Privacy policy

Controller

The controller responsible for processing your data on this website and in the MySecretary.cloud service is:

• Auryan Ltd. [OFFEN: confirm operating company]
• [OFFEN: registered address]
• Email: support@mysecretary.cloud

[OFFEN: data protection officer – check whether one must be appointed and, if so, give contact details]

What this policy covers

This policy describes which data we process when you visit this website, try the simulation and reserve an address for your assistant. The assistant service itself launches later; what it processes is described in the section “The assistant service after launch”.

Visiting the website

The website is hosted by Vercel. Each time a page is requested, Vercel processes technically necessary information: your IP address, date and time, the address requested, browser and operating system (user agent) and the previously visited page, if your browser sends it. This is needed to deliver the website and keep it secure.

The legal basis is our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR). [OFFEN: retention period of access logs at Vercel]

We serve our fonts ourselves. Loading the page sends no requests to Google or any other font provider.

Audience measurement and cookies

We use PostHog (EU cloud) to measure how the page is used. Exactly these events are sent to PostHog, each with the language of the page:

• the page being opened, with the landing page variant and the mode the page is running in
• the steps of the simulation: start, whether a last name was entered for the assistant (yes or no, never the name), the scenario chosen, the replies and decisions picked, and completion with the number of emails the assistant wrote
• use of the calculator, as broad ranges only, never the figures you enter
• viewing the pricing section, switching between monthly and yearly billing, and interest in the Team plan
• questions opened, by their number only
• clicks on the reservation button at the end of the page
• starting, submitting and confirming a reservation – on submission and confirmation with your country and preferred language –, the notice that an address is already taken, and sharing the business card

PostHog also records technical information: the page opened, without parameters (address and path only), browser, operating system, device type, screen size, browser language and time zone, and your IP address, from which PostHog derives an approximate location. [OFFEN: switch off IP address storage at PostHog or state how long it is kept] We remove names, email addresses, the referrer, UTM parameters, click IDs and the identifier of your reservation before sending; they never reach PostHog.

Without your consent, measurement runs without cookies and without storing anything in your browser: the identifier that groups events together only exists while the page is open. [OFFEN: legal basis of cookieless measurement – Art. 6(1)(f) GDPR, section 25 TDDDG]

With your consent, PostHog stores a pseudonymous identifier in a cookie and in your browser’s local storage and session storage, so that repeat visits can be recognised. The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG).

We store your decision – consent or not – in your browser’s local storage, so that the notice does not appear on every visit.

You can withdraw your consent at any time with effect for the future: the “Cookie settings” link at the bottom of every page reopens the notice, where you choose “Without cookies”. We then delete the identifiers PostHog stored in your browser and measure without cookies again.

Simulation

The simulation runs entirely in your browser. We do not transmit the names you enter there – unless you carry them over into the reservation form.

If you reserve an address after the simulation, we store with your reservation which scenario you chose and which replies you picked when you switched roles (your simulation choices). We do not ask for separate consent for this. The legal basis is our legitimate interest in understanding which scenarios convince visitors, so that we can improve the page and the product (Art. 6(1)(f) GDPR). Your simulation choices are deleted together with the reservation.

Calculator

We only store the figures you enter in the calculator if you explicitly agree in the reservation form. They help us recognise heavy users. The legal basis is your consent (Art. 6(1)(a) GDPR). Without your agreement, the figures stay in your browser.

Reserving an address on the waiting list

When you reserve an address, we store:

• your email address and your first and last name
• the first and last name and the form of address of your assistant, and the part of the address before the @ that you chose
• your country and your preferred language
• your calendar provider, if you tell us
• the figures from the calculator, if you agree
• your simulation choices (see “Simulation”)
• the referral data (see “Referral data”)
• the time of the reservation and of the confirmation

We use this information to hold the address for you, to record your entitlement to the founder price and to tell you about the launch. Your country and language help us decide which market and which language come next. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR); for country, language and calendar provider, it is our legitimate interest in planning the service (Art. 6(1)(f) GDPR).

