Version: 2026-08-18

Privacy and Personal Data Processing Policy

This Policy is published on https://feelbetter.mindemo.ai and is effective from August 18, 2026.

1. Operator and Scope

1.1. This Policy sets out the procedure for collecting, processing, storing, using, transferring, protecting and deleting personal data when the website is used and access to the online Toolkit “I Don't Want to Feel This Way” is purchased.

1.2. Owner and operator of the database containing personal data:

NOEMERA LAB

Individual Entrepreneur: Gulmira Maksutovna Atantayeva

IIN: 651125400975

Address: 190 k43 Baizakov Street, Almaty, Republic of Kazakhstan

Phone: +7 775 482 42 70

Email: contact@mindemo.ai

State registration authority of the individual entrepreneur: Almaly District State Revenue Office of the Almaty City State Revenue Department of the State Revenue Committee of the Ministry of Finance of the Republic of Kazakhstan.

1.3. This Policy applies to visits to the website, use of the free demo, placing an order and confirming payment, providing and restoring access, refunds, support and User inquiries.

2. Data We Process

2.1. When an order is placed, the following data may be processed:

• the Kazakhstan mobile phone number provided for issuing a Kaspi invoice;
• internal and public identifiers and the human-readable order code;
• the version of the Offer and this Policy (LEGAL_VERSION) accepted by the User;
• the fact, date and time of the separate confirmations accepting the Offer and consenting to the collection and processing of personal data;
• the method used to record consent and the minimum technical evidence that it was provided.

2.2. In connection with payments and refunds, the following data may be processed:

• payment amount and currency;
• Kaspi payment method, status and dates relating to creation of the payment request, invoice issuance, confirmation, cancellation and refund;
• bank or payment-infrastructure identifiers necessary to match an order and payment unambiguously;
• information about confirmation, errors, duplicate payments, reasons for cancellation, refunds or withdrawal of access.

The Operator does not request or store the User's full bank card details.

2.3. To provide, protect and restore access, the following data may be processed:

• technical purchase identifier and secret access-recovery identifier;
• product identifier;
• purchase and access status, including information about a refund or withdrawal;
• a random technical identifier for the current browser session; the server database stores its SHA-256 hash for verification, together with its association with the purchase and the dates on which the session was created, expires and, where applicable, was revoked;
• dates on which access was created, modified and, where applicable, terminated.

To limit the number of simultaneously active browser sessions, the Operator does not create a separate persistent device identifier and does not use device fingerprinting.

2.4. When the User contacts the Operator, contact details, the content of the inquiry, information supplied by the User, response history and order data may be processed to the extent necessary to resolve the matter.

2.5. For operation and security of the website, infrastructure providers may automatically process technical data including the IP address, user-agent, date and time of the request, requested page address, request identifier, error information and security events.

2.6. A strictly necessary server-side HttpOnly cookie containing a random identifier for the current browser session is used to maintain protected browser access. It does not contain the persistent secret purchase identifier. The cookie does not contain answers to exercises, is not accessible to ordinary client-side JavaScript and is not used for advertising or tracking the User across other websites.

2.7. The website does not set its own advertising or analytics cookies.

2.8. The User's answers and actions within exercises are handled in the browser and are not sent to the server for storage. The Operator does not collect psychological, medical or diagnostic data from the exercises.

3. Purposes of Processing

3.1. Data is processed only for specific purposes:

• entering into and performing the agreement;
• placing orders and confirming payments;
• providing, protecting and restoring access;
• preventing unauthorized transfer of paid access to third parties;
• handling erroneous or duplicate payments and refunds;
• providing support and responding to inquiries;
• maintaining website operation and security, preventing abuse and investigating technical failures;
• complying with mandatory accounting, tax, payment and other legal record-keeping requirements;
• protecting the lawful rights of the User and the Operator.

3.2. Data is not used for incompatible purposes without a separate lawful basis. The website does not use personal data for email marketing, advertising profiling or advertising analytics systems.

