Last updated 31 October 2026
Privacy policy
Mentry works with personal and sometimes sensitive information about how you think and feel. This policy explains, in plain language, what we collect, why, who helps us process it and the rights you have over it.
1. Who is responsible for your data
The data controller is Salman Amrabou, tax ID 41688873Q, with address at Carrer Lisboa, 17480 Roses (Girona), Spain, operating the Mentry service (“Mentry”, “we”, “us”). You can contact us about anything related to your data at rehechoyt@gmail.com.
This policy follows the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Spain’s Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
2. What Mentry is — and what it is not
Mentry is a self-knowledge and growth tool based on cognitive psychology and AI. It is not a medical device or therapy service and does not replace professional mental health support.
We never diagnose, never assign clinical labels and never recommend treatment. Because some of what you write may still reveal information about your wellbeing, we treat everything you write inside the app as sensitive.
3. What we collect
| Category | Examples |
|---|---|
| Account data | Email address, name, and basic profile data from Google if you sign in with Google. |
| Onboarding answers | Why you came, previous personality tests, mental clarity score, the area and goal you want to work on, what usually holds you back. |
| Thinking profile | Answers to the thinking test and the resulting percentages for each thinking style. |
| Content you write | Session descriptions, journal entries, messages to the Coach, check-ins. |
| Derived data | Patterns detected in your text, the short quotes they came from, whether you confirmed them, your plan, actions and progress. |
| Technical data | Session cookies, IP address and basic logs needed to keep the service secure and working. |
Mentry remembers patterns, not full conversations: the Coach works from a short, structured summary (your name, goal, thinking style, top patterns, this week’s actions, your latest check-in and what you told us in onboarding) plus only today’s last few messages, not from your entire history. Your Coach messages are saved in your account so you can read them again; you can delete them at any time with “clear chat”.
4. Why we use it and on what legal basis
- To provide the service you sign up for — your account, profile, map, plan and progress. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- To process the content you write and any information about your wellbeing it may contain. Legal basis: your explicit consent (Art. 9(2)(a) GDPR), which we ask for with its own unticked checkbox during onboarding and record with the date and the version of this policy. You can withdraw it at any time in Privacy & account, without deleting your account: we then delete what you wrote (sessions, journal, patterns, Coach messages and check-ins) and stop processing it. Withdrawal does not affect processing carried out before.
- To keep Mentry secure and prevent abuse, including per-user limits on AI usage. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
- To understand how the product is used in aggregate (for example, how many people finish onboarding). We use counts from our own database, never third-party tracking. Legal basis: legitimate interest.
- To show safety resources. If something you write suggests you may be at risk, Mentry stops the analysis and shows crisis contacts (024 and 112). We check for this before any AI analysis, and that text is not saved. We do not contact anyone on your behalf.
We do not sell your data, use it for advertising, or make decisions with legal or similarly significant effects about you based solely on automated processing.
5. AI processing
To detect thinking patterns, power the Coach and analyse journal entries, the relevant text is sent to Anthropic’s Claude API. Anthropic processes it as our processor under its commercial terms, which do not allow it to use API data to train its models. Anthropic keeps API data only for a limited time under its retention policy (for example, to detect abuse) and then deletes it. See Anthropic’s Privacy Center for the current period. We send only what each feature needs and never your full history.
AI output can be wrong. Every pattern Mentry suggests is shown with the exact quote it came from, and you decide whether it fits (yes, partly or not really).
In line with the EU AI Act (Regulation (EU) 2024/1689), we tell you whenever you are interacting with AI or reading AI-generated content: the Coach, detected patterns and weekly actions are labelled as AI. Mentry does not use AI to make decisions about you, and it never infers emotions from your face, voice or body.
6. Who we share it with
We use a small number of service providers who process data only on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Authentication and database | EU region |
| Netlify | Hosting, delivery of the website and server functions | EU and USA |
| Anthropic | AI processing (Claude API) | USA |
| Sign-in with Google, only if you choose it | EU and USA |
Where data is transferred outside the European Economic Area, it is protected by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission’s Standard Contractual Clauses.
7. How long we keep it
- Account and app data: while your account is active.
- When you delete your account, we delete your data within 30 days, except what the law requires us to keep.
- Records of your consent (date and policy version) and daily AI-usage counts: while your account is active.
- Technical and security logs: up to 90 days.
8. Your rights
You can, at any time and free of charge:
- access your data and get a copy of it;
- correct inaccurate data;
- delete your data and your account;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw your consent, without affecting processing before the withdrawal.
You can download all your data and delete your account yourself, at any time, in Privacy & account inside the app. For anything else, write to rehechoyt@gmail.com from the email linked to your account. We reply within one month. If you are not happy with our answer, you can complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es.
9. Minimum age
Mentry is only for people aged 16 or over. In line with Article 7 of the LOPDGDD, we do not knowingly collect data from anyone younger. If you believe someone under 16 has created an account, contact us and we will delete it.
10. Cookies
Mentry uses only essential cookies and similar storage: the ones needed to keep you signed in, keep your session secure and remember that you have seen the cookie notice. They are exempt from consent under Article 22.2 of Spain’s LSSI because the service cannot work without them.
We do not use analytics, advertising or social media cookies.
| Name | Purpose | Duration |
|---|---|---|
| sb-* (Supabase auth) | Keeps you signed in securely | Session / up to 1 year |
| mm-cookie-notice (local storage) | Remembers you dismissed the cookie notice | Until you clear it |
11. Security
Data is encrypted in transit (HTTPS) and at rest. Each user can only access their own records, enforced at database level (row-level security). Access to production data is restricted to what is strictly necessary to run the service.
12. Changes
If we make material changes to this policy, we will tell you in the app or by email before they take effect. The date at the top shows the latest version.