AI & Privacy Policy

1. What Data We Collect and Access

myaisecy is designed to process only the information needed to provide scheduling, calendar, reminder, and digest services.

What myaisecy does and does not see. myaisecy only processes messages you (or senders you have approved) send to your personal myaisecy email address. We do not read your Gmail inbox or any other email account.

Email content

• Email headers such as sender, recipient, subject line, and timestamp.
• Dates, times, locations, time zones, and event titles.
• Attendees, RSVP details, travel details, reminders, deadlines, and recurring-event information.
• Relevant attachments such as PDFs, itineraries, invitations, or schedule documents when needed to extract calendar details.

We do not process email content for advertising or marketing purposes.

Authentication data

• If you connect a calendar account, we use secure OAuth authorization.
• We do not store your Google, Microsoft, or other calendar passwords.
• We receive authorization tokens that allow myaisecy to perform the actions you approve.
• You can revoke access through your calendar provider or your myaisecy account settings.

Calendar data

• Event titles, dates, times, locations, and descriptions created by myaisecy.
• Event identifiers needed to update, review, or avoid duplicate calendar entries.
• Weekly digest summaries generated for your account.

Google user data

When you connect a Google account to myaisecy, we request the following OAuth scopes:

• openid — to securely associate your Google sign-in with your myaisecy account.
• https://www.googleapis.com/auth/userinfo.email — to read your Google account email address for sign-in and account matching.
• https://www.googleapis.com/auth/userinfo.profile — to read your basic Google profile information, such as your name, for account display and sign-in.
• https://www.googleapis.com/auth/calendar.events — to view, create, update, and delete calendar events on your behalf when you forward a plan to your Secy.
• https://www.googleapis.com/auth/calendar.calendarlist.readonly — to list the calendars on your Google account so you can choose which one Secy writes to.
• https://www.googleapis.com/auth/drive.file — to write files that myaisecy creates or uploads on your behalf, including generated ICS attachments and copies of email attachments (such as PDFs, itineraries, images, or boarding passes) that we link to the events we create for you. We do not read or access any other files in your Google Drive, including files myaisecy itself previously uploaded.

How we use Google user data: solely to provide the user-facing features described above — reading your calendar list, creating and updating events you have asked us to create, and writing app-generated files back to Drive at your request.

How we share Google user data: we do not sell or rent it. We do not share it with third parties for advertising or for serving ads. Calendar-derived content may be processed by AI sub-processors (OpenAI, Anthropic, and Google’s Gemini) under contracts that prohibit them from training their models on your content. This occurs in two cases: (1) when an inbound email contains a structured calendar attachment (such as an .ics invite), a plain-text summary of that attachment (title, times, location, description) is included in the email payload sent to the AI provider; other attachments (such as PDFs, images, or boarding passes) may also be sent to the AI provider when needed to extract scheduling details, and (2) for the preference-inference processing described in Section 3, event titles, event dates and start times, email-action labels, and previously inferred preferences are sent to an AI provider. No Google user data is shared with any other third party.

How we store and protect Google user data: Google OAuth refresh and access tokens are stored in our managed database (Cloudflare D1), which provides encryption at rest at the storage layer, and are transmitted only over TLS. Tokens are kept only for as long as your Google account remains connected to myaisecy. To deduplicate events, check availability, and reliably sync, myaisecy maintains a local mirror of your calendar events — titles, start and end times, locations, descriptions we created, and identifiers — in our database while your Google Calendar remains connected. This mirror is not transmitted to AI providers except as described above.

Attachment storage. When an email you forward to your Secy contains attachments (such as PDFs, images, boarding passes, or itineraries), myaisecy stores a copy of those attachments in our managed cloud object storage (Cloudflare R2) so that the linked calendar event remains usable. Each stored attachment is private: it can only be opened through an authenticated link that requires you to be signed in to the account that received the email. We do not generate public download links, and we do not share these copies with any third party. If you have connected Google Drive and have automatic Drive upload enabled, a second copy is also written to your own Google Drive using the drive.file scope described above; the copy in our storage ensures attachments remain available even when Drive upload is disabled or unavailable.

Your control: you can disconnect your Google account from inside myaisecy at any time, which immediately revokes our tokens; you can also revoke access directly at https://myaccount.google.com/permissions.

Limited Use compliance: myaisecy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Technical metadata

• IP address.
• Browser type and device information.
• Access times, request logs, and error logs.
• Usage patterns such as successful event creation, failed parsing attempts, and delivery status.

2. Why We Process Data

We process data to provide the service, keep it reliable, and keep it secure.

• Identify calendar events, create or update entries, generate reminders, and produce weekly digests.
• Detect errors, prevent abuse, improve system performance, and monitor uptime and service quality.
• Measure anonymized operational outcomes such as successful event creation or failed parsing attempts.

We do not use your personal email content to train global AI models.

