Effective date: 1st January 2025
Last updated: 17th November 2025

This privacy notice explains how we collect, use, disclose and protect personal data when you use the MenTools Challenges website and mobile app. We are committed to keeping your information safe. If we ask you to provide information by which you can be identified, it will be used only in accordance with this notice. This is the official privacy notice for our website and mobile app (MenTools Challenges).

1. INTRODUCTION

This is the privacy notice for the MenTools Challenges website and mobile applications owned and operated by MenTools LTD. We respect your privacy and are committed to protecting your personal data. This notice explains how we look after your personal data when you visit or use our site or app and tells you about your rights and how the law protects you.

2. IMPORTANT INFORMATION AND WHO WE ARE

2.1 PURPOSE OF THIS PRIVACY NOTICE

This notice gives you information on how we collect and process your personal data when you use our site or app, including any data you provide when you create an account, make a purchase, contact support, take part in challenges, or sign up to updates.

The service is not intended for children. Minimum age to use the service is 16. We do not knowingly collect data relating to children.

2.2 CONTROLLER

MenTools LTD (company number 15308203) is the controller and responsible for your personal data (called “we”, “us”, or “our” in this notice).

Registered office: 64 Fink Hill, Dale House, Horsforth, Leeds, UK LS18 4DH
Place of registration: England
Contact for privacy matters: support@mentools.co
We do not operate a postal support address.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK data protection regulator. We would appreciate the chance to deal with your concerns before you approach the ICO, so please contact us first.

2.3 CHANGES TO THIS PRIVACY NOTICE AND YOUR DUTY TO INFORM US OF CHANGES

We may update this notice from time to time. The date above shows when it was last updated. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

2.4 THIRD-PARTY LINKS

Our service may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.

3. THE DATA WE COLLECT ABOUT YOU

3.1 PERSONAL DATA

Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data, grouped as follows:

• Identity Data: name or username, age confirmation.
• Contact Data: email address.
• Account Data: password (stored in hashed form), settings, preferences.
• Transaction Data: purchase history, subscription status, price paid, currency, platform order identifiers and receipts from Apple App Store or Google Play. We do not receive or store full card numbers for mobile store purchases.
• Usage Data: how you use the app and site, features used, challenge participation, session length, time stamps.
• Technical Data: IP address, device type, operating system, app version, language, time zone, device identifiers (for example push notification tokens and mobile advertising identifiers where enabled), crash and diagnostic logs.
• Challenge and Activity Logs: information you choose to enter about workouts, habits, timers, completions and notes across fitness, nutrition, money, mind and relationships.
• Community Data: usernames, profile images, leaderboard positions, invitations and friend connections, reactions and similar community interactions.
• Support and Communications Data: messages and tickets you send us, email engagement (opens and clicks).
• Marketing Preferences: your choices for email, push and in-app messages.
• Aggregated Data: statistical or demographic data derived from your personal data. Aggregated data is not personal data unless it can reasonably identify you.

Special category data. We do not require health data. If you voluntarily enter information that reveals health or wellbeing, we process it only to provide the features you use and only with your explicit consent (which you can withdraw at any time in-app). You can delete these entries in-app and you can ask us to erase them. (See also Section 7 for international transfers and Section 9 for retention.)

3.2 IF YOU FAIL TO PROVIDE PERSONAL DATA

Where we need to collect personal data by law, or under a contract we have with you, and you do not provide that data when requested, we may not be able to provide the service. We will tell you if this is the case at the time.

4. HOW IS YOUR PERSONAL DATA COLLECTED

4.1 DATA COLLECTION

We use different methods to collect data from and about you:

• Direct interactions: you give us Identity, Contact, Account, Challenge and Support Data when you create an account, use features, or contact support.
• Automated technologies: we automatically collect Technical and Usage Data through SDKs, analytics and crash reporting when you use the app or site.
• Third parties: we receive Transaction Data and order identifiers from Apple App Store and Google Play for purchases made through those platforms.
• We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

5. HOW WE USE YOUR PERSONAL DATA

We will only use your personal data when the law allows us to. Most commonly, we use your data on the following lawful bases: to perform a contract with you, for our legitimate interests (where your interests and rights do not override those interests), to comply with a legal obligation, and with your consent where required.

5.1 PURPOSES, DATA AND LAWFUL BASES

We have set out below a description of the ways we plan to use your personal data and the lawful bases we rely on. We may process your data for more than one lawful basis depending on the purpose.

• To create and maintain your account; provide the service and core features (challenges, tracking, leaderboards).
Data: Identity, Contact, Account, Usage, Challenge, Community, Technical.
Lawful basis: performance of a contract.

