Privacy policy
Last updated: Septempber 18, 2026
General Information
Within this privacy policy (“Policy”) you will find information regarding the processing of personal data that Mindeverse s.r.o., with its registered office at Pasecká 863, 73543 Albrechtice, ID No. 29648629, File No. C 104221, kept by the Regional Court in Ostrava, Czech Republic (“we” or “our company”) processes as a data controller with you as a data subject (“you”).
We operate the website https://www.thefinds.app/ (“Website”) and the mobile app Finds (“App”, Website and App also collectively referred to as “Services”).
This Policy applies exclusively to situations in which our company acts as a data controller, i.e., where we process personal data in our own name and for our own purposes. Conversely, where we process personal data on behalf of and in accordance with the instructions of our customers, we act as a data processor and this policy shall not apply. In such cases, if you wish to exercise your rights, you must address them directly to the relevant data controller. In those instances, we process your personal data strictly in accordance with the data controller’s instructions and we are not authorized to handle requests independently. If you contact us in such a case, we will promptly forward your request to the relevant data controller.
Please note that this is a master Policy and some of its provisions only apply to individuals in certain jurisdictions, depends on whether you are protected under the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”) or under applicable U.S. privacy laws (such as the California Consumer Privacy Act (“CCPA”) and comprehensive consumer privacy laws in other U.S. states). If GDPR does not apply to you, please see section 9. “Specific provisions under applicable U.S. state privacy laws” below.
What personal information do we collect?
“Personal Data” or “Personal Information” is information we may process about you and means any data which identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual.
We may collect your Personal Data from the following sources:
directly from you, for example when you use the Services, submit content, contact us, send us a support request, complaint or otherwise communicate with us;
automatically when you access or use the Services, for example through server logs and, in the case of the App, the collection of device information and usage data;
from third parties, in particular from app stores, payment providers and similar platforms, such as Apple App Store, in order to facilitate purchases, verify transactions, manage subscriptions, billing, refunds and related account or payment processes.
For various purposes, we process different categories of Personal Data about you. These categories are:
Identification and contact data (e.g. name, surname, e-mail address, telephone, and billing address);
Account and authentication data (e.g. your login details, Apple ID, account settings, subscription status, plan type)
Device information (e.g. IP address, browser, language preferences);
Usage and interaction data (e.g. your in-app actions, preferences, saved items, library data, likes, follows, interactions with content)
Profile and user content data (e.g. your profile photo, profile information, preferences, likes, follows or other content or information you make available within the App)
Image and visual discovery data (e.g. photos or images submitted through the App for the purpose of visual discovery, temporary technical representations or embeddings created from such images, and related search or matching data)
Payment and billing data (e.g. subscription status, purchase history, transaction identifiers, purchase confirmations, Apple ID or other purchase-related information made available to us by app stores, payment providers or similar platforms);
Communication (all information about our mutual communication – support requests, complaints, etc.).
What Personal Data we process about you, for what purposes and for how long, depends on how and why you shared your Personal Data with us, or how we collected it. You may find more information about the data processing depending on the context in which the Personal Data is processed below.
WHAT PERSONAL DATA WE COLLECT AND HOW WE USE IT
Processing of Personal Data related to your use of the App
Purpose
Scope of processed information
Legal basis
Data Retention time
Account creation, authentication and account management
Identification and contact data
Account and authentication data
Device information
Pursuant to Article 6(1)(b) of the GDPR, we may process Personal Data where it is necessary for the performance of a contract
For the duration of your account. After account deletion, we may retain limited Personal Data where necessary to comply with legal obligations, resolve complaints, prevent misuse, or establish, exercise or defend legal claims.
Provision and management of subscription and other paid options
Identification and contact data
Account and authentication data
Payment and billing data
Usage and interaction data
Pursuant to Article 6(1)(b) of the GDPR, we may process Personal Data where it is necessary for the performance of a contract
Pursuant to Article 6(1)(c) of the GDPR, we may process Personal Data where it is necessary for compliance with our legal obligations, including accounting, tax and consumer protection obligations
For the duration of your account and the relevant contractual relationship. Payment, billing and accounting records are retained for the statutory period. Basic information necessary for legal claims may be retained for up to 3 years, and where required by law for up to 10 years.
Operation of user profile, saved items, library, preferences and in-app interactions
Identification and contact data
Profile and user content data
Usage and interaction data
Account and authentication data
Pursuant to Article 6(1)(b) of the GDPR, we may process Personal Data where it is necessary for the performance of a contract
For the duration of your account or until you delete the relevant content or information, unless longer retention is required or permitted by law.
