This document is published in English. Translations for other markets will be published once legally reviewed.
Summary
We use your data to provide the assistant you ask for. We do not sell your private conversations, email content or personal data to advertisers. Our AI providers may not train their models on your data. On-device processing is used where practical. Optional programmes such as MyPA Insights are off unless you opt in. Card payments are handled by Trust Payments and we never store your full card number. You can access, correct, export and delete your data.
1. Who we are
1.1 MyPA Limited ("MyPA", "we", "us") is a company registered in Jersey and registered with the Jersey Office of the Information Commissioner. We are the controller of personal data processed through the MyPA Service unless this Policy or a partner notice says otherwise.
1.2 Where MyPA is provided by a white-label or enterprise partner, that partner may also be a controller for its own customer relationship, and MyPA may act as its processor for some processing. The partner's privacy notice will explain this.
1.3 Data Protection Officer: dpo@mypa.today, MyPA Limited, VG, Floor 5, 37 Esplanade, St Helier, Jersey JE1 2TR, Channel Islands.
1.4 Representatives. Where required, MyPA will appoint a representative in the UK and/or EU and publish their details here.
2. Scope
This Policy covers personal data processed when you use MyPA websites, apps, AI services, messaging channels, connected accounts, Secure Browser, Privacy Shield, VPN, Creator apps, Ask the Experts, payments, commerce and booking features, MyPA Insights and support. Third-party services you choose to use through MyPA have their own privacy notices.
3. Our privacy principles
- Data minimisation: we process only what is reasonably needed for the purpose.
- Purpose separation: permission to use data to provide MyPA is not permission to use it for advertising or MyPA Insights.
- On-device first: suitable tasks run locally using Local Lite or Local Smart.
- No training on your private content: we do not use your private conversations, emails or files to train general-purpose AI models, and our AI providers are contractually prohibited from doing so.
- User control: optional permissions can be withdrawn at any time.
- Restricted data stays restricted: platform and legal restrictions apply even if you consent.
- Security by design.
4. Personal data we process
| Category | Examples |
|---|---|
| Account and contact data | Name, email, phone number, country, language, account identifiers, settings |
| Identity and age assurance data | Verification status, verified age band, verification reference; identity documents, facial images or biometric data processed by an approved verification provider where required |
| Interaction and AI data | Prompts, questions, instructions, uploaded files, AI Outputs, feedback and ratings, voice input and transcripts |
| Memory and personalisation data | Preferences, summaries, embeddings and other representations you allow MyPA to remember |
| Connected-account data | Email, calendar, contacts, files, photos, messages and other data from services you link, as permitted by the scopes you grant |
| Messaging-channel data | Messages you send to MyPA through WhatsApp, Telegram or another channel, and the linked number or name |
| Transaction, booking and commerce data | Products or services requested, merchant, price, booking or order status, delivery or travel details, refund status |
| Payment data | Payment token, card brand, last four digits, expiry date, billing country, transaction ID, amount, currency, 3-D Secure and fraud-screening result, subscription status and history. We do not receive or store full card numbers or security codes. |
| AI Token data | Token balances, purchases, rewards, usage and expiry |
| Ask the Experts data | Booking details, consultation messages and notes, and health or other sensitive information you share (see section 9) |
| Device and usage data | IP address, device and OS type, app version, crash and diagnostic data, security logs, feature usage |
| Location data | Approximate or precise location where you enable location services |
| Action records | Instructions, confirmations, Standing Authorities, third-party responses and outcomes for actions MyPA takes for you |
| Business data | For advertisers, merchants, creators and partners: business details, KYB results, billing and campaign information |
| Support and communications | Support requests, complaints, appeals and our responses |
5. Why we use personal data and our legal bases
| Purpose | Legal basis (UK/EU/Jersey) |
|---|---|
| Provide the Service and features you request, including AI responses, memory, connected services and actions | Contract |
| Process payments, subscriptions, refunds and AI Token purchases; prevent payment fraud | Contract; legal obligation; legitimate interests (fraud prevention) |
| Verify identity and age where required | Legal obligation; contract; consent for biometric processing where required |
| Security, fraud and abuse prevention, safety-filter operation | Legitimate interests; legal obligation |
| Human oversight: reviewing reported, flagged and sampled AI outputs for safety, accuracy and labelling | Legitimate interests (safe and reliable AI; meeting our transparency commitments); legal obligation where applicable |
| Customer support, complaints and appeals | Contract; legitimate interests |
| Improve reliability and quality using aggregated or de-identified data | Legitimate interests |
| Personalised recommendations and advertising | Consent where required; otherwise legitimate interests |
| MyPA Insights | Consent |
| Marketing emails | Consent, or legitimate interests for similar products where the law allows, with an opt-out in every message |
| Legal, tax and accounting obligations | Legal obligation |
| Ask the Experts health and sensitive data | Explicit consent; provision of health care where applicable |
Where we rely on legitimate interests, we have balanced them against your rights. You can object (section 18).
