Privacy Policy
Last updated: August 2026
1. Data Controller
SKAJ Ventures GmbH
Sonnenlandstraße 4, 14471 Potsdam, Germany
Email: support@ratemind.net
Data protection contact: Stefan Köhn, support@ratemind.net
2. Data We Collect
2.1 Account Data
When you register, we collect your name, email address, and a hashed password. Your email is stored in plaintext for authentication; your password is stored only as a bcrypt hash.
2.2 Survey and Feedback Data
When customers respond to surveys, we collect their ratings, text answers, and (if provided via email invitations) their email addresses. Customer email addresses are encrypted with AES-256-GCM before storage, in invitations, delivery records and unsubscribe entries alike. Decryption happens only on our servers and only to deliver the service; addresses are never returned to the browser in full.
For this data the business operating the survey is the controller and we act as their processor under Art. 28 GDPR. If you responded to a survey and want your data corrected or erased, contact that business — they can action it directly, and we support them in doing so.
2.3 Payment Data
Billing is handled by Stripe. We store your Stripe customer ID and subscription ID. We never store credit card numbers or bank details on our servers. Stripe's privacy policy applies to payment processing.
2.4 Technical Data
We use session cookies only, strictly necessary for authentication. We do not use tracking cookies, analytics cookies, or any third-party trackers. Our application does not store IP addresses or user agents in its database. Our hosting and database providers keep short-lived server access logs that necessarily contain IP addresses, as any web service does.
Invitation emails can optionally include an open pixel and click redirects. This is off by default and can only be switched on by the business running the survey, who is then responsible for having the recipient's consent.
3. How We Use Your Data
3.1 Contract Performance (Art. 6(1)(b) GDPR)
We process your account data, survey data, and feedback data to provide the RateMind service as described in our Terms of Service. This includes sending survey invitations and reminders via email.
3.2 Legitimate Interest (Art. 6(1)(f) GDPR)
We process anonymized, aggregated analytics (topic extraction, rating averages) to improve service quality. We apply rate limiting and bot protection to secure the service against abuse. Our legitimate interest is operating a secure and functional platform.
4. Sub-processors
| Service | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting and edge delivery | United States |
| Neon Inc. | PostgreSQL database hosting | United States |
| Stripe Inc. | Payment processing | United States |
| Vercel Blob | Logo and file storage | United States |
| Google LLC (Places API) | Business lookup in our free public tools only | United States |
Outbound email is sent over SMTP infrastructure operated for us; businesses may also configure their own SMTP server, in which case their provider handles delivery. Invitation emails received by BCC are collected from a mailbox we operate and deleted once the invitation has been created.
Data transfers to the US are covered by the EU-US Data Privacy Framework where applicable, or by Standard Contractual Clauses (SCCs).
5. Data Subject Rights
Under the GDPR, you have the following rights:
- Access (Art. 15): Request a copy of the personal data we hold about you.
- Rectification (Art. 16): Request correction of inaccurate data via your account settings.
- Erasure (Art. 17): Request deletion of your account and all associated data.
- Restriction (Art. 18): Request that we limit processing of your data.
- Portability (Art. 20): Request your data in a machine-readable format (CSV/JSON).
- Objection (Art. 21): Object to processing based on legitimate interest.
To exercise these rights, contact us at support@ratemind.net.
6. Data Retention
- Email events (delivery records): 12 months by default, then automatically deleted.
- Invite data: 24 months by default, then automatically deleted.
- Feedback data: kept for as long as the account exists, unless a shorter period is configured.
- BCC mailbox messages: deleted as soon as the invitation is created, and in any case within 7 days.
- API request logs: payloads removed after 30 days, log entries after 90 days.
- Billing records: retained for 10 years per German tax law (§147 AO).
These periods apply to every account regardless of plan. Business plan subscribers can shorten them.
Deleting an account moves it to a closed state and, after a 30-day grace period during which it can be restored, permanently deletes all associated personal data. Deleting your entire user profile erases the personal data of any account you solely own immediately. Billing records required by law are retained in our payment processor (Stripe) for the statutory period.
7. Cookies
RateMind uses only session cookies, strictly necessary for authentication and security. These cookies are:
- HttpOnly (not accessible to JavaScript)
- Secure (transmitted over HTTPS only)
- SameSite=Lax (cross-site request protection)
We do not use tracking cookies, analytics cookies, or any third-party cookies. No cookie consent banner is needed because we rely solely on the ePrivacy Directive exemption for strictly necessary cookies.
8. Security
We implement the following security measures:
- AES-256-GCM encryption for all customer email addresses, wherever they are stored.
- TLS encryption for all data in transit.
- Lookups run against keyed hashes rather than decrypted addresses, so routine queries never expose them.
- Passwords hashed with bcrypt (cost factor 12).
- Rate limiting on authentication endpoints.
9. Supervisory Authority
You have the right to lodge a complaint with a supervisory authority. The competent authority for our company is:
Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Stahnsdorfer Damm 77, 14532 Kleinmachnow
https://www.lda.brandenburg.de
10. Changes to This Policy
We may update this privacy policy from time to time. We will notify registered users of material changes via email. The "last updated" date at the top of this page indicates the most recent revision.