Cookie Policy

1.1 This Cookie Policy applies to the website(s) operated by Mentivox and to the Mentivox mobile and web application (together, the “Service”). It explains what cookies and similar tracking technologies (“Cookies”) are, which categories of Cookies we use or may use, the purposes for which we use them, and how you can manage or withdraw your consent.

1.2 This Policy should be read together with our Privacy Policy, which sets out in full how we collect, use, and protect your personal data, including data collected via Cookies. Where a conflict arises between this Policy and the Privacy Policy in respect of Cookies specifically, this Policy shall prevail.

1.3 This Policy applies to all visitors to our website and all users of the Service, regardless of location, but is drafted with particular reference to the requirements of the UK Privacy and Electronic Communications Regulations 2003 (as amended) (“PECR”) and the UK GDPR.

2.1 A “cookie” is a small text file placed on your device (computer, tablet, or mobile phone) when you visit a website or use an app. Cookies allow a website or application to recognise your device and store certain information about your visit or preferences.

2.2 Similar technologies include local storage, session storage, software development kit (SDK) identifiers used within mobile applications, pixels, and tags. For simplicity, we refer to all such technologies collectively as “Cookies” in this Policy, regardless of the specific technical mechanism used.

2.3 Cookies can be:

“Session cookies”, which are deleted automatically when you close your browser or app; or

“Persistent cookies”, which remain on your device for a set period, or until you delete them, in order to remember your preferences or actions across multiple visits.

2.4 Cookies can also be categorised by who sets them:

“First-party cookies” are set directly by Mentivox; and

“Third-party cookies” are set by a domain other than Mentivox’s own, typically because we use a third-party service embedded within our Service (for example, an analytics or payment provider).

3.1 Mentivox’s guiding principle, consistent with our broader privacy-by-design approach described in our Privacy Policy, is to use the minimum number of Cookies necessary to operate a secure, reliable, and useful Service. We do not use Cookies to monetise emotional vulnerability, and we do not sell information collected through Cookies to third parties.

3.2 As Mentivox is an early-stage company, we do not currently have any confirmed named third-party analytics, advertising, or marketing cookie vendors integrated into the Service. Where this Policy refers to categories such as “analytics” or “marketing” Cookies, these are described on an illustrative and forward-looking basis to explain the types of Cookies we may deploy as the Service develops. Section 5 below will be updated, and users notified in accordance with Section 9, before any such third-party Cookies are activated.

We categorise Cookies in accordance with standard UK GDPR/PECR practice into four categories, as follows.

4.1 Strictly Necessary Cookies

4.1.1 These Cookies are essential for the Service to function and cannot be switched off. They are typically set only in response to actions you take, such as logging in, setting your privacy preferences, or maintaining your session security.

4.1.2 Examples of strictly necessary Cookies used by Mentivox include:

session identifiers used to keep you securely logged in while using the app;

load-balancing and security cookies that protect the Service against fraud, unauthorised access, and abuse; and

cookies that remember your cookie consent choices, so that you are not asked to make the same choice repeatedly.

4.1.3 Because these Cookies are necessary to provide the Service you have requested, PECR permits us to use them without seeking your prior consent, although we remain transparent about their use in this Policy.

4.2 Functional Cookies

4.2.1 Functional Cookies allow the Service to remember choices you make (such as language preference, once multilingual support is introduced, or display preferences) in order to provide a more personalised experience.

4.2.2 Functional Cookies are not currently essential to the Service’s core operation but improve usability. Where functional Cookies are non-essential, we will seek your consent in accordance with Section 6 below before setting them, except where a narrow PECR exemption applies (for example, a cookie that solely stores a preference you have just actively set, such as dismissing a notification).

4.2.3 We do not use functional Cookies to build profiles of children for marketing purposes, and functional Cookies applied to accounts of users aged 13–17 are configured in line with the high-privacy-by-default standards described in our Privacy Policy and consistent with the ICO’s Children’s Code (Age Appropriate Design Code).

4.3 Analytics Cookies

4.3.1 Analytics Cookies help us understand how the Service is used, for example which features are most used, how long sessions last in aggregate, and where users encounter errors, so that we can improve the reliability and quality of the Service.

4.3.2 We do not currently have a confirmed named third-party analytics provider integrated into the Service. If and when we integrate an analytics tool (whether a Mentivox-operated analytics function or a third-party vendor), this section will be updated to name the specific vendor, the data collected, retention periods, and any transfers involved, in accordance with Section 10.

4.3.3 Analytics Cookies, once introduced, will be non-essential and will require your prior opt-in consent under PECR before being set, save where we rely on a narrow first-party analytics exemption recognised by the ICO for essential, privacy-preserving, aggregated statistics.

4.3.4 We will not use analytics Cookies to build profiles of children’s behaviour for the purposes of marketing, consistent with the ICO Children’s Code.

4.4 Marketing Cookies

4.4.1 Marketing Cookies (sometimes called advertising or targeting cookies) are typically used to track visitors across websites or apps in order to display advertisements relevant to their interests, or to measure the effectiveness of an advertising campaign.

4.4.2 Mentivox does not currently use any marketing or advertising Cookies. Given our explicit commitment not to monetise emotional vulnerability or user conversations, we will apply particular caution and restraint before introducing any such Cookies, and we will never use conversation content for advertising or marketing profiling purposes.

