Privacy Policy

This English version is provided for users outside Türkiye. For users in Türkiye, the Turkish version prevails if the two differ.

This Privacy Policy explains how mayAssistant collects, uses and protects your personal data when you use mayassistant.com and the mayAssistant apps (the "Service"). It provides the information required by the EU General Data Protection Regulation (GDPR, Articles 13 and 14) and by Turkish Law No. 6698 on the Protection of Personal Data (KVKK). Users in Türkiye will find the KVKK details in the KVKK Information Notice.

1. Controller

Yusuf Efe Mayda, the developer of mayAssistant ("we", "us"). mayAssistant is not a company; we provide the Service as an individual based in Istanbul, Türkiye. Contact: info@mayassistant.com. Further identification details are on the Imprint page.

2. Data we collect

• Account data: name and email address; your password is stored only as an irreversible hash (PBKDF2). If you sign in with Google or Apple, the email address and name verified by that provider.
• Audio and video recordings: meeting audio you upload or record in the app and, if you choose, screen recordings. These recordings may contain personal data of other people, such as the voices of meeting participants; informing them and obtaining any required consent is your responsibility.
• Derived content: transcripts, speaker-separation data, summaries and action items.
• Usage and security data: processed minutes, job history, session and audit logs (including IP address) and, in the Windows app, the computer name.
• Subscription: Pro is purchased through the App Store; Apple takes the payment and your card and billing details never reach us. From Apple we receive only the subscription status (product, renewal and expiry dates, transaction ID).
• Email accounts you connect: sender, subject and content of incoming emails, and the summaries and tasks derived from them.
• mayAI chats, meeting preparations and contacts: what you write, the answers, the information read to produce them, and the contact records you create.
• Calendar data (only if you connect Google Calendar or a Microsoft Outlook / Teams calendar): see section 9.
• Consent records: when you accepted the Terms of Use, gave or withdrew the AI permission, and the version of the text shown.
• Website statistics: only with your cookie consent (see the Cookie Policy).

3. Purposes and legal bases

Your data is not used for training. Neither we nor our service providers use your recordings, transcripts or summaries to train AI models; this option is disabled with our providers.

We do not send marketing emails. Your account data is needed to conclude the contract; without it we cannot provide the Service. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

4. Recipients and international transfers

To run the Service, your data is passed to the following service providers:

Data may also be disclosed to competent public authorities where we are legally required to do so.

Transfers outside the EU/EEA and Türkiye. Before any data is sent to the AI providers, the mobile and Windows apps ask for your explicit permission on first sign-in. Transfers to these providers are based on that explicit consent (GDPR Art. 49(1)(a); KVKK Art. 9), given after you have been informed of the possible risks in the Explicit Consent text. We are also working to put standard contractual clauses in place with these providers (the European Commission's Standard Contractual Clauses and the Turkish standard contracts under KVKK Art. 9) and will update this page when that is complete. If you do not give permission, recording, file upload, the meeting assistant, email analysis and mayAI are not available. The time you gave permission is stored in your account, and you can withdraw it in the app under Settings › Account.

Speaker separation and acoustic quality checks run on our own servers; audio is not sent to a third party for these steps. With our providers, the option to use data for model training is disabled. Business customers can find the named list of sub-processors in our Data Processing Agreement.

5. How long we keep your data

• Audio and video recordings: up to 2 years from the recording date on Pro and 3 months on Free (30 days of extra time when moving from Pro to Free). They are deleted automatically when the period ends, and a notice appears on the meeting's detail screen during the last 30 days. You can delete them earlier.
• Transcripts and summaries: until you delete them (they remain even after the audio recording is deleted).
• When you delete a meeting, its audio, video, transcript, summary and linked tasks are deleted immediately and permanently; they disappear from backups within 30 days at the latest.
• Invoice, job and audit records: for the periods required by law.
• Calendar connection tokens (Google, Microsoft): until you remove the connection or delete your account. Calendar events are not stored as a separate record; those read for a question you ask mayAI are kept with that chat's history, and the details of a meeting you start preparing for are kept with the preparation record (see section 9).
• mayAI chat history (your questions, the answers and the information read for them): until you delete your account.

Details are in the Retention and Deletion Policy.

6. Your rights

Under the GDPR you have the right to access your data (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict processing (Art. 18), to data portability (Art. 20), and to object to processing based on our legitimate interests (Art. 21). Where processing is based on your consent, you can withdraw it at any time; this does not affect the lawfulness of processing before the withdrawal (Art. 7(3)).

