Private beta · Updated 6 September 2026
1. Who is responsible for your data?
MindMatch Origins is operated by GSV Ε.Ε., a company registered in Greece (Γ.Ε.ΜΗ. / GEMI 195567003000, ΑΦΜ / VAT 803374539) (“MindMatch Origins”, “we”, “us”). Gautier Velissaris is the person responsible for it. Our registered address is available on request from the contact address below.
Privacy contact: contact@mindmatch-origins.com
For GDPR purposes, GSV Ε.Ε. is the data controller for the processing described in this notice.
2. What Origins does
MindMatch Origins is an AI-guided personal reflection experience. You answer open-ended questions about your life and relationships. The service uses those answers to continue the conversation and generate a personal Origins reading.
Origins is not therapy, medical care, crisis support or a diagnosis.
3. What information we process
Depending on what you choose to share, we may process:
- answers you write or dictate;
- structured themes/data points extracted so the conversation can adapt;
- your generated Origins reading and earlier versions;
- your first name, if you provide it;
- your email, only if you ask for a resume link;
- beta feedback you submit;
- minimal technical/session information needed to operate, resume and secure the service and measure basic product performance.
Sensitive information
The questions are open-ended. You may voluntarily mention information GDPR treats as a special category of personal data, such as health information, religious/philosophical beliefs, sex life or sexual orientation.
We do not require you to disclose this. If you choose to do so, we ask for your explicit consent before the conversation begins.
Please avoid unnecessary identifying information about other people.
4. Why we use the information
We process data to:
1. run your adaptive Origins conversation;
2. generate/update your Origins reading;
3. let you leave and resume;
4. respond to safety/crisis signals as described in the product;
5. let you delete or request a copy of your data;
6. understand whether the private beta works, using content-free product events and feedback;
7. protect the service and diagnose technical failures.
We do not sell your personal data. We do not use your conversation to target advertising.
5. Legal bases
For conversation content and the reading, we rely on consent under Article 6(1)(a) GDPR. To the extent you voluntarily provide special-category information, we rely on explicit consent under Article 9(2)(a) GDPR.
For strictly necessary security/service-integrity processing, we may rely on legitimate interests under Article 6(1)(f), limited to what is necessary to operate and protect the beta.
Where processing is necessary to provide a feature you specifically request — for example a resume link — Article 6(1)(b) may also apply.
You can withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal.
What deletion actually removes
Deleting your Origins data removes your session, every answer, every
version of your reading, your saved email and any beta feedback you
submitted. Two things are kept with your identifier removed, so they
can no longer be linked to you: content-free product events (for example
"a reading was opened") and records of how much AI processing a session
used. We keep those to understand whether the beta works and what it
costs; neither contains anything you wrote. These **anonymised usage
metrics** — event counts and AI processing volumes with no identifier —
are retained indefinitely for product and cost analysis.
6. AI and infrastructure providers
Your data is not processed only on your device. To provide Origins, we currently expect to use:
- Anthropic — conversation processing and adaptive questions/readings;
- Google Firebase / Google Cloud — authentication, hosting, storage and backend infrastructure.
- Namecheap (Private Email) — sending the emails you ask for: your resume link, and the notice before an inactive session is deleted. This sits outside the Google agreement and is a separate processor.
- OpenAI — speech to text, and text to speech. Speech to text runs only if you choose to answer by voice. The recording is sent to OpenAI, turned into text, and the text is returned to you to read and correct before anything is submitted. MindMatch does not store the audio: it is discarded as soon as the transcription comes back, and it is never written to our database. OpenAI states that data sent through its API is not used to train its models, and that it may be retained for up to 30 days for abuse monitoring before deletion. If you never use the microphone, no audio ever leaves your device. Text to speech runs only if you press the speaker on a question: the text of that question is sent to OpenAI and spoken audio comes back. The audio is generated on request and is not stored — not by MindMatch, and not beyond OpenAI's own processing. Your browser keeps it only while the page is open, so replaying costs nothing. Nothing you write is ever spoken aloud, and your reading is never sent for speech.
- Google Analytics (Google Ireland Limited) — visitor measurement on our public pages only: the home page, the French home page and our articles. It is never active inside the Origins conversation. See section 7.