Visual discovery and AI image processing
Image and visual discovery data
Device information
Account and authentication data
Usage and interaction data
Pursuant to Article 6(1)(b) of the GDPR, we may process Personal Data where it is necessary for the performance of a contract
Photos or images submitted for visual discovery and temporary technical representations or embeddings created from them are processed temporarily and deleted after the results are returned, unless limited retention is necessary for security, error handling, prevention of misuse, compliance with law, or establishment, exercise or defense of legal claims.
Product analytics, App performance and improvement of the Services
Device information
Usage and interaction data
Account and authentication data
Pursuant to Article 6(1)(f) of the GDPR, we may process Personal Data where necessary for our legitimate interest in understanding how the Services are used, improving their functionality, fixing errors, ensuring performance and developing new or improved features
For the necessary period, generally no longer than 12 months, unless a shorter period applies to specific categories of data or longer retention is necessary for security, legal compliance or legal claims.
Data provided by third-party app stores (such as Apple App Store) in order to facilitate purchases and manage billing and transactions
Identification and contact data
Payment and billing data
Pursuant to Article 6(1)(b) of the GDPR we may process Personal Data if it is necessary for contract performance
For the statutory period
Sending newsletter
Identification and contact data
Pursuant to Article 6(1)(f) of the GDPR - Our legitimate interest in sending special offers of our products or services to existing customers regarding similar products or services
Pursuant to Article 6(1)(a) of the GDPR, we may process Personal Data if we have your consent – which is required and relied upon for non-customer opt-in subscribers to receive our newsletter
Until you tell us that you no longer wish to receive a newsletter
Fulfilling legal obligations in the areas of consumer protection, accounting, and tax law
Identification and contact data
Payment and billing data
Pursuant to Article 6(1)(c) of the GDPR, we may process your Personal Data where it is necessary for compliance with our legal obligations
For the statutory period
Fulfilling legal obligations relating to the provision and handling of complaints about goods / services
Identification and contact data
Payment and billing data
Pursuant to Article 6(1)(c) of the GDPR, we may process your Personal Data where it is necessary for compliance with our legal obligations
For the duration of the contract and for a period of 3 years from the execution of the contract; basic information on the legal relationship and its existence (parties, subject of the obligation, etc.) for up to 10 years from the execution of the contract
Mutual communication and answering your questions
Identification and contact data
Pursuant to Article 6(1)(f) of the GDPR – Our legitimate interest in answering the question
For a period of 3 years after the question is answered or for a period of 3 years after the last communication between our company and you in relation to the relevant question
Processing of Personal Data related to your use of the Website
Purpose
Scope of processed information
Legal basis
Data Retention time
Mutual communication and answering your questions
Identification and contact data
Communication
Pursuant to Article 6(1)(f) of the GDPR we may process Personal Data if we have legitimate interest – legitimate interest in answering the question.
For a period of 3 years after the question is answered or for a period of 3 years after the last communication between our company and you in relation to the relevant question.
Sending newsletter
Identification and contact data
Communication
Pursuant to Article 6(1)(a) of the GDPR, we may process Personal Data if we have your consent – your consent to receive our newsletter.
Until you tell us that you no longer wish to receive commercial offers
WITH WHOM DO WE SHARE YOUR PERSONAL DATA?
Recipient
Reason for disclosure
Supabase Inc.
We use cloud database, backend infrastructure and hosting providers to operate the App, store account data, profile information, preferences, saved items, library data and other data necessary for the provision, security and functioning of the App.
HuggingFace Inc.
We use AI model hosting and processing providers to provide the visual discovery feature. Images submitted through the App may be processed temporarily in order to create a technical visual representation and return visually similar product results.
Resend Inc.
We use e-mail delivery providers to send service-related e-mails, transactional e-mails, account communications, security notifications, support communications and, where applicable, marketing communications.
Legal and tax advisors
Occasionally, we may need to consult legal or tax advisors for information about legal relationships with you. These are persons who are bound by the legal duty of confidentiality.
App analytics and performance tools
In order to analyze our Services and improve its features, we use analytics tools that process user interactions, app performance, and general behavioral patterns. These tools help us enhance user experience and ensure the Services meets user needs.
Retention of your Personal Data
We retain Personal Data only for as long as necessary or legally permitted, based on the purpose(s) for which it was collected. For specific retention periods, please refer to the table above, where each purpose is matched with its corresponding retention timeframe.