4. Consent to Collection and Processing of Personal Data

4.1. Before placing an order, the User can review this Policy and the Offer in English, Russian or Kazakh.

4.2. Consent is given through a separate mandatory interface action and is not combined with confirmation of acceptance of the Offer. Merely visiting the website or using the free demo does not constitute consent to processing order data.

4.3. When an actual order is placed, the Operator records consent together with the order so that the following can be confirmed:

• the Operator and the User who provided the data;
• the version of the legal terms and this Policy corresponding to the published version, including the value 2026-08-18 for this version;
• the date and time of consent;
• the categories of data and purposes of processing;
• the term or period of processing;
• the possibility of transferring the necessary amount of data to payment and technical providers;
• consent to cross-border transfer of personal data in the cases and to the extent provided for in this Policy;
• absence of consent to dissemination of personal data in publicly accessible sources.

4.4. The User does not consent to public dissemination of their personal data. The Operator does not publish information about the User's order, payment, access or inquiries without a separate lawful basis.

4.5. By selecting the mandatory consent checkbox when placing an order, the User confirms having read this Policy and consents to the collection and processing of personal data described in it, including necessary transfers to technical and payment providers and cross-border transfers in the cases provided for in this Policy.

5. Processing Periods and Withdrawal of Consent

5.1. Each category of data is processed no longer than necessary for the stated purpose unless longer retention is required by the laws of the Republic of Kazakhstan.

5.2. Order, payment, refund, accounting and tax records, as well as information about the accepted version of legal documents, are retained for the mandatory periods applicable to the relevant type of document and transaction.

5.3. Order and purchase identifiers, the secret access-recovery identifier, hashes of active browser sessions and access-status information are retained while needed to provide, protect and restore paid access, handle inquiries and protect the rights of the parties. Expired or revoked technical sessions may be retained to the extent and for the period reasonably necessary for security and resolution of technical disputes, after which they are deleted or anonymized unless another lawful basis requires retention.

5.4. Inquiry data is retained until the matter is resolved and for the period necessary to demonstrate performance of obligations and protect the rights of the parties. Technical logs are retained for periods necessary for security, diagnostics and incident investigation, taking into account the settings of the infrastructure provider.

5.5. The technical identifier of an active browser session stored in the cookie is retained until the purpose for which it is used has been achieved, the established session period expires, the session is revoked, the User exits the protected session, or site data is cleared by the User or browser. Expiration of an individual browser session does not by itself terminate the right to paid access.

5.6. The User may withdraw consent by contacting contact@mindemo.ai. To the extent applicable, processing is terminated in accordance with the procedure and time limits established by the laws of the Republic of Kazakhstan. If continued retention or processing is required by law or is necessary in connection with an unperformed obligation, the Operator will state the basis for continuing the processing.

5.7. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal was received. Data required for mandatory accounting, tax, payment or legal records may be retained after withdrawal to the necessary extent and for the period established by law.

6. Infrastructure, Storage and Cross-Border Transfers

6.1. The Operator seeks to limit the personal data processed to information necessary for placing orders, confirming payments, providing and restoring access, complying with mandatory legal requirements and ensuring website security.

6.2. The User's answers and actions within exercises are not transmitted to the Operator for server-side storage. The Operator does not create a database of psychological, medical or diagnostic data from the content of Toolkit exercises.

6.3. For operation of the website, order database, payments and access system, the Operator may use cloud, server, payment and other technical infrastructure providers. Such providers receive or technically process only the amount of data necessary to perform the relevant function.

6.4. Some technical providers may use infrastructure located outside the Republic of Kazakhstan. Accordingly, personal data may, to the necessary extent, be transferred to and technically processed outside the Republic of Kazakhstan. Such cross-border transfers are made for the purposes stated in this Policy where the User has provided consent or another basis permitted by law applies.

