Mimir Logo

Privacy Policy

Mimir — AI Tutor

Last updated: March 06, 2026

1. Introduction

Random Walk SAS ("Random Walk," "we," "our," or "us"), a société par actions simplifiée registered in France under RCS number 928186881, with its registered office at 6 rue d'Armaillé 75017 Paris, is the data controller responsible for the processing of your personal data when you use the Mimir mobile application and related services (collectively, the "Service").

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, how long we retain it, and what rights you have under Regulation (EU) 2016/679 (the "General Data Protection Regulation" or "GDPR"), French Law No. 78-17 of 6 January 1978 as amended (the "Loi Informatique et Libertés"), and other applicable data protection legislation.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. This Privacy Policy is incorporated into and forms part of our Terms of Service.

2. Data We Collect

We collect and process the following categories of personal data:

2.1. Data You Provide During Onboarding

When you first set up the Mimir app, we ask you to provide:

  • Nickname: a display name of your choosing. This does not need to be your real name and is used to personalise your experience within the app (e.g., the AI Tutor addresses you by this name).
  • Age (or age range): used to adapt the educational content and difficulty level to your profile, and to verify compliance with age-eligibility requirements (see Section 6 below).

2.2. Data Shared with Our Third-Party AI Service

The Mimir AI Tutor is powered by Google's Gemini API, a third-party artificial intelligence service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

When you interact with the AI Tutor, the following personal data is sent to Google's Gemini API servers in order to generate personalised educational responses:

  • Your age (or age range), so that the AI Tutor can adapt its language, tone, and content difficulty to your profile;
  • Your messages and answers entered in the AI Tutor chat, including any personal information you may voluntarily include in your messages.

Your nickname is stripped from the data before it is sent to Google. We replace it with a generic placeholder so that your display name is never transmitted to Google.

Important: Google processes this data solely to provide the AI Tutor responses. Under our agreement with Google, this data is not used by Google to train, improve, or develop its general AI models. Google's processing of this data is governed by Google's Cloud Data Processing Addendum and Google's Privacy Policy.

Before any data is shared with Google's Gemini API, you will be asked for your explicit consent via an in-app prompt. You may decline, in which case the AI Tutor feature will not be available, but you may continue to use other features of the app. You may withdraw your consent at any time in the app's settings, which will stop future data sharing with Google's Gemini API.

2.3. Conversation Logs (Anonymised)

In addition to the real-time processing described in Section 2.2, we retain anonymised logs of your conversations. Before storage, these logs are stripped of directly identifying information (such as your nickname and any personal details you may have included in your messages) and associated with a non-reversible pseudonymous identifier. These anonymised conversation logs are used to:

  1. improve the quality, accuracy, and relevance of the AI Tutor's responses;
  2. personalise your learning experience (e.g., adapting to your level, remembering topics covered); and
  3. analyse aggregate usage patterns to develop and improve the Service.

We do not use your anonymised conversation logs to build a profile about you for advertising purposes.

2.4. Account Data

If you create an account, we may collect your email address for account management, authentication, and communication purposes (e.g., password reset, service notifications).

2.5. Technical and Usage Data

We automatically collect certain technical information when you use the Service, including:

  1. device type, operating system version, and app version;
  2. unique device identifiers (e.g., advertising ID, which you can reset in your device settings);
  3. usage statistics (e.g., session frequency, session duration, features used);
  4. crash reports and performance data; and
  5. IP address (truncated or used only for approximate geolocation at country level, then discarded).

2.6. Payment Data

If you subscribe to a paid plan, payment transactions are processed by third-party payment processors (such as Apple's App Store or Google Play, or Stripe). We do not collect or store your full credit card number, bank account details, or other payment instrument data. We may receive from payment processors a transaction ID, subscription status, and purchase history for account management purposes.