Please note that in some circumstances we may store your Personal Data for longer periods of time, for example (i) where we are required to do so in accordance with legal, regulatory, tax or accounting requirements, or (ii) for us to have an accurate record of your dealings with us in the event of any complaints, or (iii) if we reasonably believe there is a prospect of litigation relating to your personal data.
Transfer of Personal Data to third countries
We may transfer your Personal Data to third-party processors located outside the European Economic Area (“EEA”) subject to appropriate transfer safeguards.
However, we engage third-party providers to perform certain activities on our behalf. Some of these activities may involve the collection, use, or transfer of your Personal Data outside of EEA. These third-party providers comply with the European Commission-approved Standard Contractual Clauses (SCCs) or are subject to an adequacy decision for the transfer of personal data from the European Economic Area (EEA) to the United States or other countries that do not have equivalent privacy and data protection laws. We are responsible for processing the personal data we receive under the SCCs and for ensuring that any subsequent onward transfer to a third-party service provider acting on our behalf is conducted in accordance with applicable data protection regulations.
Newsletter opt-out option
We may and we will occasionally send you a newsletter to your email address to keep you informed of updates and new features.
If you wish to opt-out of receiving our marketing newsletter, you can withdraw your consent any time by clicking on the link at the bottom of every newsletter email. You can also withdraw your consent to receiving newsletter by contacting us using the contact details provided below.
Children’s privacy
The App is intended for users aged 13 and over. We do not knowingly collect or process Personal Data of children under the age of 13. Where consent is required for the processing of Personal Data of a child and law requires parental consent, we will take appropriate steps to obtain or verify such consent.
If we become aware that we have collected Personal Data from a child under 13 without appropriate consent, we will take reasonable steps to delete such Personal Data without undue delay. If you are a parent or legal guardian and believe that your child has provided us with Personal Data without appropriate consent, please contact us using the contact details provided below.
What are your rights?
Below is a full list of what you can do in relation to the Personal Data processed. If you wish to exercise any of your rights, please contact us using the contact details provided below.
Right to withdraw consent. If we process your Personal Data with your consent, it is your right to withdraw your consent to the processing of your Personal Data. This also applies to your consent to receive the newsletter. You can always withdraw your consent by following the instructions in each consent form or by contacting us using the contact details provided below.
Right of access. You have the right to access the Personal Data we process about you, as well as information about what Personal Data we process about you, for how long, for what purposes, who has access to it and whether we use it for automated decision-making (or how such automated decision-making works).
Right to correction. If you discover that we are processing incomplete or incorrect Personal Data about you, you have the right to have your Personal Data corrected or, if the purpose of processing the Personal Data so requires completed.
Right to erasure. You have the right to erase your Personal Data that we store and process about you, provided that the processing is not necessary for compliance with our legal obligations, or for the establishment, exercise, or defense of legal claims.
Right to restriction of processing. In cases where you believe that your Personal Data processed by us is inaccurate, you have the right to request that we restrict the processing of your Personal Data for the time necessary to verify the accuracy of your Personal Data and correct it, if necessary.
Right to data portability. In the case of automated processing or based on your consent or performance of the contract, you have the right to receive the data in a structured, commonly used and machine-readable format and to have them transmitted by us to another personal data controller.
Right to object to the processing of your Personal Data. You can object to the processing of your Personal Data by contacting us at email address provided below.
Right to complain. You can lodge a complaint about how we process your Personal Data with a supervisory authority, specifically with the Office for Personal Data Protection of the Czech Republic, located at Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, tel.: +420 234 665 111, e-mail: posta@uoou.cz
The following rights shall apply to individuals protected by applicable U.S. privacy laws (such as the CCPA and comprehensive consumer privacy laws in other U.S. states). If you wish to exercise any of your rights, please contact us using the contact details provided below:
Right to know and right to access
You have the right to know whether we process your Personal Information, and to access such Personal Information. This includes the right to information about the categories of Personal Information we collect, the sources from which it is collected, the business or commercial purposes for collecting or sharing your Personal Information about you, and whether we disclosed, sold or shared your Personal Information and to whom.
Right to rectify
You have the right to have your Personal Information corrected or, if required by the purpose of processing this Personal Information, to supplement it.
Right of deletion
You have the right to delete your Personal Information, which our company stores and processes about your person. Please note that there may be circumstances in which we are required to retain your Personal Information, for example for the establishment, exercise or defense of legal claims.
Right to request to receive a copy
You have the right to request to receive a copy of your Personal Information, including specific pieces of Personal Information, including, where applicable, to obtain a copy of the Personal Information you provided to us in a portable format.