6. AI processing
6.1 Processing routes. Tasks may run on your device (Local Lite / Local Smart) or in the cloud (Cloud Smart). In Cloud Smart, we send the minimum information reasonably needed for the task to cloud AI models we host or that are provided by third-party AI providers acting as our processors. Depending on the task, your settings and availability, these include AI services operated by Anthropic, Google, OpenAI, xAI, Perplexity, Mistral, DeepSeek and Alibaba.
6.2 Provider restrictions. Our AI providers are contractually required to process data only on our instructions, not to use it to train or improve their general models, to keep it secure, and to delete it after a limited period (typically no more than 30 days for abuse monitoring, or zero retention where available).
6.3 Bring your own provider. If you connect your own AI account or key, data you send is governed by that provider's terms.
6.4 Human review. To keep MyPA safe and accurate, trained MyPA reviewers may review: content you report or flag; content that triggers high-severity safety alerts; and a limited random sample of de-identified outputs for quality assurance. Reviewers are bound by confidentiality, access is logged, and we exclude content from connected email (including Gmail), health services and Ask the Experts consultations from routine quality sampling. See the Human Oversight Process Policy.
6.5 Improving MyPA. We use aggregated and de-identified usage data and your explicit feedback (such as ratings) to improve MyPA. We will ask for your separate consent before using identifiable conversation content to train or fine-tune any model.
6.6 Automated decision-making. MyPA uses AI to generate responses and recommendations, but does not make decisions about you based solely on automated processing that produce legal or similarly significant effects, except fraud-prevention checks on payments, which you can ask a human to review.
7. Memory and personalisation
Where enabled, MyPA stores preferences, summaries and embeddings to personalise your assistant, on your device, in secure cloud storage, or both. You can view, edit and delete memories and turn memory off in Settings > Privacy.
8. Payments
8.1 Card payments made directly to MyPA are processed by our payment service provider, Trust Payments, and its acquiring and card-scheme partners. Your card details are entered into Trust Payments' secure payment environment; we receive only a token and limited card information.
8.2 Trust Payments acts as an independent controller for the payment data it processes to provide payment services, meet its regulatory obligations (including anti-money-laundering and fraud prevention) and comply with card-scheme rules. Its privacy notice is available at trustpayments.com.
8.3 We share with Trust Payments the information needed to process and authenticate payments, prevent fraud and handle refunds and chargebacks, including your name, email, billing country, order details, IP address and device data.
8.4 Purchases through Apple, Google or another app store are processed by that store under its privacy policy.
9. Health and other sensitive data
If you use health, wellbeing or Ask the Experts features, we process health or other special-category data you provide only as necessary for that service, with your explicit consent or another lawful condition. Such data is never used for advertising or MyPA Insights and is excluded from routine quality sampling.
10. Connected services and source restrictions
10.1 Data from connected services is used only to provide the functionality you request.
10.2 Google. MyPA's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail or Google Workspace data for advertising, MyPA Insights, sale or training general AI models, and we do not allow humans to read it except with your permission, for security purposes, to comply with law, or where aggregated and anonymised for internal operations.
10.3 Apple. We do not require App Tracking Transparency or other system permissions to use MyPA or earn rewards; do not use VPN or Network Extension data for advertising, MyPA Insights or third-party profiling; do not collect information about other installed apps for analytics or advertising; and do not use HealthKit or Clinical Health Records data for advertising or data mining.
10.4 Messaging channels. If you link WhatsApp, Telegram or another channel, we receive only messages you send to MyPA and your linked identifier. We cannot read your other conversations. Meta or the relevant provider processes data under its own policy.
11. VPN and Privacy Shield
Privacy Shield operates on your device to block trackers and threats. The server-based VPN processes limited connection information to route encrypted traffic and does not log the sites you visit, subject to limited technical, security and abuse-prevention processing.
12. MyPA Insights (optional)
12.1 MyPA Insights is a voluntary programme for adults (18+) to contribute selected data for research and measurement in return for Promotional AI Tokens. It is off by default and requires a separate opt-in that shows the data categories, purposes, mode, recipient categories and reward terms.
12.2 Modes. In Aggregated Insights Mode, customers receive only aggregate, statistical outputs designed not to identify you. In Permissioned Data Sharing Mode (where offered and lawful), selected personal or pseudonymous data is disclosed to the recipient categories you approved.
12.3 Excluded data. Identity documents, biometrics, payment credentials, health or clinical data, other people's private communications, Apple VPN data, installed-app information on Apple devices, data from APIs that prohibit such use (including Google Workspace Limited Use data) and data from users under 18.
