Privacy Policy

Version: 1.0 · Last updated: 7 October 2026

1. Who we are

MyPAI ("we", "us") is a personal operational-risk service. It reads your Gmail and Google Calendar, read-only, to find the commitments in them — things you have to reply to, attend, pay or do — and shows you the ones that may need your attention. This policy covers the MyPAI web app and this website.

• Controller: MY PAI LTD (company number 16399782, registered in England and Wales)
• Contact: see §14.

2. The short version

• MyPAI reads your mail in memory. It does not store your message bodies, attachments or snippets and does not keep a copy of your mailbox.
• What MyPAI keeps is a record of its own judgements — the items it assessed for you and what you did with them — together with account, sign-in and security records. When some features are switched on it also keeps short text derived from your mail, such as a normalised subject line (§3.3, §6).
• Decisions are made by deterministic software we wrote, not by an AI model. MyPAI sends your Google data to no AI model or AI provider and trains no model with it.
• MyPAI never sends, changes, deletes or moves any of your email or calendar items.
• We do not sell your data, do not use it for advertising and do not share it with advertisers, data brokers or AI companies.
• You can stop MyPAI's access at any time in your Google Account. Deleting your MyPAI records, or getting a copy, is done by asking us: there is no self-service button yet (how to manage or delete your data today).

3. What we collect

3.1 From Google, with your permission

When you sign in with Google you grant MyPAI these permissions: openid, userinfo.email, userinfo.profile, gmail.readonly and calendar.readonly. They let MyPAI read:

• your Google profile: your email address, name and profile picture, and Google's stable identifier for your account. Our server records your email address and that identifier; your name and picture are fetched by your browser and are not stored by our server;
• Gmail, read-only: your received and sent messages, including their headers (such as subject and sender), labels, dates and content. In practice MyPAI reads, for the time window you choose (90 days by default), the messages in your Gmail Primary category (or, if there are none, your inbox) and your sent mail, and it reads whole conversations in memory so its rules can understand them. When certain features are switched on it also looks up the identifiers (not the content) of your recent messages in Trash and Spam;
• Google Calendar, read-only: the upcoming events on your primary calendar, for the future window you choose. (The permission itself covers every calendar you can access; MyPAI reads only the primary one.)

These permissions are read-only: MyPAI cannot send, change, delete or move anything. MyPAI never sees your Google password.

If your Google account has not been given access. MyPAI is in a private beta. If you sign in with an account that has not been given access, MyPAI reads your Google profile (email address and identifier) in memory only to decide that, tries to revoke the permission you just granted, and saves nothing about you in its database. MyPAI's own log entry records only that a sign-in was refused; the server's ordinary request log (§3.3) records the request like any other.

3.2 Microsoft Outlook

Outlook is not available in this release: Microsoft sign-in is switched off. Records from any earlier Outlook connection are kept but not used.

3.3 What MyPAI stores

MyPAI reads your messages in memory to work out what matters. We do not store message bodies, and we do not keep a copy of your mailbox. We keep only the records MyPAI needs to run the service and to remember its own judgements. Always:

• Your account identifiers: your Google email address and Google's stable identifier for your account.
• Connection tokens for your Google account — the access and refresh tokens Google gives MyPAI, when they expire and which permissions you granted — so MyPAI can read on your behalf. We keep them on our server, protected by access controls. The long-lived refresh token never leaves our server; the short-lived access token is also passed to your own browser at sign-in (§3.4). We do not give either token to anyone else. §9 says how long they are kept.
• Records of the items MyPAI assessed for you (it shows you most of them): for each item, an identifier made with a one-way hash from details of the item (including its subject line and the sender's domain), MyPAI's assessment of it, when it was first and last seen, and whether and when you marked it as handled or acknowledged it. A separate log of each time MyPAI looked keeps the time, MyPAI's assessment and the identifier Google assigns to the email conversation or calendar event concerned, so MyPAI can find it again.
• Your handled and acknowledged marks; the accounts you have connected (email address and when connected) with the personal or work label MyPAI sets for each; and the time of your last check.
• Sign-in session records: a one-way hash of your session token, your email address, when you signed in, when MyPAI last saw you and when the session expires and — recorded once, at sign-in — your IP address and browser details (user agent). They are kept for security investigation and are not used to decide what you see.
• Security logs: MyPAI's server records a small number of security events (for example, that a sign-in was refused or failed) as fixed event names, outcome codes and counts, designed never to include message content, tokens or full email addresses. They go to the server's process log (§9), which, like any server's, can also hold ordinary request and error lines, including IP addresses.
• Encrypted backups of the above, taken manually from time to time (§9); MyPAI's own automated scheduled backups are not yet in place.

