Privacy Policy

Your privacy matters to us. This Policy explains how Madless ("we", "our", "us") collects, uses and safeguards personal information when you interact with our website, web application, and API (collectively, the "Services").

The data controller is Havetobe Limited (trading as Madless), a company registered in England and Wales under company number 17255387, with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Havetobe Limited is registered as a data controller with the UK Information Commissioner's Office (ICO) under registration number ZC195618; our entry is on the public register at ico.org.uk. You can reach us about anything in this Policy at [email protected].

• Provide, maintain, and improve the Services.
• Authenticate your identity and enforce access control.
• Process payments and manage subscriptions.
• Respond to your requests and support queries.
• Enforce rate limits and prevent abuse.
• Run trust and safety checks to keep the platform safe for all users (see Section 9).
• Send transactional emails (e.g. magic sign-in links, security alerts). You may not opt out of these.
• Read what you keep so it can be searched, cited and answered from, and answer the questions you ask (see Section 2.5).
• Send occasional product updates (you may opt out at any time).

We use only essential and functional cookies. We do not use any tracking, analytics, or advertising cookies. All cookies listed below are first-party (set by Madless, not by third parties) and do not require consent under GDPR Article 5(3).

Cloudflare Web Analytics, our only analytics tool, operates without cookies and does not collect personally identifiable information. We do not use any tracking or advertising cookies.

We do not sell, rent, or trade your personal data. Information is shared only with the sub-processors listed in Section 6, strictly to deliver the Services. We may disclose information if required by law or to protect the rights, safety, or property of Madless, our users, or the public.

Inviting people onto a view: a view on your Canvas is private until you invite someone onto it. Once you do:

• When you place a concept on a view with people on it, the concept becomes visible to the people on that view, and your display name is shown beside it. The concept stays attributed to your account and stored in your space; placing it does not create a copy in anyone else’s space.
• The person who first invites others onto a view is its Owner. The Owner invites and removes people and sets each person’s permission — Full (adds their own cards, moves any card, connects, clusters) or Read only (sees everything, talks in every thread, keeps into their own Canvas, touches nothing on the view) — and whether they can invite. How many people a view can hold, counting the Owner and pending invitations, is set by the Owner’s plan and is never more than eight.
• People on a view can read, search, discuss, and report the concepts placed there, and keep a copy of one into their own Canvas; that copy is then their own concept. A line you draw between two of your own cards is your own connection and stays in your space; any other line on the view belongs to the view. Being on a view does not reveal anything else in a person’s space — their other concepts and views, private notes, reminders, Ask history, or owner-only metadata.

You can take a concept off a view at any time, which ends access to it through that view. When someone leaves a view, or the Owner removes them, their cards leave the view with them, and so does every line on it that touches one of their cards; the concepts themselves, and any connection they drew between two of their own cards, stay in their own space. When the Owner removes everyone, everyone else loses the view immediately, and its talk — every message written on the view and on its cards — is deleted with it. Deleting the underlying concept removes its usable content from every view it was placed on, except where we must retain material to comply with law. Revoking access cannot erase information another person independently downloaded, recorded, or copied — including a copy they kept into their own Canvas — while they were authorised to view it.

We use the following third-party services to operate our platform:

These providers are contractually bound to protect your data and process it only on our behalf.

What you keep — the mind itself and its files — and every backup of it are stored in the United Kingdom and the European Union, and nowhere else. There is no location to choose. What sits outside that promise is your account, not what you keep: signing in, billing and email are handled by providers in Section 6 — Google’s Firebase Authentication (a global service), Stripe and Postmark — and are not held to this location; where each one operates is on our Sub-processors page.

• The database and every backup are in the United Kingdom (London). Your concepts, pages, connections, concept history, and the questions you asked with their answers — the mind itself — are stored in one database in London. Backups are encrypted, in Google Cloud Storage in London: your files are mirrored nightly, and the database is snapshotted at least weekly with continuous point-in-time recovery behind it.
• The live copy of your files is in the European Union. The working copy of what you upload — images, video, audio, PDFs, everything in your drive — is stored in Cloudflare R2 under Cloudflare’s EU jurisdiction: a contractual guarantee that the bytes stay at rest in the European Union. The application servers that handle your requests run from the United Kingdom.

For security and debugging purposes, we maintain the following:

• Structured application logs for error monitoring and debugging (via Sentry).
• Session records that include login timestamps, device information, and IP addresses for security purposes.
• Rate limit violation tracking to detect and prevent abuse.

These records are retained only as long as necessary for their stated purposes — typically up to 90 days, and longer only where needed to investigate a specific incident or to meet a legal obligation.

To keep the platform safe, we perform automated content moderation:

• Uploaded images are scanned for harmful content using Google Cloud Vision SafeSearch.
• Uploaded documents (PDF, DOCX) have text extracted for automated blocklist matching.
• User-generated content is periodically scanned against configurable blocklist patterns.
• Flagged content is reviewed internally. We may take action including content removal or account suspension.

These scans are automated and do not involve human review unless content is flagged at a high or critical severity level.

User reports and serious flags may be preserved under a legal hold so that evidence is not destroyed during review. Where the law requires it, we may disclose flagged content and relevant account, technical, and evidence information to the National Crime Agency, law enforcement, regulators, or an equivalent competent authority. Access is restricted to what is necessary for safety, investigation, and compliance.

• Automated backups of your data are stored encrypted in Google Cloud Storage in London: every file you upload is mirrored nightly, and the database is snapshotted at least weekly with continuous point-in-time recovery behind it.
• A space that has been put to sleep for long inactivity (possible on some free tiers) is skipped by the backup runs while it sleeps: the backups it already has are kept, but nothing new is backed up until the space wakes.
• Deleted content is soft-deleted (moved to trash) and permanently purged after 30 days.
• Account data is retained for as long as your account is active. Upon account deletion, all personal data is removed within 30 days, except where retention is required by law.
• Security logs are retained only as long as necessary for their stated purposes.

We implement administrative, technical, and physical safeguards to protect data, including:

• Encryption in transit (TLS) and at rest (via Google Cloud Platform defaults).
• Principle-of-least-privilege access controls with role-based authorization.
• CSRF protection, rate limiting, and Content Security Policy headers.
• API request idempotency to prevent duplicate operations.
• Webhook payload signing (HMAC) with SSRF protection.

Depending on your jurisdiction, you may have the right to:

• Access or correct your personal data.
• Request deletion ("right to be forgotten").
• Object to or restrict certain processing.
• Port your data to another service.
• Withdraw consent for optional processing.

You can do most of this yourself in Settings — export a copy of your data, edit your profile, or permanently delete your account or a space. For anything we can't put behind a button — objecting to or restricting processing, or if you've lost access to your account — email [email protected] and we'll respond within 30 days. UK and EU users hold these rights under the UK GDPR and EU GDPR.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk or on 0303 123 1113. We would appreciate the chance to address your concern first.

The Services are not intended for anyone under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will promptly delete it.

We may update this Policy from time to time. We will post the revised version on this page with an updated effective date. For material changes, we will notify users via email or an in-app notice.

Questions about this Privacy Policy, data-subject requests (UK / EU GDPR), or anything else data-protection related? [email protected].

Havetobe Limited (trading as Madless) is a small UK limited company and does not maintain a separate Data Protection Officer. Privacy queries are handled by the founder via the address above; we aim to respond within one working day and within thirty days for formal data-subject requests, as required by law.