1. Who is responsible
The controller for the processing of your personal data in MySpace is matd ag, Sonnmattstrasse 11, 9532 Rickenbach TG, Switzerland, UID CHE-152.170.242. Contact for all data protection questions: marcel.kuhn@matd.ch.
This policy applies to the product MySpace (myspace.matd.ch and sign-in at matd.ch/login). For the website matd.ch, the privacy policy at https://www.iubenda.com/privacy-policy/17832966 applies.
2. Two roles: your data and the data of your customers
a) Your own data as a customer: here we are the controller. This covers your account, your company, your subscription, your usage and your requests to us. This privacy policy applies to it.
b) Data you process through MySpace: here we are your processor. This includes, for example, emails in your mailbox, comments on your channels, your contacts and leads, and photos, videos or voices of people you upload. You are the controller for this data. We process it only on your instructions and under the data processing agreement annexed to the Terms. You inform the people whose data you process in the product yourself.
3. What data we process
| Category | Examples | Source |
|---|---|---|
| Account | email address, name, password (only as a hash at Supabase), language | you; Google when signing in with Google |
| Company and roles | company name, offers, members and their roles (owner, campaign manager) | you |
| Subscription and payment | plan, subscription status, period end, invoices; Stripe collects billing address and payment method | you, Stripe |
| Content | texts, images, videos, voice recordings, drafts, approvals, brand material | you; created by the AI assistants |
| Connected accounts | access keys (tokens) for Instagram/Facebook, LinkedIn, TikTok, YouTube, Microsoft 365, HeyGen | the platform, when you connect the account |
| Usage and AI consumption | which AI tasks ran, cost per task, error logs | the product |
| Technical data | IP address, browser, time of access, captcha check | your device |
| Communication | emails to us, system and approval emails to you | you, the product |
4. Purposes and legal bases
| Purpose | Legal basis (GDPR; in Switzerland the FADP applies without a formal legal basis) |
|---|---|
| Running the account, providing the product, executing AI tasks | contract (Art. 6(1)(b)) |
| Billing the subscription, keeping invoices | contract; legal obligation (lit. c; Art. 958f Swiss CO) |
| Security, preventing misuse (captcha, AI budget, access rights) | legitimate interest (lit. f) |
| System and approval emails, account notices | contract |
| Finding errors, improving the product (without profiling) | legitimate interest (lit. f) |
We do not sell personal data. We do not use advertising or analytics trackers in the product.
5. AI processing
5.1 When you trigger an AI task, MySpace sends content to the AI models of the providers listed in section 6. Examples are your inputs, your offers, scripts, images or the text of an email Nora is to reply to (up to 8,000 characters). What you say to Ava is converted into text for this purpose.
5.2 The model receives only what it needs for the task. Your email signature, for example, is added only after the AI response. It never goes to a model.
5.3 According to their terms for API customers, the AI providers do not use the data to train their models. We do not train our own models with your data.
5.4 AI results are drafts. No decision with legal effect is made automatically (Art. 21 FADP, Art. 22 GDPR). Published posts carry an AI notice, see matd.ch/ki-transparenz.
6. Recipients and services
We use the following services. Unless stated otherwise, they process data on our behalf (sub-processors).
