Myra — Effective date: [Effective date — set at publication]
Data controller: [Legal entity name — pending incorporation], a company registered in the United Arab Emirates(“Myra”, “we”, “us”). Contact: privacy@getmyra.com.
Myra is a communications assistant. It connects, with your permission, to accounts you choose — email, calendar and messaging services — and presents them in one place, with assistant features that triage messages, draft replies for your review, detect scheduling, and organise your relationships, notes and files. Myra works for you: the data it processes is yours, is processed to provide these features to you, and is not used for advertising, sold, or used to train generalised artificial-intelligence models.
To provide the service you signed up for: presenting your communications, generating triage classifications, drafting text for your review, detecting scheduling intent, producing reminders and summaries, and keeping your connected accounts in sync with actions you take in Myra. Assistant features are powered by a third-party AI provider (Anthropic); the content necessary for a feature is sent to that provider under a data-processing agreement that prohibits use of your data for model training. We do not use your content for advertising and we do not sell personal data.
Myra’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Google user data is used only to provide the user-facing features described above; it is not transferred except as necessary to provide those features, to comply with law, or as part of a merger with notice to you; it is not used for advertising; and humans do not read it except with your explicit permission, for security purposes, to comply with law, or where the data has been aggregated and anonymised.
Where you connect a messaging service such as WhatsApp, Myra accesses it through a connectivity provider (Unipile) using the credentials session you authorise. You should be aware that WhatsApp’s terms of service do not officially support third-party clients, and connecting carries a risk, however managed, of restrictions being applied to your account by the platform. Myra operates read-focused, human-paced usage designed to minimise this risk, and you may disconnect at any time.
Your data is stored in the European Union (Supabase, hosted on AWS in London, eu-west-2). Some processing necessarily occurs outside the EU and UK — in particular the AI features (Anthropic) and the APIs of accounts you connect (Google, Microsoft and Apple). Our subprocessors include Supabase (database and storage), Vercel (application hosting), Anthropic (AI processing), Unipile (messaging connectivity, for messaging accounts you connect), Paddle (payments), and Google, Microsoft and Apple (the APIs of accounts you connect). A current subprocessor list is maintained at /subprocessors. Transfers outside the EU/UK are protected by Standard Contractual Clauses.
We retain your content while your account is active. You may export your data at any time (Settings → Export) and you may delete your account (Settings → Delete account). Deletion is immediate: it permanently erases your content, disconnects all connected accounts and removes your stored files in a single operation. Encrypted system backups are retained for up to 30 days for disaster recovery and then permanently expire, except where the law requires longer retention of specific records. If you cancel a subscription, connected messaging sessions are disconnected when the cancellation takes effect.
Depending on your location, you have rights to access, correct, export, restrict and delete your personal data, and to object to processing. EU/UK users: our legal bases are performance of contract (providing the service) and legitimate interests (service security and improvement); our EU representative is [EU representative — to appoint] and you may lodge a complaint with your supervisory authority. UAE users: we process personal data in accordance with Federal Decree-Law No. 45 of 2021 (PDPL). To exercise any right, contact privacy@getmyra.com.
Data is encrypted in transit and at rest, access to production data is restricted by authentication, and each account’s data is isolated and verified by automated isolation tests. As part of Google API verification we are pursuing an independent application security assessment (CASA). More detail is on our security page.
We will notify you of material changes by email before they take effect. Questions: privacy@getmyra.com. Postal: [Registered address — pending incorporation].