To exercise your rights, write from the email address registered to your account to info@mayassistant.com. We reply free of charge within one month. You can also delete your account and all your data yourself in the app under Settings › Account › Delete account.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State where you live or work or where you believe the infringement took place (Art. 77 GDPR). Users in Türkiye can apply to the Personal Data Protection Board (KVKK Kurulu); their rights under KVKK Art. 11 are listed in the KVKK Information Notice.

7. Children

The Service is intended only for people aged 18 or over. We do not knowingly collect personal data of children.

8. Security

Data is encrypted in transit with TLS; passwords are stored irreversibly; every operation that changes state is written to an audit log. No method is 100% secure; in the event of a breach we meet our legal obligations to notify the authorities and you.

9. Google Calendar and Google user data

If you choose to connect your Google Calendar, mayAssistant requests read-only access (scope: https://www.googleapis.com/auth/calendar.events.readonly) and uses it for three purposes: when you tap a day in the calendar on the app's "İşlerim" (My Tasks) screen, the app shows you that day's meetings (title, time, attendee names and meeting link); when you yourself tap Prepare on a meeting, the app opens a preparation chat for that meeting; and when you ask the in-app assistant mayAI a question about your calendar (for example "what do I have tomorrow?"), the meetings of the days your question covers are used in the answer.

• Data accessed: the calendar events of the day you select, fetched from Google at the moment you tap it. When you ask mayAI a calendar question, the events of the days your question covers (title, time, attendee names, meeting link) are fetched at that moment and used only for that answer. To mark which days have meetings in the calendar's month view, only the dates of that month's events are used; these dates are kept in memory for 5 minutes and are not saved.
• Data stored: we do not store calendar events as a separate record. There are two exceptions: (1) a meeting preparation you start yourself: the title, start time and calendar ID of the meeting you tapped Prepare on are stored with your preparation record; (2) your mayAI chat history: the questions you ask mayAI and its answers are stored in your chat history, together with the calendar event details read to produce those answers (title, time, attendee names, meeting link), until you delete your account, so that you can reopen and continue a conversation. To keep the connection working we also store the OAuth refresh token issued by Google and the connected account's email address, encrypted.
• Sharing: Google user data reaches an AI service in two cases only: (1) when the preparation chat generates an answer to your question, the title and start time of the meeting you are preparing for are sent, together with the sources you selected; (2) when you ask mayAI a question about your calendar, the events of the days your question covers (title, time, attendee names, meeting link) are sent solely to generate that answer. In both cases the data is sent to our AI service provider (USA), which does not use it for model training; every option in our account with that provider that would allow data sharing or training is disabled. Calendar events are never sent to AI unless you ask. Apart from this AI provider, Google user data is not shared with third parties, sold, used for advertising, or used to train AI/ML models. Our staff do not read this data; it may be accessed only at your request, for security purposes or where required by law.
• Revoking access: you can disconnect at any time in the app under Settings › Calendars; the stored token is deleted and the grant is revoked at Google. You can also remove access on your Google Account's third-party connections page. Disconnecting does not delete the preparation records you created; you can ask for them to be deleted at info@mayassistant.com. You can delete your mayAssistant account yourself in the app under Settings › Account › Delete account; the token, preparation records and mayAI chat history are deleted with it and the grant is revoked at Google. You can also ask for your chat history to be deleted at info@mayassistant.com.
• mayAssistant's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft Outlook / Teams calendar

The same rules apply if you connect a Microsoft calendar. mayAssistant requests read-only access (Microsoft Graph Calendars.Read, plus User.Read for the account's email address) and shows you only the meetings of the day you select (title, time, attendee names and the Teams join link). The exceptions described above apply here too: meeting preparation, and calendar questions you ask mayAI (the events of the days your question covers are sent to our AI service provider solely for that answer and are kept in your chat history). Otherwise calendar events are not stored, not sent to AI services and not shared with third parties; only the refresh token issued by Microsoft and the connected account's email address are stored, encrypted. You can disconnect at any time under Settings › Calendars; the token is deleted. You can also revoke access on your Microsoft account's apps page.

10. Changes and contact

When we change this policy, we publish the new version on this page with a new date and, for significant changes, notify you in the app or by email. Questions: info@mayassistant.com — identification details on the Imprint page.