• To process purchases and manage subscriptions made via Apple App Store or Google Play; to detect and prevent fraud.
Data: Transaction, Identity, Technical.
Lawful basis: performance of a contract; legitimate interests (preventing fraud).

• To send service communications, notices about changes to terms or privacy, and important app messages.
Data: Identity, Contact, Account.
Lawful basis: performance of a contract; legal obligation.

• To provide support and handle requests.
Data: Identity, Contact, Support.
Lawful basis: performance of a contract; legitimate interests (customer service).

• To operate analytics, measure performance, fix errors, and improve our service.
Data: Usage, Technical, Aggregated.
Lawful basis: legitimate interests (running, improving and securing our service).

• To provide optional marketing communications by email or push, where permitted.
Data: Identity, Contact, Marketing Preferences, Usage.
Lawful basis: consent where required; legitimate interests for similar-product communications to existing customers where permitted. You can opt out at any time.

• To protect our users and enforce our terms, including investigating misuse of leaderboards and community features.
Data: Identity, Account, Usage, Technical, Community.
Lawful basis: legitimate interests (protecting our service and users); legal obligation where applicable.

• To comply with legal and regulatory obligations, tax and accounting records.
Data: Transaction and related records.
Lawful basis: legal obligation.

Special category data (if you choose to enter wellbeing information): processed only for the features you use.
Lawful basis: your explicit consent; you can withdraw consent and delete entries in app and you can request erasure.

5.2 MARKETING

You can control marketing preferences in app or by using the unsubscribe link in any email. Opting out of marketing does not affect service messages.

5.3 COOKIES AND SIMILAR TECHNOLOGIES

Our website and apps use cookies and mobile SDKs for essential functions, analytics, performance and (where enabled) advertising/measurement. In the UK/EEA we only set non-essential cookies/SDKs with your consent, collected via our consent banner or in-app controls; you can change your choices at any time. On the website, we honour Global Privacy Control (GPC) signals as an opt-out for sale/sharing/targeted advertising where legally required. See our Cookie Policy for details of vendors, purposes and retention.

5.4 CHANGE OF PURPOSE

We will only use your personal data for the purposes we collected it for unless we reasonably consider that we need to use it for another compatible purpose. If we need to use your data for an unrelated purpose we will notify you and explain the legal basis.

5.5 AUTOMATED DECISION MAKING

We do not use automated decision making that produces legal or similarly significant effects about you.

6. DISCLOSURES OF YOUR PERSONAL DATA

We may share your personal data with:

• Service providers acting on our behalf who provide hosting, storage, analytics, crash reporting, customer support tools, messaging and similar services. 
• For advertising/measurement, we may disclose identifiers and usage data to ad/analytics partners only where permitted by law and your settings. In the UK/EEA we obtain consent before using non-essential cookies/SDKs for these purposes; in the U.S. you may opt out of sale/sharing/targeted ads as described in Section 10.4
• Payment platforms that process your purchases on mobile (Apple App Store and Google Play).
• Professional advisers and insurers.
• Authorities, regulators and law enforcement where required by law or to protect rights, users, or security.
• Third parties in connection with a business transaction such as a merger, acquisition or asset sale. The new owner may continue to use your personal data as set out in this notice.

We require all service providers to take appropriate security measures and to process personal data only on our instructions.

We do not sell your personal data.

7. INTERNATIONAL TRANSFERS

Some of our service providers may be located outside the UK or EEA. Where personal data is transferred internationally, we ensure a similar level of protection by using legally approved safeguards such as the UK International Data Transfer Agreement and/or EU Standard Contractual Clauses, and by assessing the risks of the transfer. You can contact us for more information.

Where we rely on standard contractual clauses or the UK International Data Transfer Agreement, we also implement supplementary measures and conduct transfer risk assessments appropriate to the service and destination, and will use recognized adequacy mechanisms where available

8. DATA SECURITY

We have put in place appropriate security measures to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to personal data to staff and providers who need it and who are subject to confidentiality obligations. We maintain procedures to respond to suspected personal data breaches and will notify you and any regulator where we are legally required to do so.

For incidents involving personal data, we keep an internal breach register and will notify regulators and affected individuals where legally required (for example, under UK/EU GDPR).

9. DATA RETENTION

We keep personal data only for as long as necessary for the purposes we collected it, including to meet legal, accounting and reporting requirements. Typical periods are:

• Account and profile data: for the life of your account, then deleted or anonymised within 30 days, with routine backups rotating on a fixed schedule.
• Challenge and activity logs: until you delete them in app or your account is deleted.
• Transaction records: 6 years after the end of the relevant financial year.
• Analytics and technical logs: 12 to 24 months.
• Support tickets: up to 24 months after closure.
• Marketing preferences and email history: until you opt out, or after 24 months of inactivity.