12.4 Withdrawal. You can withdraw at any time in settings. Future processing and reward accrual stop; ordinary MyPA continues; validly earned tokens are kept. Data already in genuinely aggregated reports cannot be withdrawn because it no longer identifies you.
13. Who we share data with
| Recipient | Why |
|---|---|
| Cloud hosting and infrastructure providers | Host and operate the Service |
| AI model providers | Cloud Smart processing (as processors, no training) |
| Trust Payments and app stores | Payments, refunds, fraud prevention |
| Identity and age verification providers (currently Didit) | Verification where required |
| Communications providers (email, SMS, messaging channels) | Send notifications and operate channels |
| Third parties you ask MyPA to deal with | Complete bookings, purchases and messages you request |
| Ask the Experts professionals | Provide the service you book |
| Support, security and fraud-prevention providers | Support you and protect the Service |
| White-label and creator partners | As described in the partner's notice (creators do not receive your private conversations with their AI Persona unless you are told otherwise) |
| Insights customers | Only under MyPA Insights and within your consent |
| Professional advisers, auditors, regulators, law enforcement | Where required by law or to protect rights |
| Buyers or successors of our business | In a reorganisation, merger or sale, subject to this Policy |
The current list of key subprocessors and their locations is in the International Data Transfer and Subprocessor Schedule, available on request from dpo@mypa.today.
14. Advertising
MyPA's advertising is primarily contextual, based on what you ask MyPA within the Service. We do not use third-party cross-site tracking pixels on the core Service. Sensitive categories are not used for targeting. Sponsored content is labelled. Where personalised advertising requires consent, we ask for it.
15. International transfers
MyPA is based in Jersey, which is recognised by the UK and EU as providing adequate data protection. Some providers process data in other countries, including the UK, EU/EEA, the United States and India. Where data is transferred to a country without adequate protection, we use appropriate safeguards such as the UK International Data Transfer Addendum, EU Standard Contractual Clauses, adequacy frameworks (such as the EU–US Data Privacy Framework and UK Extension) or another lawful mechanism.
16. Retention
| Data | Retention |
|---|---|
| Account data | While your account is open, then up to 90 days after closure (unless longer is required below) |
| Conversations and AI Outputs | Until you delete them or close your account; deleted items removed from active systems within 30 days |
| Memory | Until you delete it or turn memory off |
| Payment and transaction records | 7 years after the transaction for tax, accounting and card-scheme purposes |
| Action records | 24 months after the action, or longer if needed for a dispute |
| Human oversight review records | 24 months |
| Identity verification results | As required by law; identity images and biometric data deleted by the provider promptly after verification unless law requires longer |
| Security logs | Up to 12 months |
| Support and complaint records | 3 years after closure of the matter |
| Consent records | For the life of the consent plus 6 years |
| Marketing preferences | Until you opt out, then suppression record kept |
Backups expire within 35 days. Genuinely anonymised data may be kept.
17. Security
We use encryption in transit and at rest, access controls with multi-factor authentication, logging, secure development, vulnerability management and incident response. Card data is handled in Trust Payments' PCI DSS-compliant environment. No system is completely secure; we will notify you and regulators of personal data breaches where required by law.
18. Your rights
Depending on where you live, you may have the right to: access your data; correct it; delete it; restrict or object to processing (including direct marketing and processing based on legitimate interests); data portability; withdraw consent; not be subject to solely automated decisions with significant effects; opt out of sale, sharing or targeted advertising; and complain to a regulator. Use Settings > Privacy or email dpo@mypa.today. We respond within one month (extendable where permitted). We will not discriminate against you for exercising your rights.
19. Children
MyPA is not intended for children under 13. Users aged 13–17 need parental permission, receive restricted features, cannot make purchases and cannot join MyPA Insights. If we learn we hold data of a child under 13 without appropriate consent, we will delete it.
20. United States residents
Where the California Consumer Privacy Act or other US state laws apply, you may have rights to know, access, delete and correct personal information, to opt out of sale or sharing and targeted advertising, and to limit use of sensitive personal information. We honour Global Privacy Control signals where required. If MyPA Insights is a financial incentive under California law, we provide a Notice of Financial Incentive before enrolment.
21. Japan
For users in Japan, the Japan Country Schedule (Part B – APPI) supplements this Policy. The Japan Country Schedule will be published before MyPA launches in Japan.
22. Changes
We will notify you of material changes before they take effect. Where a change requires consent, we will ask for it rather than rely on continued use.
23. Contact and complaints
Data Protection Officer: dpo@mypa.today, MyPA Limited, VG, Floor 5, 37 Esplanade, St Helier, Jersey JE1 2TR, Channel Islands. You may complain to the Jersey Office of the Information Commissioner (jerseyoic.org), the UK Information Commissioner's Office (ico.org.uk), your local EU supervisory authority or another competent regulator.