| # | Service | Purpose | Data | AI model | Location |
|---|---|---|---|---|---|
| 1 | Supabase (Supabase Inc.) | database, sign-in, file storage, sign-in emails | all product data | no | Zurich, Switzerland (company based in the USA) |
| 2 | Vercel (Vercel Inc.) | hosting, server functions, scheduled tasks | all data during processing, access logs | no | server functions in Frankfurt (EU), delivery via Vercel's worldwide network (company based in the USA) |
| 3 | Stripe | payments, subscription, invoices, customer portal | owner's email, company name, billing address, payment method, optional UID | no | Ireland (EU), partly USA |
| 4 | Anthropic (Anthropic PBC) | language model Claude: Ava, Mia, Nora (draft replies), proofreading | inputs, content, email text for draft replies | yes | USA |
| 5 | OpenAI (OpenAI) | speech recognition and speech output (Ava), text generation | voice recordings, transcripts, texts | yes | USA |
| 6 | Google Gemini / Veo (Google) | generating images and videos (Mia) | prompts, brand images, reference images | yes | USA/worldwide |
| 7 | ElevenLabs | voice for videos (speech output) | scripts, voice data | yes | USA |
| 8 | HeyGen | avatar videos | scripts, avatar image or video, HeyGen access | yes | USA |
| 9 | Resend | system and approval emails | email address, email content | no | USA |
| 10 | Cloudflare Turnstile | captcha at sign-up and sign-in | technical browser data, IP address | no | USA/worldwide |
Platforms you connect yourself. These platforms are separate controllers. Their privacy policies apply. We only send them what you approve, or only read what you allow:
| # | Platform | Use in the product |
|---|---|---|
| 11 | Microsoft 365 (Microsoft Graph) | Nora reads emails and calendar from your mailbox and sends emails you approve. We do not store emails, only their processing status. |
| 12 | Meta (Instagram, Facebook) | publishing posts, showing comments. We do not store comments. |
| 13 | publishing posts | |
| 14 | TikTok | publishing videos |
| 15 | Google (YouTube, Google sign-in) | publishing Shorts; sign-in with a Google account |
Authorities and third parties: We only disclose data where the law requires it or you ask us to.
7. Transfers abroad
Your data is stored in the database in Zurich, and the server functions run in Frankfurt (EU). Data goes to the USA only to services based there: the AI providers, the email service Resend and the captcha service Cloudflare, plus the platforms you connect yourself. We transfer data to the USA only with one of these safeguards:
- the provider's certification under the Swiss-U.S. Data Privacy Framework or the EU-U.S. Data Privacy Framework, or
- the European Commission's standard contractual clauses, recognised by the FDPIC, with the Swiss amendments.
8. How long we keep data
| Data | Period |
|---|---|
| Account, company, content | as long as the account exists |
| Drafts that were not approved | deleted after a period you can set (default 14 days) |
| After a failed payment | Pro continues for 3 more days, then the company switches to the Free plan. Access remains open and the data is kept. If nobody from the company has signed in 60 days after the switch, we permanently delete the company and its data (warning by email 7 days in advance). |
| Emails from your mailbox, comments | not stored, only displayed live; only the processing status is stored |
| Access keys of connected accounts | encrypted (AES-256-GCM) until you disconnect or the account is deleted |
| Technical log of scheduled tasks | 30 days |
| Invoices and accounting records | 10 years (Art. 958f Swiss CO) |
9. Deleting your account
You can have your account deleted at any time. To do so, send an email to marcel.kuhn@matd.ch. We delete the account with all data within 30 days. This excludes invoice records we are required to keep.
10. Your rights
You have the right to access, rectification, erasure, restriction, data release and portability, and objection (Art. 25–28, 32 FADP; Art. 15–21 GDPR). You can withdraw consent at any time. Write to marcel.kuhn@matd.ch. We reply within 30 days.
You can lodge a complaint with a supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), in the EU with the authority of your place of residence or work.
11. Cookies
The product only sets technically necessary cookies, mainly for sign-in. At sign-up and sign-in, Cloudflare Turnstile checks whether a human is filling in the form. The product sets no advertising or analytics cookies. For the website matd.ch, iubenda's cookie policy applies: https://www.iubenda.com/privacy-policy/17832966/cookie-policy.
12. Security
Data is transmitted encrypted (TLS). We additionally store access keys to your accounts encrypted (AES-256-GCM). Access rules in the database ensure that each company only sees its own data. Our own staff access customer data only when necessary for operations or support.
13. Changes
We update this policy when the product or the law changes. The published version applies. We inform you of material changes by email or in the product.