When certain features are switched on (we turn features on and off from time to time), MyPAI also keeps:

• Commitment records: the type of commitment, when it falls due, its current state, a short description built from details in the email (for example the destination and date of a flight), the sending organisation's domain, a normalised copy of the subject line or calendar event title, the sender's email address (or, for a calendar event, the organiser's), booking or order reference numbers, and the identifiers that Google or the sender attached to the messages or events concerned, so MyPAI can recognise them again. For the evidence behind a commitment it keeps references to the messages or events (never their text) and when they were seen.
• Records of items MyPAI chose not to show you, and what happened next: for each conversation, its conversation identifier, a one-way hash of the subject, the sender's domain (never the full address), the message's date and, for some kinds of decision, whether it was unread and whether you had replied in the conversation when MyPAI chose not to show it, MyPAI's assessment and when it was made; and, on later checks, what you then did with that conversation — for example that you replied to it, starred it, marked it important, read it, archived it without reading, deleted it, marked it as spam, or left it unread for 30 days — with the time. MyPAI uses these only to check its own accuracy. Weekly counts of these, by sender domain, are kept for the same purpose.
• Notice records: the kind of notice MyPAI has surfaced (for example a bank, credit, tax, school or health-result notice) and when it was last shown.

Your mail also contains information about other people, such as senders and recipients. MyPAI reads it in memory only to find your commitments, and keeps about those people only what the records above describe (for example a sender's domain and, for some conversations and calendar events when the commitment features are on, their email address).

3.4 When you use the web app

• Requests: like any website, the servers that deliver MyPAI (Vercel for the web app, Render for MyPAI's server) receive your IP address and browser details with each request. Your browser also loads Google's sign-in script from Google whenever you use the web app, and fetches your profile picture from Google after you sign in, so Google receives your IP address and browser details too.
• mypai_session cookie: keeps you signed in. It is set by MyPAI's server, is HTTP-only and Secure, and holds a random token of which our database keeps only a one-way hash. It expires 30 days after you sign in (on the server a session also ends after 30 days without use, and in any case 90 days after sign-in).
• Sign-in state cookie: protects the sign-in step against forgery and expires after 10 minutes.
• Google access token in your browser: at sign-in, MyPAI's server passes your browser a short-lived Google access token (never the long-lived refresh token, which stays on our server). Your browser uses it once to ask Google for your name, email address and profile picture. On the normal sign-in path it is not written to browser storage. If you add another account, the tab holds that account's access token in session storage until the link completes, then clears it.
• Browser tab storage: the web app keeps your name, email address and profile picture (as Google returns them), your preferences (the categories you choose to watch or ignore, and the account view you chose), and temporary sign-in details in your browser's storage for the current tab. Closing the tab clears this storage.
• Google scripts: every page of the web app loads Google's sign-in script, and the app also includes Google's older Firebase library; MyPAI does not use either to sign you in. The Firebase library creates two small technical databases in your browser's storage (firebaseLocalStorageDb and firebase-heartbeat-database) that stay after you close the tab, and on some browsers (mobile browsers and Safari) it may also load a Google script and a page from Firebase's hosting address when the app opens. MyPAI does not use any of this to store anything about you, and uses no advertising, analytics, tag-manager or error-tracking scripts.
• MyPAI itself sets no analytics, advertising or tracking cookies.

3.5 From you directly

What you choose in MyPAI (acknowledging an item, your preferences) and anything you send us when you contact us.