3. Use of AI Models and Third-Party Providers

myaisecy uses AI models from OpenAI (GPT models), Anthropic (Claude models), and Google (Gemini and Gemma models) to interpret scheduling information from emails, attachments, and related content. We periodically re-benchmark these providers and select the best-performing model for each part of the pipeline. For the active provider, an internal heuristic chooses between a smaller, lower-cost model and a larger, more capable model per message, based on the complexity of the scheduling task.

These providers process data on our behalf to provide the service. We require, by contract, that third-party AI providers do not use your personal email content to train their own models, and we do not authorize any human review of your content by these providers.

Preference inference from calendar history. myaisecy periodically processes certain calendar metadata to infer scheduling preferences used to interpret your future inbound emails. Data sent to AI providers for this purpose is limited to event titles, event dates and start times, email-action labels (action type and status), and previously inferred preferences. Email body content, event descriptions, attendee information, locations, attachments, and your self-written profile note are not sent. Inferred preferences are stored solely in myaisecy’s own database. They are not used for model training, not used for advertising, and not shared with any third party other than the AI provider performing the inference. You may opt out by contacting privacy@myaisecy.com.

4. What We Store and How Long We Keep It

myaisecy is designed to keep personal data only as long as needed to provide the service, troubleshoot issues, comply with legal obligations, and maintain security.

• Email bodies, in-app messages, text messages, or MMSs are processed temporarily where possible and are not retained longer than necessary.
• Operational logs are retained for up to 30 days unless longer retention is required for security, fraud prevention, debugging, legal compliance, or abuse investigation.
• Calendar summaries, digest history, and extracted scheduling records may be retained while your account is active.
• The local calendar mirror described in Section 1 (event titles, times, locations, identifiers) is retained while your account is active and your Google Calendar remains connected. Disconnecting Google Calendar removes the mirrored data copied from your Google calendar.
• Copies of forwarded email attachments stored in our cloud object storage are retained for up to 12 months from receipt, after which they are automatically deleted. You can also revoke individual attachments or delete your account to remove them sooner.
• Inferred scheduling preferences are retained while your account is active and are removed on request or on account deletion.
• When you delete your account, we will permanently delete or de-identify your stored account data, synced tokens, local calendar mirror, inferred preferences, and stored summaries typically within 7 days and no later than 30 days, unless limited retention is required for legal, security, billing, or fraud-prevention reasons.

5. Sharing of Personal Data

We do not sell your personal data or email content to third parties for marketing or advertising.

We may share limited information only with trusted service providers who help us operate myaisecy, such as AI model providers, cloud hosting providers, calendar providers, email processing providers, payment processors, and monitoring or security tools.

We may also disclose information if required to comply with law, legal process, security obligations, or to prevent fraud, abuse, or harm.

6. Security Measures

• Encryption in transit using SSL/TLS.
• Encryption at rest where supported by infrastructure providers.
• Secure OAuth authorization rather than password storage.
• Access controls for production systems.
• Logging and monitoring to detect abuse or service errors.
• Limited retention of operational logs.

No employees, contractors, or representatives of myaisecy read user emails unless access is specifically needed for troubleshooting, security, or support, and only with user authorization or where legally required.

7. User Control

You remain in control of your account and connected services.

• Choose which senders are authorized to send emails to your myaisecy address.
• Add or remove approved senders.
• Choose which calendar myaisecy can access.
• Turn off automatic upload of email attachments to your Google Drive in app settings (the auto_export_drive preference). When this is off, myaisecy still keeps a private copy of each attachment in our own cloud storage (described in Section 1) so the linked calendar event remains usable; revoke the attachment or delete your account to remove that copy as well.
• Request that we disable preference inference for your account by contacting us.
• Revoke calendar access through your calendar provider.
• Request access to, correction of, or deletion of your personal data.
• Delete your account.

To make a privacy request, contact privacy@myaisecy.com.

8. GDPR Rights

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar rights, you may have the right to access, correct, delete, restrict, object, receive a portable copy of your data, withdraw consent where applicable, or lodge a complaint with a data protection authority.

9. California Privacy Rights

If you are a California resident, you may have rights under the California Consumer Privacy Act and related laws, including the right to know what personal information we collect, why we collect it, whether we share it, and to request deletion or correction.

myaisecy does not sell your personal data or email content.

10. AI Accuracy and User Review

myaisecy uses AI to identify scheduling information, but AI systems can make mistakes. Event dates, times, locations, attendees, and other details should be reviewed by the user, especially for important, time-sensitive, travel-related, financial, legal, medical, or work-critical events.

myaisecy is intended to reduce administrative burden, not replace user judgment.

11. Changes to This Policy

We may update this AI & Privacy Policy as the service evolves. If we make material changes, we will update the effective date and may notify users through the website, email, or account interface.

12. Contact

For privacy questions, data requests, or AI processing questions, contact privacy@myaisecy.com.