transparency and EU AI Act Compliance

AI-Powered Features

MentalNext uses Google Gemini AI models (via Google Vertex AI) to power certain features of the Service. The following features use AI processing:

• Survey Feedback: AI-generated analysis of your survey responses to provide personalized insights
• Exercise Feedback: AI-generated feedback on your exercise completions
• Coach Feedback: AI-generated coaching responses based on your progress and diary entries
• Voice Simulation: Real-time AI-powered conversational practice for exposure exercises
• Exercise Recommendations: AI-suggested exercises based on your profile and progress
• Coping Strategies: AI-generated coping strategy suggestions

Important Disclosures

• All AI-generated content is advisory only and does not constitute clinical diagnosis, treatment recommendations, or medical advice
• We do not engage in fully automated decision-making that produces legal or similarly significant effects on users (GDPR Article 22)
• AI outputs are clearly labeled in the user interface with an "AI-generated" indicator

Data Sent to AI Models

• Survey scores and anonymized exercise responses
• Voice audio during voice simulation sessions (streamed in real-time, not stored)
• We do not send personally identifiable information (names, email addresses) to AI models

Data Residency and Security

• All AI processing occurs within the EU (Google Cloud EU multi-region)
• Data is encrypted in transit using TLS 1.2+

Human Oversight

• AI system prompts and outputs are reviewed by qualified professionals on the MentalNext team
• The MentalNext team maintains AI literacy training on system capabilities and limitations

Your Rights Regarding AI Processing

• You may contact us at olli@mentalnext.com with any questions or concerns regarding AI processing of your data
• You have the right to request human review of any AI-generated content or recommendation

3.12 App Waitlist

Legal Basis: Consent (GDPR Article 6(1)(a)), which you give when you submit the waitlist form on our website (https://jollido.app/app)

Data Collected:

• Email Address: The address you enter in the form
• Phone Platform: iPhone or Android, as you choose in the form
• Source Page: The part of our website you came from (for example "/lp"), so that we know which pages lead people to the app
• Timestamp: When you signed up

Purpose: To tell you by email when the Jollido app is out for your phone. We use this list for nothing else.

Retention: Deleted within 1 year after you sign up. A daily automatic job deletes each entry when it is 1 year old (see Section 7).

Withdrawing Your Consent: You can withdraw your consent at any time. Email olli@mentalnext.com, and we delete your entry from the list.

Data Processor: Supabase (our database provider, EU region in Stockholm, Sweden). We do not give the list to anyone else.

Database Tables: app_waitlist

4. How We Use Your Data

We use your personal data for the following purposes:

4.1 Service Delivery

• Account creation and authentication (magic link email)
• Providing mental health assessment and progress tracking
• Generating personalized AI feedback and recommendations
• Delivering therapeutic exercises and practice schedules
• Managing your subscription and access to premium features

4.2 Communication

• Sending transactional emails (account verification, password resets, payment confirmations)
• Sending practice reminders (if enabled by you)
• Responding to your support requests
• Sending important service updates (only when necessary)

Marketing Communications: We will only send marketing emails with your explicit opt-in consent. You can withdraw consent at any time.

4.3 Service Improvement

• Analyzing usage patterns to improve user experience
• Testing new features and functionality
• Conducting research to enhance therapeutic effectiveness
• Identifying and fixing bugs and technical issues

4.4 Legal and Security

• Complying with legal obligations (tax, accounting, data protection)
• Preventing fraud and abuse
• Protecting against security threats
• Enforcing our Terms of Service
• Responding to legal requests from authorities

5. Data Sharing and Third-Party Processors

We do not sell your personal data. We share data only with trusted service providers who process data on our behalf under strict contractual obligations.

5.1 Third-Party Data Processors

Supabase (Database and Infrastructure)

Provider: Supabase, Inc.
Purpose: Database hosting, authentication, backend infrastructure
Data Shared: All data listed in Section 3
Security: Data encrypted at rest and in transit, Row Level Security (RLS) enabled
Website: https://supabase.com/privacy

Stripe (Payment Processing)

Provider: Stripe, Inc.
Location: United States (EU data protected under Standard Contractual Clauses)
Purpose: Payment processing, subscription management
Data Shared: Email, payment information, transaction details, customer ID
Security: PCI DSS Level 1 certified
Website: https://stripe.com/privacy

Note: Stripe processes payment card data directly; we never store full card numbers.