4. Why we use it

We use your data only to:

1. Provide MyPAI: read your mail and calendar, find your commitments, show them to you and keep track of their state.
2. Check and improve MyPAI's accuracy for you: records of what MyPAI assessed and showed you and, when switched on, of what it chose not to show and what happened next, and aggregated figures about MyPAI's own performance, all serving the same features.
3. Keep MyPAI secure: sign-in sessions, security logs (events and counts, designed never to include content) and investigating abuse.
4. Protect against data loss: we take encrypted off-site backups manually; MyPAI's own automated scheduled backups are not yet in place.
5. Meet legal obligations and respond to your requests.

We do not use your data for advertising, sell it, or use it to train any AI or machine-learning model.

Legal bases: 1 and 2 — performing our contract with you (UK GDPR Art. 6(1)(b)); 3 and 4 — our legitimate interest in keeping the service secure and protecting data against loss (Art. 6(1)(f)); 5 — legal obligation (Art. 6(1)(c)). Your mail can contain sensitive ("special category") information (for example a health-result notice, which MyPAI can recognise as a kind of notice), and some derived descriptions may reflect it. We treat it exactly like all other data under this policy, use it only for the purposes above, and will delete any record you ask us to (§9).

5. How MyPAI uses information from Google (Limited Use)

MyPAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms:

• We use the Gmail and Calendar data MyPAI reads only to provide and improve MyPAI's own features: finding the commitments in your mail and calendar and showing them to you. These features are the MyPAI product you see.
• We do not transfer your Google data to anyone else, except: to the hosting providers that run MyPAI for us (§8); where necessary for security, such as investigating abuse; where the law requires it; or, only with your explicit prior consent, as part of a merger, acquisition or sale of assets.
• We do not use your Google data for advertising, and we never sell it.
• We do not share your data with advertisers, data brokers or AI companies.
• We do not use your Google data to create, train or improve any machine-learning or artificial-intelligence model. MyPAI's decisions are made by deterministic software we wrote, not by a model, and MyPAI does not send your Google data to any AI model or AI provider.
• We do not let people read your Google data, except: with your clear agreement for the specific items concerned; where necessary for security; where the law requires it; or as aggregated, anonymised figures used to run the service.
• These commitments apply to the data we read and to everything we derive from it, including our own records and backups.

6. What MyPAI works out from your mail (derived commitments)

• MyPAI's rules turn what they read into records of its own judgements: what kind of item it is (for example a reply you owe, a booking or a payment), when it falls due, and its current state.
• These are MyPAI's automated, deterministic assessments, made by rules we wrote — not by an AI model and not by a person. They decide what MyPAI shows you. You can always read your own mail directly.
• They are personal data about you. Everything in this policy applies to them, including the Limited Use commitments in §5.
• What they contain is listed in §3.3. When some features are switched on they include short text derived from your mail — a normalised subject line, and short descriptions built from details such as a destination or a date.
• In MyPAI only you see them. We share them with no one else except as §5 and §8 describe.
• If you think a record is wrong, tell us (§14) and we will correct or delete it.

7. Connecting an AI assistant

Today: MyPAI does not offer any connection to an AI assistant, and MyPAI sends your data to no AI provider. If we ever offer one, we will update this policy before it is available.

8. Who else touches your data

These four are the only providers that receive your Google data or MyPAI's records of it:

• Microsoft Outlook is not available in this release.
• We use no analytics, advertising, error-tracking, payment or AI provider today, and we do not share your data with advertisers, data brokers or AI companies. We will update this list before any new provider receives your data.

International transfers. Some of these providers are based outside the UK or may process data there. Where they do, they state that they rely on the UK Extension to the EU-US Data Privacy Framework (where the provider is certified under it) or on standard contractual clauses with the UK International Data Transfer Addendum.

9. How long we keep it, deleting it and getting a copy

How to manage or delete your data today

1. Stop MyPAI reading your mail. In your Google Account, open Security, find the list of third-party apps and services with access to your account (Google may reword these screens), choose MyPAI and remove its access. Google then stops honouring MyPAI's tokens. This does not delete anything MyPAI has already stored.
2. Log out of MyPAI to end your session on that browser. This deletes the session record; it keeps your stored connection tokens.
3. Additional accounts. If you linked an additional account, Disconnect in MyPAI's account menu deletes that account's stored tokens and its entry in your account list, but not the records already made about its mail. It does not itself ask Google to revoke access, so also remove MyPAI in that Google Account.
4. The account you sign in with. MyPAI has no button to disconnect it or delete its data, and no self-service account deletion or export yet.
5. Delete your MyPAI records, or get a copy. Email the privacy contact in §14. We will delete the records MyPAI holds about you, or send you a copy in a structured, machine-readable format, within one month and confirm when it is done. We may first need to confirm your identity.