Confirmation by email (double opt-in): after you submit the form, you receive an email with a confirmation link. If you do not confirm within 48 hours, we automatically delete the unconfirmed reservation together with all information stored with it, and release the address again. If the confirmation email cannot be sent, we delete the reservation immediately.

We keep confirmed reservations for as long as the reservation is valid and your entitlement to the founder price exists. [OFFEN: deletion period for confirmed reservations that never become an account] You can ask us to delete your reservation at any time by emailing support@mysecretary.cloud.

Referral data

When you first open the page, we note in your browser’s session storage where you came from: the previously visited page (referrer), a click ID from an advert (gclid, gbraid, wbraid or msclkid), the campaign’s UTM parameters (source, medium, campaign, term, content), the landing page variant you arrived on and, if present, a referral code (ref). Session storage is cleared when you close the tab. We do not pass this referral data on to PostHog. [OFFEN: storing referral data in session storage before any consent – check permissibility under section 25 TDDDG]

Only if you reserve an address do we transmit this referral data and store it with your reservation. We do not ask for separate consent for this. The legal basis is our legitimate interest in knowing which campaigns and recommendations lead to reservations, so that we spend our advertising budget sensibly (Art. 6(1)(f) GDPR). The referral data is deleted together with the reservation.

[OFFEN: add the transfer of conversions to Google Ads before the campaign starts]

Emails and support

We send the confirmation email and the email after confirmation via Mailgun (EU region). Replies to these emails go to support@mysecretary.cloud and are forwarded to a Microsoft 365 mailbox where we handle support requests.

We write to you in German or English. Support is available in German and English only.

Your assistant’s business card

After confirmation, we generate a business card as an image. It shows your assistant’s name, her address and your name (“Assistant to …”). The card can be opened via a link containing a random identifier; anyone you share this link with can see it. [OFFEN: invalidate cached cards when a reservation is deleted]

Service providers (processors)

We use the following service providers. They process data on our behalf and on our instructions. [OFFEN: review and conclude data processing agreements under Art. 28 GDPR with every provider]

Already today, for the website and the waiting list:

• Supabase (database; Frankfurt): all reservation data; after launch, also account data, scheduling requests and the encrypted access keys to your calendar.
• Vercel (website hosting; EU regions): access logs and all data that passes through the website when pages are requested and forms are submitted.
• Mailgun (sending and receiving email; EU region, Frankfurt): sender and recipient addresses, subject lines, contents and delivery logs of emails.
• PostHog (audience measurement; EU cloud): usage events without real names, a pseudonymous identifier, technical information about browser and device, IP address and approximate location, landing page variant, and for reservations country and preferred language.
• Microsoft 365 (support mailbox; EU): your emails to support.

In addition, once the assistant service launches:

• AWS Bedrock (language model; Frankfurt): excerpts from emails, names and addresses of the people involved and scheduling details, processed in transit to understand replies and draft emails.
• Stripe (billing and VAT; EU and USA): name, billing address, revenue and VAT number. Your payment details are held by Stripe, not by us.

You connect your Microsoft 365 or Google calendar yourself. Through that connection, we only read when you are free or busy, and create the meetings that have been agreed. [OFFEN: clarify the role of Microsoft and Google for the calendar connection]

Transfers to the United States: all the providers named are US companies or belong to a group with a US parent company. Even where data is stored in the EU, access from the United States – for example by the parent company or by US authorities – cannot be ruled out. Where data is transferred to the United States, we rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework if the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses. [OFFEN: check certification and transfer mechanism for each provider]

The assistant service after launch

After launch, your assistant processes emails on which she is in To or CC, and the free/busy times of your calendar. She does not read the titles, attendees or contents of existing appointments, and she has no access to your inbox. In doing so, she processes the names, email addresses and scheduling details of the people she arranges a meeting with. We keep the full content of incoming emails for 30 days and then delete it. [OFFEN: legal confirmation of the 30-day period]

[OFFEN: draft this section before the assistant service launches – in particular the legal basis for processing data of participants who have no contract with us, and the privacy notice in the assistant’s emails]

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on our legitimate interest (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). An email to support@mysecretary.cloud is enough.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state where you live or work. [OFFEN: supervisory authority competent for us]