7. Product analytics during the beta
We collect a deliberately small set of product events, such as:
- landing viewed;
- conversation started;
- consent accepted;
- turn number and answer character count;
- abandonment point;
- reading viewed/read depth;
- share intent/channel;
- feedback rating;
- API failure type.
We do not send interview text, reading text, email address, pull answer or free-text feedback into analytics.
Free-text feedback, when provided, is stored only as feedback content linked to the beta session.
Website analytics on our public pages
The product events above are our own. They are sent to our own servers and they are not sent to a third-party analytics service.
Separately, we use Google Analytics 4, provided by Google Ireland Limited, on our public pages only — the home page, the French home page and our articles. We use it for one purpose: to understand how many people visit those pages and where they came from, so we know whether writing them is worth continuing.
It only runs if you agree. When you first arrive on a public page we ask you. Until you choose Accept, no Google script is loaded, no Google cookie is set and no request is sent to Google. If you choose Reject, or close the notice without choosing, nothing is loaded and nothing is sent — and the _ga cookies set for this site are deleted. We remember your choice in your browser so we do not ask again.
You can change your mind at any time. "Cookie settings" at the foot of every public page reopens this choice, and withdrawing consent takes one click. Withdrawal switches Google Analytics off immediately and deletes the _ga cookies set for this site. Our legal basis for these cookies and for this processing is your consent, Article 6(1)(a) GDPR.
It is switched off before the conversation starts. The moment you begin Origins, Google Analytics is disabled for the rest of that visit and stays disabled. It never sees your answers, your reading, your feedback, your email address, anything you type in the conversation, or the fact that you typed anything at all.
If you accept, it records: which public page you viewed, which article you opened, your approximate location derived from your IP address, your device type and browser, and the campaign parameters in the link you followed (for example, that you came from Instagram). It does not record that you started Origins — nothing is sent to Google at that moment. We do not send it your name, your email address, your account identifier or any free text. We do not use Google Signals and we do not use Google Analytics for advertising or ad personalisation; both are switched off in our code.
Cookies it sets, once you accept: _ga and _ga_7SE6L8YR5D, which Google sets to last up to 2 years and which distinguish one visitor from another.
How long Google keeps it. Event-level data is retained for 2 months; user-level data for 14 months; the user-level period restarts when the same person visits again. This governs the underlying records. It does not govern Google's standard aggregated reports, which are not deleted on this schedule and remain available to us afterwards. Google may transfer this data outside the EEA under its standard contractual clauses. Google's own explanation is at https://policies.google.com/technologies/partner-sites
8. How long we keep information
Our policy:
- Origins conversation and reading: deleted after 12 months of inactivity;
- warning: approximately one month before automatic deletion where we have a valid email;
- resume links: expire after 30 days.
9. Deleting your Origins data
You can permanently delete your Origins data from the in-product menu.
Deletion is intended to remove the conversation, extracted Origins data, generated reading, saved reading versions, resume-link data and associated session records we control, subject only to data we are legally required to retain.
Deletion is irreversible.
10. Your rights
Subject to applicable law, you may have rights to:
- access;
- rectification;
- erasure;
- restriction;
- data portability where applicable;
- objection;
- withdraw consent;
- lodge a complaint with a data-protection authority.
To exercise a right: contact@mindmatch-origins.com
Supervisory authority: the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Athens — dpa.gr
11. International transfers
Some providers may process data outside the EEA. Where this happens, we will rely on an applicable transfer mechanism such as an adequacy decision or approved contractual safeguards, and identify the relevant safeguards once production configuration is confirmed.
12. Security
We use reasonable technical and organisational measures designed to protect personal data. No internet service can guarantee absolute security.
If you believe your resume link or data has been exposed, contact contact@mindmatch-origins.com.
13. Children
The MindMatch Origins private beta is for people aged 18 and over.
14. Changes
Because this is a private beta, the product may change quickly. If a change materially affects personal-data processing, we will update this notice and, where required, ask for new consent.
15. Contact
GSV Ε.Ε.
Registered address available on request
contact@mindmatch-origins.com