Google Vertex AI (AI Content Generation)

Provider: Google LLC
Location: European Union (EU multi-region)
Purpose: Generating personalized mental health feedback and recommendations using Google Gemini models via Vertex AI
Data Shared: Survey responses, exercise outcomes, assessment data (pseudonymized where possible). No personally identifiable information (name, email) is included in AI prompts.
EU Data Residency: All AI processing occurs within the EU, ensuring your data never leaves the European Economic Area for AI processing.
Website: https://cloud.google.com/vertex-ai/docs/generative-ai/learn/data-governance

Sentry (Error Monitoring)

Provider: Functional Software, Inc. (Sentry)
Location: United States
Purpose: Error tracking, performance monitoring, bug detection
Data Shared: Technical error data, user IDs (with PII scrubbing enabled)
Security: PII scrubbing active, IP addresses anonymized
Website: https://sentry.io/privacy

Twilio SendGrid (Email Delivery)

Provider: Twilio Inc.
Location: United States
Purpose: Transactional email delivery (welcome emails, exercise reminders)
Data Shared: Email address, first name
Transfer Mechanism: Standard Contractual Clauses (SCCs)
Website: https://www.twilio.com/legal/privacy

5.2 Legal Disclosures

We may disclose your personal data if required by law, legal process, or government request, including:

• Court orders or subpoenas
• Law enforcement requests
• National security requirements
• Protection of our rights or safety of users

We will notify you of such disclosures unless legally prohibited.

6. International Data Transfers

Our service processes data internationally through the following transfers:

For EU/EEA Users: When your data is transferred outside the EEA, we ensure it is protected by:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy Decisions where the destination country is deemed to provide adequate protection
• Appropriate technical and organizational measures to ensure data security

7. Data Retention Periods

We retain your personal data only as long as necessary for the purposes outlined in this policy.

After Retention Period: Data is permanently deleted or anonymized for statistical purposes.

Automatic Deletion: Every day, an automatic job deletes records that no longer belong to an active account (for example security and usage logs, consent records, answers given without an account, and technical copies of payment events) once they are older than 1 year.

Payment and Accounting Records: Our app database deletes your payment records when you close your account, or no later than 1 year after (see Section 3.4 for the details). The payment and accounting records that tax and bookkeeping laws require are kept by our payment providers (Stripe for payments on our website, Apple for the App Store, Google for Google Play) and in our accounting, for as long as those laws require (see Section 3.4).

Backups: Our database provider (Supabase, EU region in Stockholm, Sweden) keeps a daily backup of the database for 7 days. Data that we delete is gone from all backups within 7 days.

Your Right to Deletion: You can request earlier deletion at any time, subject to our legal obligations (see Section 11.3).

8. Data Security Measures

We implement appropriate technical and organizational measures to protect your personal data:

8.1 Technical Safeguards

• Encryption: Data encrypted at rest (AES-256) and in transit (TLS 1.3)
• Access Controls: Row Level Security (RLS) ensuring users can only access their own data
• Authentication: Secure magic link authentication with JWT tokens
• Network Security: HTTPS enforced, HSTS headers, CSRF protection
• Rate Limiting: Protection against brute force attacks and abuse
• Security Monitoring: Automated error tracking and security event logging

8.2 Organizational Safeguards

• Access Management: Principle of least privilege, role-based access control
• Employee Training: Regular security and data protection training [if applicable]
• Incident Response: Data breach response plan in place (our detailed breach response procedures are available upon request)
• Vendor Management: Data Processing Agreements with all processors
• Regular Audits: Quarterly security and compliance reviews

8.3 Anonymization and Pseudonymization

• IP Addresses: Last octet removed before storage
• Analytics: User identifiers pseudonymized where possible
• Error Reports: PII automatically scrubbed by Sentry
• API Calls: Consideration of anonymization before Vertex AI submission

Breach Notification: In the unlikely event of a personal data breach, we will notify affected users and the supervisory authority within 72 hours if the breach poses a risk to your rights and freedoms.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to provide and improve our services.

9.1 Essential Cookies

Purpose: Authentication, security, basic functionality
Legal Basis: Necessary for service delivery (no consent required)
Examples:

• Session cookies for authentication
• CSRF tokens for security
• Local storage for user preferences

9.2 Analytics Cookies

Purpose: Understand usage patterns, improve user experience
Legal Basis: Consent (opt-in required)
Examples:

• Page view tracking
• Feature usage analytics
• Performance monitoring

Your Control: You can manage cookie preferences through our cookie consent banner or in your account settings.

Third-Party Cookies: We do not currently use third-party advertising cookies or trackers.

For detailed information, see our separate Cookie Policy.

10. Children's Privacy

Our service is not intended for individuals under the age of 13.

Age Verification: We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at olli@mentalnext.com.

Parental Rights: Parents or guardians have the right to access, rectify, or delete their child's data.

11. Your Rights Under GDPR

As a data subject in the EU/EEA, you have the following rights:

11.1 Right of Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data and to access a copy of your data.

How to Exercise:

• Go to My Data & Privacy → Export Data
• Email olli@mentalnext.com with subject "Data Access Request"

Response Time: Within 1 month (may be extended by 2 months for complex requests)

Format: JSON, CSV, or PDF

11.2 Right to Rectification (Article 16)

You have the right to correct inaccurate or incomplete personal data.