6.5. The Operator takes reasonable organizational and technical measures to restrict access to personal data and protect it, taking into account the nature of the product, the categories of data processed and the infrastructure used.

7. Transfer to Third Parties

7.1. The Operator does not sell Users' personal data and does not transfer it to third parties for their independent advertising profiling.

7.2. Data may be transferred only where there is a lawful basis and only to the extent necessary for the relevant recipient:

• Kaspi and banking or payment participants involved in processing the payment;
• providers of cloud, server and other technical infrastructure necessary for operation of the website, order database and access system;
• technical contractors, accountants and other professional advisers when necessary for support, record keeping or protection of rights and subject to applicable confidentiality requirements;
• government authorities and other persons in cases provided for by the laws of the Republic of Kazakhstan.

7.3. A recipient receives only the data necessary to perform the relevant function. Use of one provider does not mean that the provider receives access to all User data.

7.4. If performance of the relevant technical function involves transfer of personal data outside the Republic of Kazakhstan, the transfer is carried out in accordance with section 6 of this Policy.

8. Cookies and Browser Data

8.1. A separate Cookies Policy does not apply. The use of cookies and other technical browser data is described in this section.

8.2. A strictly necessary HttpOnly cookie is used as technical proof of the current protected browser session for access to the paid Toolkit. Each time paid content is requested, the server verifies the validity of the session and the current purchase status. The cookie is not used for advertising or tracking the User across other websites.

8.3. The website does not use its own advertising or analytics cookies or similar tools. Therefore, no separate choice for optional cookies or cookie banner is provided.

8.4. The User can delete local website data through browser settings; this will end protected access in that browser. Paid access can be restored using the saved private link for the paid order, subject to the active-session limit, or by contacting the Operator and verifying the purchase.

9. User Rights

9.1. In accordance with the laws of the Republic of Kazakhstan, the User has the right to:

• obtain information about whether their personal data is held and processed, including the purposes, sources, methods and periods of processing;
• obtain information about the categories of data being processed;
• request correction or supplementation of data where grounds exist;
• request blocking of data where there is information indicating a violation of the conditions for its collection or processing;
• request deletion of data in cases provided for by law;
• withdraw consent to collection and processing of data and, where applicable, to transfer to third parties and cross-border transfer;
• appeal actions or omissions of the Operator to the authorized state authority or a court;
• exercise other rights provided by the laws of the Republic of Kazakhstan.

9.2. To exercise these rights, the User may contact contact@mindemo.ai. To avoid disclosing data to an unauthorized person, the Operator may request information reasonably necessary to verify the identity of the applicant and their connection with the relevant order.

10. Security

10.1. The Operator takes necessary organizational and technical measures to protect personal data against unlawful or accidental access, alteration, disclosure, dissemination, destruction and other unlawful actions.

10.2. Access to data is limited to the extent necessary to perform the relevant functions. Technical access identifiers are treated as confidential values and must not be published or disclosed to unauthorized persons.

10.3. The Operator applies the principle of data minimization and provides suppliers only with information necessary for the relevant technical or contractual function.

11. Contact Information

11.1. For questions concerning the collection, processing, storage, correction, blocking or deletion of personal data, the User may contact the Operator:

NOEMERA LAB

Gulmira Maksutovna Atantayeva

Address: 190 k43 Baizakov Street, Almaty, Republic of Kazakhstan

Phone: +7 775 482 42 70

Email: contact@mindemo.ai

11.2. Inquiries are reviewed in accordance with the procedure and time limits established by the laws of the Republic of Kazakhstan.

12. Changes to the Policy and Document Version

12.1. The current version of the Policy is published on the website before the corresponding User consent is obtained.

12.2. The Operator retains information sufficient to identify the version of the Policy that the User reviewed and consented to.

12.3. A change to the Policy does not retroactively change the content of consent previously given. If a change in purposes, categories of data or transfer conditions requires new consent, that consent is requested separately.

12.4. Document version: 2026-08-18. Publication date: August 18, 2026.