Right to opt-out
You have the right to opt-out of the processing of your Personal Information, including the right to opt-out of the “sale” or “sharing” (as defined under the CCPA) of your Personal Information or its use for targeted advertising, if applicable, where such requests are permitted by law.
Right to no discrimination
You have the right not to receive discriminatory treatment for the exercise of your privacy rights. If you want to know how to exercise your privacy right, please see section 9 “Specific provisions under applicable U.S. state privacy laws” below.
Right to appeal
If we decline to act on a request that you have submitted, we will inform you of our reasons for doing so and provide instructions for how to appeal the decision.
Right of complaint
You may lodge a complaint with relevant authorities such as the Federal Trade Commission, state attorney general, or other applicable authority, depending on the nature of the issue. We ask you to please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
Automated processing and profiling
We use automated technical processing to provide certain features of the App, in particular the visual discovery feature. For more information about this feature, please see our App’s terms of service available in the App or on the Website.
When you submit an image for visual discovery, the image may be processed automatically using AI-based technology in order to create a temporary technical representation of the image and compare it with product data to return visually similar product results.
The App is not designed to process images of natural persons and you must not submit photos or images that depict or include identifiable individuals. To the extent the submitted image or related usage data constitutes Personal Data, such processing is used only to provide the visual discovery results requested by you.
Technical safeguards
We protect your Personal Information by applying appropriate technical and organizational safeguards designed to ensure a level of security appropriate to the risks associated with the processing of Personal Data. These safeguards may include, where appropriate, measures aimed at preventing unauthorized access, loss, misuse, alteration or disclosure of Personal Data.
Access to Personal Data is limited to persons who need such access for the purposes described in this Policy and in App’s terms of service available in the App or on the Website. We also take reasonable steps to ensure that our systems and service providers maintain appropriate security standards. However, no method of transmission over the internet or method of electronic storage is completely secure, and therefore we cannot guarantee absolute security of Personal Data.
Specific provisions under applicable U.S. state privacy laws
The provisions in this section apply only to residents of U.S. states whose privacy laws apply to our processing of Personal Information.
This Policy details the categories of Personal Information we collect and process, the categories of sources from which we obtain it, the purposes for its collection and processing, the categories of Personal Information we disclose to third parties for our operational business purposes, as well as our practices regarding data retention and deletion (please see sections 1-8).
Please note that we do not sell or share your Personal Information, or process your Personal Information for targeted advertising, as those terms are defined under applicable U.S. privacy laws. Accordingly, browser-based opt-out preference signals, such as Global Privacy Control (GPC), do not affect our current processing practices.
You may have certain rights under applicable law regarding your Personal Data. These rights are set forth above in the section 6 “What are your rights?”. If you have questions or wish to exercise your rights under applicable privacy laws, please contact us using the details provided in this Policy. We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the Personal Information subject to the request. We may need to request additional Personal Information from you, such as your account email address where applicable, in order to verify your identity and protect against fraudulent requests. If you make a request to delete, we may ask you to confirm your request before we delete your Personal Information. We will respond to your request within timeframes required by applicable law (generally within 45 days). If you have a complex request, applicable law may allow us up to 90 days to respond. We will still contact you within 45 days from when you contacted us to let you know we need more time to respond.
If we decline to act on the request that you have submitted, we will inform you of our reasons for doing so and provide instructions for how to appeal the decision. Depending on your state of residence you may have the right to appeal within a reasonable period of time after you have received our decision. If you have this appeal right, within 60 days (45 days for residents of certain states) of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If we deny your appeal, we will provide you with a method for contacting your state attorney general’s office to submit a complaint to the extent required by applicable law.
Other California Privacy Rights
Additional information for California residents regarding their privacy rights under the CCPA is included in this Policy. The CCPA permits you, as a California resident, to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please contact us using the contact details provided below.
Do Not Track Notice:
Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. Please note that we do not track your online activities over time and across third-party websites or online services and, accordingly, we do not currently take any action in response to DNT signals.
What else should you know
Our company has not appointed a data protection officer. We are not obliged to appoint a data protection officer in our company.
Contact information
If you have any questions about the processing of your Personal Data, please contact us at:
Email: support@thefinds.app
Address: Pasecka 863, Albrechtice, Czech Republic
Changes to this Policy
This Policy may be changed to reflect best practices and legal requirements for Personal Data protection. The current version will always be listed on our Website and if the changes are significant, we will also inform you by e-mail.
This Policy is effective as of: 18.09.2026