How to Exercise:

• Update information directly in your Profile settings
• Contact olli@mentalnext.com for non-editable fields

11.3 Right to Erasure / "Right to be Forgotten" (Article 17)

You have the right to request deletion of your personal data when:

• Data is no longer necessary for the purpose collected
• You withdraw consent (where consent is the legal basis)
• You object to processing (Article 21)
• Data has been unlawfully processed
• Legal obligation requires deletion

Limitations: We may retain data if necessary for:

• Compliance with legal obligations (e.g., tax records)
• Establishment, exercise, or defense of legal claims
• Public interest or scientific research purposes

How to Exercise:

• Go to Profile → Account Settings → Delete Account
• Email olli@mentalnext.com with subject "Account Deletion Request"
• Follow the confirmation process (type "DELETE" to confirm)

Grace Period: You have 30 days to recover your account before permanent deletion.

11.4 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format.

How to Exercise:

• Go to My Data & Privacy → Export Data → Select JSON format
• Email olli@mentalnext.com with subject "Data Export Request"

Included Data: All personal data you provided to us under contract or consent.

11.5 Right to Object (Article 21)

You have the right to object to processing based on legitimate interests or direct marketing.

How to Exercise:

• Marketing: Unsubscribe link in emails or Profile → Privacy Settings
• Analytics: My Data & Privacy → Privacy Settings
• Other processing: Email olli@mentalnext.com with your objection

11.6 Right to Restriction of Processing (Article 18)

You have the right to request we restrict processing while:

• Verifying accuracy of contested data
• Processing is unlawful but you prefer restriction over deletion
• We no longer need data but you need it for legal claims
• Pending resolution of an objection (Article 21)

How to Exercise: Email olli@mentalnext.com with subject "Restriction Request"

11.7 Rights Related to Automated Decision-Making (Article 22)

Current Status: We do not engage in fully automated decision-making with legal or similarly significant effects. AI-generated feedback is advisory only and does not replace professional medical advice.

11.8 Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw consent at any time.

How to Exercise:

• Privacy Settings → Toggle off specific consents
• Email olli@mentalnext.com

Effect: Withdrawal does not affect lawfulness of processing before withdrawal.

11.9 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority.

Relevant Supervisory Authority: The data protection supervisory authority in your country of residence. A list of EU/EEA authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

Our Preference: We encourage you to contact us first so we can address your concerns directly.

12. Marketing and Communications

12.1 Transactional Emails

We send necessary service emails without requiring consent:

• Account verification and magic links
• Password reset requests
• Payment confirmations
• Important service updates
• Security alerts

You cannot opt out of transactional emails as they are essential for service delivery.

12.2 Marketing Emails

We send marketing communications only with your explicit opt-in consent.

Content May Include:

• New feature announcements
• Mental health tips and resources
• Special offers or promotions
• Research participation opportunities

How to Opt Out:

• Click "Unsubscribe" in any marketing email
• Profile → Privacy Settings → "Receive Marketing Emails" toggle
• Email olli@mentalnext.com

12.3 Exercise Reminders

Practice session reminders are optional and can be toggled in your Calendar settings.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes in our data processing practices
• New legal or regulatory requirements
• Service enhancements or new features
• Feedback from supervisory authorities

Notification Process:

• Material Changes: We will notify you by email and/or prominent notice in our app at least 30 days before changes take effect
• Minor Changes: We will update the "Last Updated" date and "Version" number
• Re-consent: If changes require new consent, we will request your explicit agreement

Version History: All previous versions are archived and available upon request.

Your Responsibility: Please review this policy periodically. Continued use after changes constitutes acceptance.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Company: MentalNext Ltd
Email: olli@mentalnext.com
Response Time: Within 5 business days

Subject Line Recommendations for Faster Response:

• Data Access Request
• Account Deletion Request
• Privacy Concern
• GDPR Rights Request
• Data Breach Report

15. Governing Law and Jurisdiction

Governing Law: This Privacy Policy is governed by the laws of the European Union, including the General Data Protection Regulation (GDPR).

Jurisdiction: Any disputes arising from this policy will be subject to the jurisdiction of the competent courts in the user's country of residence within the EU/EEA, or as otherwise required by applicable law.

For EU/EEA Users: Nothing in this section affects your statutory rights under GDPR or your right to lodge a complaint with your local supervisory authority.

Acknowledgment

By using our services, you acknowledge that:

1. You have read and understood this Privacy Policy
2. You consent to the collection, processing, and use of your data as described
3. You understand your rights under GDPR and how to exercise them
4. You are at least 13 years old or have parental consent