We may retain anonymised or aggregated data that does not identify you.

10. YOUR LEGAL RIGHTS

If you are in the UK/EEA, your rights under UK/EU GDPR include those listed below; U.S. state-specific rights are described separately in Section 10A.

• Access your personal data.
• Correct inaccurate data.
• Erase your data in certain cases.
• Restrict processing in certain cases.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Data portability for information you provided to us.
• Withdraw consent where we rely on consent.

If you wish to exercise any of these rights, contact support@mentools.co

10.1 NO FEE USUALLY REQUIRED

You will not have to pay a fee to access your personal data or to exercise your rights. We may charge a reasonable fee or refuse to comply if your request is clearly unfounded, repetitive or excessive.

10.2 WHAT WE MAY NEED FROM YOU

We may need to request information to confirm your identity and ensure your right to access your personal data or to exercise any of your other rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

10.3 TIME LIMIT TO RESPOND
We try to respond to all legitimate requests within one month. If your request is complex or you have made a number of requests, it may take longer. We will keep you updated.

10.4 U.S. State Privacy Rights (if you reside in certain U.S. states). Depending on your state, you may have the right to: (a) know/access categories and specific pieces of personal information; (b) delete personal information; (c) correct inaccuracies; (d) opt out of “sale” or “sharing” of personal information and targeted advertising (cross-context behavioral advertising); (e) limit use/disclosure of sensitive personal information (where applicable); (f) receive equal service and price even if you exercise your rights; (g) use an authorized agent to submit requests; and (h) appeal a decision we make about your request.

“Sale” and “Sharing”. We do not sell personal information for money. We may “share” identifiers and usage data with advertising or analytics partners to measure performance or show likely-to-be-relevant content; under some laws, this is “sharing” or “targeted advertising.” You can opt out at any time using:
• Do Not Sell or Share / Opt-out of Targeted Ads: available on our website footer and in-app (Settings ▸ Privacy).
• Universal Opt-Out Signals (e.g., Global Privacy Control): when detected on our website, we treat them as a valid opt-out.
• Device settings (e.g., “Limit Ad Tracking”/“Allow Apps to Request to Track”).

Submitting requests. To exercise U.S. rights, use the in-app controls or email support@mentools.co
with “US Privacy Request” and your state of residence. We will verify your request and respond within required timelines. If we deny a request, you may appeal by replying “Appeal” to our decision.

We do not knowingly sell/share personal information of consumers under 16 without appropriate consent.

10.5 Australia (APPs). If you are in Australia, you have rights to access and correct personal information we hold about you, and to complain to us and, if unresolved, to the Office of the Australian Information Commissioner (OAIC). Where reasonable, you may interact with us anonymously or using a pseudonym (for example, general enquiries), except where impracticable or where we are required by law to identify you. We take reasonable steps before cross-border disclosures to ensure overseas recipients handle personal information in accordance with the APPs (see “International Transfers”). OAIC: oaic.gov.au.

11. CHILDREN

Minimum user age is 16. We do not knowingly collect personal data from users under 16. If you believe we have collected data from a child under 16, please contact us and we will delete it. We do not direct the Service to children under 13 and do not knowingly collect their personal information; any such data will be deleted upon discovery.

12. APP STORES AND PAYMENTS

For purchases made through Apple App Store or Google Play, those platforms process your payment and provide us with order identifiers and receipts so we can activate and manage your access. Their privacy practices apply to the processing they perform.

13. COMMUNITY FEATURES AND USER CONTENT

If you use community features such as leaderboards and invitations, limited profile information (for example username, avatar, scores) may be visible to other users in those areas. Please do not share information in your profile or posts that you would prefer to keep private. You are responsible for the content you submit and you can delete your own content from within the app.

14. THIRD-PARTY SERVICES

Our service may contain links to or integrations with third-party services. Their own terms and privacy policies apply and we are not responsible for their practices.

15. CONTACT
Questions, requests and complaints about this notice or our handling of personal data should be sent to support@mentools.co. You can also contact or complain to the ICO.

15.1 EU/EEA GDPR Representative (Article 27)
If you are located in the EU and have questions or concerns regarding your personal data, you may contact our appointed GDPR representative:

EU Representative:
Euverify Ltd (Ireland)
Unit 3D North Point House
North Point Business Park
New Mallow Road
Cork
T23 AT2P
Ireland
Email: gdpr@euverify.com

To submit a Data Subject Access Request (DSAR), data deletion request, or any other GDPR-related inquiry, please use our secure portal at: https://gdpr.euverify.com/verify/c623bb29-585e-4cfd-a1c5-987360ce4b22

This link allows you to verify our appointed representative and submit GDPR requests directly. Requests submitted through this portal are logged and tracked to ensure timely response and compliance.