3. Legal Bases for Processing

Under the GDPR, we process your personal data on the following legal bases:

Processing Activity Legal Basis (Art. 6 GDPR) Details
Providing the Service (nickname, age, conversation logs for personalisation)Performance of a contract (Art. 6(1)(b))Necessary to deliver the educational features you have requested.
Sharing data with Google Gemini API (age, messages)Consent (Art. 6(1)(a))Your explicit consent is obtained via an in-app prompt before any data is shared with Google's Gemini API. You may withdraw consent at any time in the app settings.
Improving the AI Tutor and the Service (anonymised conversation logs, usage data)Legitimate interest (Art. 6(1)(f))Our legitimate interest in improving the quality and relevance of our AI models and Service. We have assessed that this processing does not override your rights, given that data is anonymised.
Age verification and eligibilityLegal obligation (Art. 6(1)(c))Compliance with GDPR Art. 8 and French law requirements on the age of digital consent.
Sending service-related emails (e.g., account, security)Performance of a contract (Art. 6(1)(b))Necessary for account management and security.
Sending promotional emailsConsent (Art. 6(1)(a))Only with your prior opt-in consent. You may withdraw consent at any time.
Payment processingPerformance of a contract (Art. 6(1)(b))Necessary to manage your subscription.
Crash reports, security monitoringLegitimate interest (Art. 6(1)(f))Our legitimate interest in maintaining the security and stability of the Service.

4. Data Sharing and Recipients

We do not sell your personal data. We may share your data with the following categories of recipients, only to the extent necessary for the purposes described in this Privacy Policy:

4.1. Third-Party AI Service Provider — Google (Gemini API)

The AI Tutor feature is powered by Google's Gemini API, provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Data shared: Your age (or age range) and your messages and answers entered in the AI Tutor chat.

Purpose: To generate personalised educational responses adapted to your profile and learning needs.

Data protection: Google processes this data under our Data Processing Agreement (DPA) in compliance with Article 28 of the GDPR. Google applies appropriate technical and organisational security measures to protect the data. Under our agreement, Google does not use the data shared via the Gemini API to train, improve, or develop its general-purpose AI models.

Consent: This data is only shared with Google after you have provided your explicit consent via the in-app consent prompt. You may withdraw your consent at any time in the app settings.

For more information, see Google's Privacy Policy.

4.2. Other Service Providers (Sub-processors)

We engage trusted third-party companies to help us operate and improve the Service, including:

  • Cloud hosting providers (e.g., for storing data securely);
  • Analytics providers (e.g., for aggregated, anonymised usage statistics);
  • Payment processors (e.g., Apple, Google, Stripe — for subscription management).

All sub-processors are bound by data processing agreements (DPAs) that comply with Article 28 of the GDPR.

4.3. Legal and Regulatory Authorities

We may disclose your personal data if required to do so by law, regulation, legal process, or enforceable governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

4.4. Business Transfers

If Random Walk is involved in a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your data.

5. International Data Transfers

Your personal data is primarily processed within the European Economic Area (EEA).

Transfer to Google (United States): When you use the AI Tutor, your data is transmitted to Google's servers, which may be located in the United States. This transfer is protected by the EU-U.S. Data Privacy Framework, under which Google LLC is certified, and/or Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46(2)(c) GDPR).

For other international transfers, we ensure that appropriate safeguards are in place, including:

  1. transfers to countries that have been granted an adequacy decision by the European Commission (Art. 45 GDPR);
  2. Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46(2)(c) GDPR); or
  3. other appropriate safeguards as required by applicable law.

You may request a copy of the safeguards in place by contacting us at team@randomwalk.fr.

6. Children's Privacy and Parental Consent

Mimir is an educational application and may be used by minors. We take the protection of children's data very seriously.

6.1. Age Thresholds

  • Under 13: The Service is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected personal data from a child under 13 without appropriate consent, we will take steps to delete that data promptly.
  • Ages 13–15: In accordance with Article 8 of the GDPR and Article 45 of the Loi Informatique et Libertés, users under the age of 16 in France (or the applicable age in their country of residence) require verifiable parental or guardian consent before using the Service. We implement reasonable measures to obtain and verify such consent. This includes consent for sharing data with Google's Gemini API as described in Section 2.2.
  • Ages 16 and above: Users aged 16 and above may consent to the processing of their personal data on their own behalf.

6.2. Data Minimisation for Minors

We apply the principle of data minimisation (Article 5(1)(c) GDPR) with particular rigour when processing the data of minors. We only collect the minimum data necessary to provide the Service (nickname and age), and conversation logs are anonymised before storage.

