Privacy Policy

Melissa is operated by Ekaterina Fediukovich, a self-employed professional (autónomo) registered in Spain, tax ID Z1130287A, address Calle Simone de Beauvoir 2, 46183, L'Eliana, Valencia, Spain ("we", "us"). Contact: melissatreat.main@gmail.com. Website: https://melissatreat.dev. Application: https://app.melissatreat.dev.

This policy applies to visitors of our website and to mental health professionals who create a Melissa account ("you"). Melissa is intended for professional use only and is not directed at patients or the general public.

We are the data controller for data about you: your account, subscription, correspondence with us and your use of the website and the app.

We are a data processor for information about your clients that you enter into Melissa: client records, appointments, session notes, therapy goals and payments. For this data you are the controller: you decide what to record and why, you are responsible for having a lawful basis — including for health data under Article 9 GDPR — and for informing your clients. We process client data only on your instructions, as set out in the data processing terms in our Terms of Service.

If you are a client of a professional who uses Melissa, please contact that professional about your data. We will forward any request we receive to them.

Account data. When you sign in with Google or with an email link, we receive your email address and, for Google sign-in, your name and profile picture, via Firebase Authentication. We use them to create and secure your account and to send essential service messages. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Settings: currency, default prices and session durations, working schedule, tags and expense categories. Legal basis: performance of a contract.

Client data you enter: first and last name, birth year, status and tags; appointments (date, time, duration, format, price, description); session notes and therapy goals; payments and expenses you record. We store and display this data so you can run your practice. We do not use client data for analytics or advertising, or to train AI models.

Billing data. The Pro plan is paid through Stripe. You enter your card details directly on Stripe; they never reach our servers. We store your Stripe customer ID and the status of your subscription. Legal basis: performance of a contract and legal obligations (tax and accounting records).

Calendar feed. If you turn on the calendar feed, we create a secret link that lets your calendar app (for example, Google or Apple Calendar) load your appointments. Anyone who has the link can see these appointments, so keep it private. You can regenerate the link in settings at any time.

Technical logs. Our servers record API requests, timestamps, IP addresses and errors to keep the service secure and working. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Error monitoring. When an error occurs in the app, information about it — including your user ID, email address, IP address, browser and the steps that led to the error — is sent to Sentry so that we can fix it. Legal basis: legitimate interest in a reliable service.

Analytics and session recording — only with your consent, see section 4.

Correspondence. When you write to us, we keep the correspondence to answer you and to have a history of earlier requests. Legal basis: legitimate interest.

We use strictly necessary cookies and similar browser storage to keep you signed in (__session), remember your language (NEXT_LOCALE) and store your cookie choice (mt_cookie_consent). They do not require consent.

Only with your consent, we use: on the website — Google Analytics and Mixpanel to measure visits, clicks and traffic sources, including campaign (UTM) parameters; in the app — Mixpanel to record usage events and sessions, and Sentry Session Replay to record sessions that help us reproduce errors. Session recordings mask all text and input values, so the content of client records is not captured.

Your choice is stored for 6 months, after which we ask again. You can change it at any time: on the website via "Cookie settings" at the bottom of the page, in the app via Settings → Data and privacy. When you withdraw consent, we delete the analytics cookies from your browser.

Legal basis: consent (Art. 6(1)(a) GDPR and Art. 22.2 of the Spanish LSSI). Mixpanel processes data in the EU. Google Analytics may transfer data to the United States (see section 7). Analytics data is kept according to the retention settings of these services.

Melissa offers an optional connection to AI assistants that support the Model Context Protocol (MCP), such as ChatGPT, Claude or Cursor. An AI app has no access to your account until you connect it: you sign in to Melissa from the app, review the requested permissions and approve access via OAuth.

Once connected, the AI app can, on your instructions and within the permissions you approved, read and change clients, appointments, session notes, therapy goals, schedule, tags and payments in your account. Access tokens are short-lived; the connection expires after 30 days without use.

Data requested by the AI app is sent to the AI provider you use with it (for example OpenAI or Anthropic) and processed under your own agreement with that provider and its privacy policy; the provider may process it outside the EU. Before connecting, consider whether sharing client data with an AI provider is compatible with your professional and legal obligations: share only the minimum necessary and review the provider's data controls. You can disconnect the app at any time in its settings.

We do not use your data or your clients' data to train AI models.

Service providers (subprocessors) that help us run Melissa: Google Cloud Platform — hosting and database (EU, Finland); Google Firebase — authentication and hosting of the website and the app (EU); Stripe — payments; Sentry — error monitoring (EU, Germany); Mixpanel — product analytics, with consent only (EU); Google Analytics — website analytics, with consent only. Each of them processes data under a data processing agreement with us.

AI providers (such as OpenAI or Anthropic) receive data only if you connect an AI app, and do so under your own agreement with them.

Our access. Nobody at Melissa looks at your clients' data, except: when you ask us for help and give explicit permission; when an automated process fails and we need to see a minimum of data to fix it; to investigate abuse or a security incident; or when required by law.

Legal requests. We disclose data to authorities only when compelled by a valid legal order under EU or Spanish law, and we will notify you unless we are prohibited from doing so.

Transfer of the business. If Melissa is ever transferred to another operator, we will notify you before your data becomes subject to a different privacy policy.

We never sell personal data and never use client data for advertising.

Your account and client data are stored on Google Cloud servers in the European Union.

Some providers — Stripe, Google Analytics and, if you connect an AI app, the AI provider you use with it — may process data in the United States. Such transfers rely on the EU–U.S. Data Privacy Framework or on Standard Contractual Clauses approved by the European Commission.

All data is encrypted in transit (HTTPS/TLS) and at rest, including backups. Client data is available only to your signed-in account; access on our side is restricted to what is necessary to run the service.

You are responsible for keeping access to your Google or email account secure, since it is used to sign in to Melissa.

If a personal data breach affects your data, we will notify you without undue delay and, where required, the supervisory authority.

We keep your data while your account is active.

You can export all your data (JSON or CSV) and delete your account at any time in Settings → Data and privacy. Deleting the account immediately and permanently erases your clients, appointments, notes, goals and payments from our database, deletes your sign-in account and removes your customer record at Stripe. Copies in encrypted backups are overwritten within 30 days.

We keep invoices and payment records for as long as Spanish tax and accounting law requires. To prevent a deleted account from being recreated by mistake, we keep the technical identifier of the deleted sign-in account, without any other data.

Demo accounts contain sample data and expire after 24 hours. Technical logs are kept for up to 30 days.

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability and to withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Many of these rights can be exercised directly in the app: edit your settings, export your data or delete your account. For anything else, write to melissatreat.main@gmail.com; we will reply within one month. We may ask you to confirm your identity first.

You can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or with the supervisory authority of your country.

Requests from your clients about client data are handled by you as the controller. We will help you respond to them.

Melissa accounts are for professionals aged 18 and over. If you record information about clients who are minors, you are responsible for obtaining the consent of their parents or legal guardians where required.

We may update this policy. We will change the date at the top and, for significant changes, notify account holders by email or in the app before the changes take effect.

Ekaterina Fediukovich, Calle Simone de Beauvoir 2, 46183, L'Eliana, Valencia, Spain. Email: melissatreat.main@gmail.com.