Privacy Policy
Last updated: «date» · Version: 1.0 (draft for review)
This policy explains how AIMayDo collects and uses personal data when you visit our site, talk to an AI twin, or operate a twin as an expert. It is written to meet the information duties in Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act.
1. Who is responsible (data controller)
The data controller for the processing described here is:
«Legal entity», CVR «number»
«registered address»
Email: «privacy@ contact email»
We have not appointed a Data Protection Officer at this stage; whether one is required will be assessed with counsel. Contact details above are placeholders pending the legal review noted at the top of this page.
2. What data we process
- Account & contact data — name, email, role (visitor / expert / admin), and authentication identifiers.
- Billing data — purchase records and the payment metadata returned by our payment processor. We do not store full card numbers.
- Expert biometric & likeness data — for experts who build a twin: voice recordings, facial/portrait imagery, and the recorded consent and identity artefacts. These are special-category (biometric) data under Art. 9.
- Conversation data — the messages you exchange with a twin, and derived usage (e.g. minutes consumed).
- Technical data — a first-party visitor identifier and standard server logs needed to run and secure the service. To stop abuse of the free-minute allowance (e.g. resetting it by clearing cookies), we also keep a salted one-way hash of your IP address as an abuse-prevention counter. We do not store the raw IP for this purpose, and the hash cannot be reversed to identify you.
3. Why we process it, and our legal basis
| Purpose | Legal basis (GDPR Art. 6 / 9) |
|---|---|
| Creating and running your account; providing the service | Performance of a contract (Art. 6(1)(b)) |
| Billing and processing minute purchases | Contract (Art. 6(1)(b)); legal obligation for tax records (Art. 6(1)(c)) |
| Building a twin from an expert's voice and likeness (biometric data) | Explicit consent (Art. 9(2)(a)) — recorded before any twin goes live |
| Retaining conversation history to improve and review twins | Consent (Art. 6(1)(a)) and/or legitimate interests (Art. 6(1)(f)) |
| Security, fraud prevention and keeping the service available | Legitimate interests (Art. 6(1)(f)) |
Where we rely on consent — in particular for an expert's biometric data — you can withdraw it at any time (see section 7). Where we rely on legitimate interests, you can object (see section 7).
4. Who we share data with (sub-processors)
We use the following service providers to deliver the product. Each acts as a processor or independent controller under a data-processing agreement:
| Provider | Purpose | Location |
|---|---|---|
| Anthropic | Large-language-model responses for the twin | USA |
| ElevenLabs | Voice synthesis and voice cloning | USA |
| Simli | Real-time talking-avatar rendering | USA |
| Supabase | Database, authentication and file storage | EU |
| Stripe | Payment processing for minute purchases | USA |
| Resend | Transactional and authentication email delivery | USA |
We do not sell personal data. We share it only as needed to run the service or where required by law.
5. International transfers
Several of our providers (Anthropic, ElevenLabs, Simli, Stripe) process data in the United States. For these transfers outside the EU/EEA we rely, per vendor, on the EU–US Data Privacy Framework where the vendor is certified and/or on Standard Contractual Clauses with supplementary measures. The specific mechanism per provider is being confirmed and will be listed here: «per-vendor mechanism».
6. How long we keep data
- Account data — for the life of the account, then deleted within 90 days of closure (except records we must keep, below).
- Billing records — 5 years from the end of the financial year, as required by the Danish Bookkeeping Act (Bogføringsloven).
- Expert biometric/likeness data — kept only while the twin is live. When the expert revokes consent or closes the twin, the cloned face and voice are deleted at our processors (Simli, ElevenLabs) and in our systems within 30 days.
- Conversation history — kept while your account is active, deleted when you delete it or within 90 days of account closure.
- Abuse-prevention IP hash — the salted, one-way IP hash used to cap free minutes is purged on a rolling 30-day window.
These are our current retention periods; counsel may refine them before this policy is finalised.
7. Your rights
Subject to the conditions in the GDPR, you have the right to:
- Access — a copy of the personal data we hold about you (Art. 15).
- Rectification — correction of inaccurate or incomplete data (Art. 16).
- Erasure — deletion of your data where the conditions apply (“right to be forgotten”, Art. 17).
- Restriction — limiting how we process your data (Art. 18).
- Portability — receiving your data in a structured, machine-readable format (Art. 20).
- Objection — objecting to processing based on legitimate interests (Art. 21).
- Withdraw consent — withdrawing any consent at any time, without affecting processing already carried out (Art. 7(3)). For experts this includes revoking the likeness/voice/name licence, which switches the twin off.
You can exercise access, erasure, portability and consent-withdrawal directly from your account's Data Rights controls when signed in, or by contacting us at «privacy@ contact email». We aim to respond within one month.
You also have the right to lodge a complaint with the Danish supervisory authority, Datatilsynet (datatilsynet.dk), or with the supervisory authority in your EU country of residence.
8. Cookies
We use only strictly-necessary cookies by default: a first-party visitor identifier (mayaido_vid) and the Supabase sign-in/session cookies. These are exempt from consent because they are essential to provide a service you have requested. We currently load no analytics or marketing cookies. If we add any in future, they will load only after you opt in through the cookie banner.
9. AI twins and automated processing
Twin replies are generated by AI and are always labelled as such. They are information, not professional advice. We do not use your conversations to make decisions that produce legal or similarly significant effects about you without a legal basis and appropriate safeguards.
10. Changes to this policy
We will update this policy as the product and our legal review progress, and will revise the date at the top when we do.