4.4.3 We will never set marketing Cookies for users we know or reasonably believe to be children (users aged 13–17), consistent with the ICO Children’s Code’s prohibition on profiling children for marketing purposes.

4.4.4 If marketing Cookies are introduced in future for eligible adult users, this Policy will be updated in advance to name the specific vendor(s), describe the data collected, and explain how consent will be obtained and withdrawn, in accordance with Section 10.

5.1 This section is to be populated as third-party tools are integrated. As at the date of this Policy, Mentivox does not have any confirmed named third-party analytics, advertising, payment, or marketing cookie providers integrated into the Service. Our current infrastructure sub-processor, Supabase, is used for data storage and does not set marketing or advertising cookies on visitors.

5.2 Should we integrate a third-party service that sets its own Cookies (for example, a future payment processor once a paid tier is introduced, or a customer support widget), we will update this section to identify the vendor by name, describe the purpose and category of the Cookies set, note the jurisdiction in which the vendor processes data, and link to the vendor’s own cookie or privacy notice where available.

5.3 We will notify users of material updates to this section in accordance with Section 10 and, where the update introduces new non-essential Cookies, will seek fresh consent before those Cookies are activated.

6.1 Where required by PECR, we will not set non-essential Cookies (functional, analytics, or marketing) on your device until you have given your consent, which will be obtained through a clear and prominent cookie banner or in-app consent prompt presented on your first use of the Service.

6.2 Our consent mechanism will allow you to:

accept all non-essential Cookie categories;

reject all non-essential Cookie categories, while still allowing strictly necessary Cookies required for the Service to function; and

make granular choices by category (for example, accepting functional Cookies but rejecting analytics or marketing Cookies), where technically applicable.

6.3 Consent will only be treated as validly given where it is freely given, specific, informed, and given by way of a clear affirmative act (for example, actively selecting “accept”), consistent with UK GDPR consent standards. We will not use pre-ticked boxes or deceptive design patterns (“dark patterns”) to obtain consent.

6.4 For accounts registered by users aged 13–17 under parental consent as described in our Privacy Policy and Terms of Service, non-essential Cookies will default to “off” and will only be activated following the same consent standard, applied with the enhanced, high-privacy-by-default settings appropriate to child accounts.

6.5 We will retain a record of your consent choices, including the date and scope of consent given, in order to demonstrate compliance with PECR and the UK GDPR accountability principle, as further described in our Data Retention Policy.

7.1 You may change or withdraw your Cookie preferences at any time by:

accessing the cookie preference settings within the Service (available via the app’s privacy or settings menu); or

adjusting your browser settings to block or delete Cookies, where you access our website via a browser.

7.2 Withdrawing consent will not affect the lawfulness of any use of Cookies based on consent given before its withdrawal.

7.3 Please note that if you disable strictly necessary Cookies through your browser or device settings, some parts of the Service may not function correctly, including the ability to remain securely logged in.

7.4 Most web browsers allow some control of Cookies through browser settings. You can typically find these settings in the “options,” “preferences,” or “privacy” menu of your browser. Further general information about managing cookies through your browser can be found via your browser provider’s help pages.

7.5 For app-based Cookies and similar technologies (such as device identifiers or local storage used within the Mentivox app), you may also be able to reset or limit tracking through your device’s operating system privacy settings.

8.1 Consistent with our age policy described in our Privacy Policy and Terms of Service, users aged 13–17 may only register with verifiable parental or guardian consent. Cookie settings for such accounts are configured to the highest privacy-protective defaults available, geolocation-related Cookies (if any are introduced in future) are disabled by default for child accounts, and no Cookie is used to profile a child user for marketing purposes.

8.2 Parents and guardians who have registered consent on behalf of a child user may contact us using the details in Section 12 to review or request changes to Cookie settings applied to that child’s account.

9.1 Some browsers offer a “Do Not Track” (DNT) signal. There is currently no universally accepted industry standard for recognising and responding to DNT signals. Where we introduce analytics or marketing Cookies in future, we will consider the feasibility of honouring recognised browser-level opt-out signals and will update this Policy accordingly.

10.1 We may update this Cookie Policy from time to time, in particular as we integrate new third-party tools, launch new features, or as legal requirements change. The “Last Updated” date at the top of this Policy indicates when it was last revised.

10.2 Where changes are material — including the introduction of new categories of non-essential Cookies or new third-party vendors — we will notify users through the Service or by other reasonable means (such as email or an in-app notice) in advance of the change taking effect, and will seek fresh consent where required.

10.3 We encourage you to review this Policy periodically to stay informed about our use of Cookies.

11.1 This Cookie Policy forms part of, and should be read together with, our Privacy Policy, Terms of Service, and Data Retention Policy, each of which is available within the Service and on our website. In the event of any inconsistency specifically regarding Cookies, this Policy governs.

12.1 If you have any questions about this Cookie Policy, or wish to exercise any choice described above, please contact us at:

Mentivox Ltd 3 Manchester Road, Thornton-Heath, CR7 8HH Company Number: 17271375 ICO Registration: ZC154942

You may also raise Cookie-related queries through the privacy contact channel identified in our Privacy Policy.

This Policy is drafted with reference to the following legal and regulatory sources:

Privacy and Electronic Communications Regulations 2003 (as amended) (“PECR”)

UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018

ICO Children’s Code (Age Appropriate Design Code)

Companies Act 2006