Deleting a record removes it from our live systems. Copies inside older encrypted backups and in our host's disk snapshots remain until those backups are deleted or the snapshots expire (see Backups below).

How long we keep each kind of record

• Connection tokens: kept until you ask us to delete your account or, for an additional account you linked, until you disconnect it in MyPAI. If you remove MyPAI's access in your Google Account, or Google stops honouring a token for another reason (for example, Google expires an app's refresh tokens after seven days while the app is in Google's testing status), the tokens stop working but stay stored until they are deleted. Logging out ends your MyPAI session but does not delete the tokens.
• The records in §3.3 (the items MyPAI has assessed for you, your marks and account labels and, when switched on, commitment, not-shown and notice records): kept for as long as you have a MyPAI account. Removing MyPAI's access stops MyPAI reading your mail but does not delete these records; disconnecting an additional account deletes that account's stored tokens and its entry in your account list but not the records already made about its mail; deleting your account deletes them. We do not currently delete them on a timer.
• Sign-in sessions: the cookie lasts 30 days from sign-in, and on the server a session ends after 30 days without use and in any case 90 days after sign-in. Logging out deletes the session record, and an expired session's record is deleted if its cookie is presented again, but there is no scheduled clean-up, so other expired records stay until your account is deleted. A session record holds a one-way hash of the session token, your email address, times, and the IP address and browser details recorded when you signed in.
• Security logs: MyPAI's server writes its security events, and ordinary request and error lines, to its process log. Our host, Render, collects that log and keeps it under the log retention that applies to our hosting plan; we have not set a separate period.
• Backups: taken manually for now; encrypted with a key kept separate from the database before they are uploaded. A record you delete stays inside older encrypted backups until we delete those backups. We have not yet set a fixed retention period for backups; we keep them until we delete them. Separately, our host, Render, takes automatic daily snapshots of the server's disk and keeps them for at least seven days; a record you delete can remain in a snapshot until it expires.

10. Your rights

Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, and give it to you in a portable format.

• Stop MyPAI reading your mail at any time: remove MyPAI's access in your Google Account's security settings (Google then stops honouring MyPAI's tokens), or ask us to delete your account. The steps are in §9.
• Make a request: contact us (§14). We reply within one month and may first confirm your identity, so that nobody else can act on your account.
• Complain: you can complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to put things right first.

11. Security

What is in place today:

• Read-only Google permissions: MyPAI cannot change your mailbox.
• Encrypted connections (HTTPS) between your browser, MyPAI and Google.
• Sign-in sessions held on our server; the session cookie is HTTP-only and Secure, and our database stores only a one-way hash of the session token itself (the session record also holds the details listed in §3.3).
• Access to MyPAI is limited to Google accounts that have been given access: a sign-in from any other Google account is refused before anything about it is saved (§3.1).
• No message bodies are stored (§3.3).
• Security logging designed never to record message content, tokens or full email addresses.
• Encrypted off-site backups, taken manually (not automatic), encrypted with a key kept separate from the database.

We do not claim any security certification (such as SOC 2 or ISO 27001). MyPAI has not yet completed Google's verification for restricted Gmail access or the annual independent security assessment Google requires for it (CASA).

If a personal data breach is likely to put you at risk, we will tell you without undue delay, and we will notify the ICO within 72 hours where the law requires it.

12. Children

MyPAI is for adults. You must be 18 or over to use it.

13. Changes to this policy

The date of the latest update is shown at the top of this page, and we record every change. We will tell you about material changes at least 14 days before they take effect, by email.

14. Contact

• Privacy questions and requests: andrewostyles@gmail.com
• Post: MY PAI LTD, registered office: Flat 4 Marchwood House, Kintbury Close, Fleet, England, GU51 1AZ
• Regulator: Information Commissioner's Office, ico.org.uk.