MYSSLELegal
Privacy notice
Effective 17 October 2026 · Version 1.5The service owner must set the controller name, postal address, and privacy email before public launch. See .env.example. A controller cannot satisfy GDPR transparency duties without these details.
Myssle does not sell personal data or use behavioural advertising. Optional external media remains blocked until you allow it, and you can export or delete your account data from Settings.
1. Who controls your data
Myssle is the controller responsible for personal data processed through Myssle.
- Postal address
- Not configured
- Privacy contact
- Privacy contact not configured
2. Data we process, purposes, legal bases, and retention
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account details: email, name, account ID, acceptance records, authentication and security records | Create and secure your account, sign you in, and send verification or password-reset messages | Performance of our contract; legitimate interests in service security; compliance with legal obligations where applicable | For the life of the account, then deleted or de-identified, subject to configured security-log and backup cycles |
| Onboarding profile: broad education level, main study goal, and features you want help with | Set up and personalise your starting workspace. We do not ask for your institution name, grades, or exact age. | Performance of our contract | Until you delete your account |
| Study content: subjects, schedules, rooms, teacher names, links, materials, tasks, tests, notes, priorities and completion state | Provide the planning features you request | Performance of our contract | Until you delete the content or your account |
| Private study-team data: team name, membership, display name, invite code, shared snapshots and import preferences | Let invited classmates exchange independent copies of study content | Performance of our contract | Until the team, shared offer, membership, or account is deleted; copies imported by another student remain in that student's workspace |
| Focus-session statistics and notification preferences | Provide focus statistics and reminders you enable | Performance of our contract; consent for browser notifications | Until you delete the data/account or change the preference |
| Text you submit to Quick add or Describe your subject, AI draft responses, processing status, reference date, timezone and selected subject | Add subjects, tasks and tests, reopen your private agent request history, and fill subject forms | Performance of our contract for the optional feature you request | Accepted floating-agent submissions and their AI drafts are saved in your private account until you delete the message, your study data, or your account. Inline subject-form requests are not stored in request history; their text stays in memory until the form closes, disabling, sign-out or reload. Disabling the helper hides it without deleting saved history. Unsubmitted text and local draft edits stay in memory until reset, disabling, sign-out or reload. External providers apply their own retention policies. |
| AI request identifiers, account reference, timestamps, cost reservations and import identifiers | Enforce usage limits, the shared spending cap and duplicate-safe imports | Legitimate interests in service security and reliability | Import identifiers until study-data/account deletion; accounting metadata is kept for budget auditing, with account references removed on account deletion. |
| Technical data such as IP address, device/browser information, request time and diagnostic or security logs | Deliver, troubleshoot, protect and prevent abuse of the service | Legitimate interests in reliable and secure operation | Only as long as reasonably needed under the configured provider retention and backup cycles |
| Public-calendar fields you choose to share | Provide your read-only public calendar link | Performance of our contract for user-directed sharing | Until sharing is disabled or the relevant account is deleted |
| Consent choices and requested interface preferences stored in your browser | Remember your privacy choice and settings, and demonstrate the choice presented | Compliance with privacy obligations; consent for optional external media; requested storage for user-selected settings | Consent choice for up to 180 days; other preferences until removed, reset, or browser data is cleared |
Required account and study data is needed to provide Myssle. If you do not provide it, the relevant feature may not work. Browser notifications, public sharing, and YouTube are optional.
Please do not enter sensitive personal data, confidential school records, or information about other people unless you have a lawful reason and authority to do so.
3. Where data comes from
Most data comes directly from you when you register, create study content, change settings, or contact us. We also receive technical data automatically from your browser and infrastructure providers. Other members of a private study team may provide your display name or share study snapshots with you.
4. Service providers and recipients
We share data only as needed to run the service, follow your sharing instructions, comply with law, protect rights and security, or complete a business transfer subject to appropriate safeguards.
- Supabase provides authentication, database, and backend infrastructure.
- OpenRouter and Alibaba Cloud process the submitted text, subject names/codes, reference date and timezone only when you use Quick add. Describe your subject sends only the course text you submit. The configured model is Alibaba Qwen3.8 Flash. No other workspace content is sent. Provider retention and processing locations depend on their service policies; this feature does not guarantee EU-only processing. See OpenRouter’s privacy policy and Alibaba Cloud’s privacy policy.
- Cloudflare provides web hosting and delivery infrastructure.
- Email delivery providers process addresses and message-delivery data when transactional or reminder email is enabled.
- Google/YouTube receives device and usage data only after you allow external media and connect the optional player. Google's own terms and privacy notice then apply.
- Private study-team members can see your display name and snapshots you deliberately share. Your email address and personal completion state are not shared.
- People with a public link can view the calendar fields associated with that link until you disable sharing.
We do not sell personal data and do not use it for behavioural advertising.
5. International transfers
Some providers may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, the European Commission's Standard Contractual Clauses, and supplementary safeguards. Contact us for information about the safeguard relevant to your data.
7. Your sharing choices
Your personal workspace is private by default. Private-team sharing happens only when you choose a team and publish a snapshot. Public calendar sharing must be enabled in Settings, and anyone with the resulting link may view the exposed schedule fields.
Review content before sharing. Removing a team offer does not delete copies another student already imported, and information copied from a public calendar may remain outside Myssle's control.
8. Your rights
Subject to GDPR conditions and exceptions, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. You are also entitled not to be subject to qualifying solely automated decisions.
Myssle does not make decisions producing legal or similarly significant effects through automated processing. You can export your account data or request deletion in Settings. For other requests, contact Privacy contact not configured. We normally respond within one month and may ask for information needed to verify your identity.
9. Account deletion and backups
Account deletion is designed to remove the authentication account and application data linked to it. Data may remain temporarily in restricted backups or security records until the applicable provider cycle completes, and may be retained where law requires it or where needed to establish, exercise, or defend legal claims. Content independently imported by another student belongs to that student's workspace and is not deleted with your account.
10. Complaints
You may complain to the supervisory authority where you live, work, or believe an infringement occurred. In Slovakia, this is the Office for Personal Data Protection of the Slovak Republic. We would appreciate the opportunity to address your concern first.
11. Children
Myssle is not directed to children under 16 and we do not knowingly accept their accounts. A parent or guardian who believes a child provided data without valid authorisation should contact us.
12. Security and incidents
We use access controls, encrypted transport, row-level database rules, least-privilege access, and account authentication. No system is completely secure. Where a personal-data breach creates a legal notification duty, we will notify the competent authority and affected people as required.
13. Changes
We may update this notice when the service, providers, or law changes. Material changes will be presented in the app or by email where appropriate. The effective date and version above identify the current notice.