6.3. Parental Rights

Parents and guardians may exercise the data subject rights described in Section 9 on behalf of their children by contacting us at team@randomwalk.fr.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law:

Data CategoryRetention PeriodRationale
Nickname, ageDuration of your account, plus 30 days after deletionNecessary to provide the Service. Deleted shortly after account closure.
Email addressDuration of your account, plus 30 days after deletionAccount management and communications.
Data sent to Google Gemini APIProcessed in real time; not retained by Google beyond the API request processing timeUsed solely to generate AI Tutor responses. Not stored by Google for model training.
Anonymised conversation logsMaximum of 24 months from the date of the conversationAI model improvement and Service personalisation. Automatically purged after the retention period.
Technical and usage dataMaximum of 13 monthsAnalytics and performance monitoring, in accordance with CNIL guidance.
Payment transaction recordsDuration required by applicable tax and commercial law (up to 10 years in France)Legal obligation under French commercial and tax law.

After the applicable retention period, personal data is securely deleted or irreversibly anonymised.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, in accordance with Article 32 of the GDPR. These measures include:

  1. encryption of data in transit (TLS) and at rest;
  2. access controls and authentication mechanisms;
  3. regular security assessments and vulnerability testing;
  4. anonymisation of conversation logs before storage;
  5. stripping of identifying information (such as nicknames) before transmitting data to Google's Gemini API; and
  6. staff training on data protection and security.

While we strive to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. Your Rights Under the GDPR

As a data subject, you have the following rights under the GDPR and applicable French law. You may exercise any of these rights by contacting us at team@randomwalk.fr.

RightDescription
Right of access (Art. 15)You have the right to obtain confirmation as to whether your personal data is being processed and to access a copy of that data.
Right to rectification (Art. 16)You have the right to request correction of inaccurate personal data.
Right to erasure (Art. 17)You have the right to request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
Right to restriction of processing (Art. 18)You have the right to request that we restrict the processing of your data in certain circumstances.
Right to data portability (Art. 20)You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
Right to object (Art. 21)You have the right to object to processing based on our legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
Right to withdraw consent (Art. 7(3))Where processing is based on your consent (including consent to share data with Google's Gemini API), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. You can withdraw your consent for AI data sharing in the app settings.
Right to lodge a complaintYou have the right to lodge a complaint with the French data protection authority: Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
Right to define post-mortem directives (French law)Under French law (Loi Informatique et Libertés, Art. 85), you have the right to define directives regarding the storage, erasure, and communication of your personal data after your death.

We will respond to your request without undue delay and in any event within one month of receipt, as required by Article 12(3) of the GDPR. This period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

10. Cookies and Similar Technologies

The Mimir mobile application does not use browser cookies. However, we and our analytics partners may use similar technologies (such as SDKs or device identifiers) to collect usage data as described in Section 2.5.

Where required by the ePrivacy Directive (2002/58/EC) as transposed into French law and by CNIL guidelines, we will obtain your consent before deploying any non-essential tracking technologies. You may manage your preferences at any time through the app settings.

11. Automated Decision-Making and Profiling

The AI Tutor uses automated processing (via Google's Gemini API) to generate personalised educational content based on your interactions (e.g., adapting difficulty, suggesting topics). This does not constitute automated decision-making that produces legal effects or similarly significant effects on you within the meaning of Article 22 of the GDPR.

We do not use your personal data for automated profiling that would result in decisions with legal or similarly significant effects.

12. Third-Party Links and Services

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party services before sharing your personal data with them.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. We will notify you of any material changes by posting the updated Privacy Policy on the Service and, where required by applicable law, by seeking your consent or providing you with prior notice (e.g., via email or in-app notification).

The "Last updated" date at the top of this Privacy Policy indicates when the latest revision took effect. We encourage you to review this Privacy Policy periodically.

14. Data Protection Officer

If you have any questions or concerns about this Privacy Policy or our data processing practices, you may contact our Data Protection Officer:

Random Walk SAS
6 rue d'Armaillé, 75017 Paris
Email: team@randomwalk.fr

You may also contact the CNIL at any time if you have a concern about how your personal data is being processed.

15. Contact Us

For any questions about this Privacy Policy or to exercise your data subject rights, please contact us at:

Random Walk SAS
6 rue d'Armaillé, 75017 Paris
Email: team@randomwalk.fr