Privacy Policy

Mydus is currently operated by [LEGAL ENTITY NAME — to be confirmed once the operating company is registered]. For any question about this policy or your data, contact us at teammydus@gmail.com.

Account data — when you sign up, we collect your name, email address, and a business/company name. Your password is never stored by us directly; it is handled by our authentication provider (Supabase), which stores it in hashed form.

Business data you enter — Mydus is a tool for running a service business, so the account holder (and any staff they invite) can enter records about their own customers, staff, jobs, payments, expenses, and products. This can include third parties' personal data — for example a customer's name, phone number, email, and home address, or a staff member's contact details and pay rate. We process this data on behalf of the business as a data processor; the business using Mydus is the data controller for their own customers' and staff's records, and is responsible for having a lawful basis to store that data in Mydus.

Usage and technical data — we automatically collect basic technical information needed to keep the service running: IP address, browser type, device information, and log data (e.g. which pages were requested and when).

Cookies — we use a strictly necessary session cookie to keep you signed in. We do not currently use analytics or advertising cookies.

• To provide and operate the Mydus application (creating your account, saving the data you enter, displaying it back to you).
• To authenticate you and keep your account secure.
• To communicate with you about your account, including service updates and, where applicable, billing.
• To diagnose and fix technical problems.
• To comply with legal obligations.

We do not sell personal data, and we do not use the data you store in Mydus to serve advertising.

• Performance of a contract — processing your account data and the business data you enter is necessary to provide the service you signed up for.
• Legitimate interests — for security, fraud prevention, and improving the service.
• Legal obligation — where we're required to keep or disclose records (e.g. tax law).

We share data with a small number of service providers ("subprocessors") who help us run Mydus. They are only permitted to use the data to provide their service to us:

• Supabase — authentication and database hosting.
• Vercel — application hosting.

If we add a payment processor (e.g. Stripe) to handle subscription billing, it will be added here, and your payment card details will be handled directly by that processor — Mydus does not store card numbers.

We do not otherwise sell, rent, or share personal data with third parties for their own marketing purposes.

Our subprocessors may process data outside the UK. Where that happens, we rely on the safeguards those providers have in place (such as the UK International Data Transfer Addendum or equivalent standard contractual clauses) to ensure your data is protected to UK GDPR standards.

We keep account and business data for as long as your account is active. If you close your account, we will delete or anonymise your data within a reasonable period, except where we're required to keep it longer for legal, tax, or accounting reasons.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data ("right to be forgotten"), subject to our legal retention obligations.
• Object to or restrict certain processing.
• Receive your data in a portable format.
• Complain to the UK Information Commissioner's Office (ICO) if you believe your data has been mishandled.

To exercise any of these rights, email teammydus@gmail.com. If the data in question is a customer or staff record entered by a business using Mydus, we may need to direct your request to that business, as they are the data controller for those records.

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), access controls, and row-level data isolation so one business's data is never visible to another. No system is perfectly secure, and we cannot guarantee absolute security.

Mydus is a business tool and is not directed at, or intended for use by, children under 16.

We may update this policy from time to time. If we make material changes, we'll let you know by email or via a notice in the app before the change takes effect.

Questions about this policy or your data: teammydus@gmail.com.