Privacy Policy

1. Introduction & Privacy Commitment

At MYAL ("Platform", "we", "us", or "our", accessible at https://myal.link), we are deeply committed to safeguarding the privacy and digital sovereignty of both our registered account holders ("Users") and the public visitors who interact with our users' published profile pages ("Visitors"). This Privacy Policy explains transparently how we collect, process, store, and protect your information in full alignment with international privacy standards, including the General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA/CPRA).

2. Data Roles: Controller & Processor

To ensure total clarity regarding data handling responsibilities:

• MYAL as Data Controller: We act as the Data Controller with respect to the account information, profile settings, billing credentials, and communication logs provided directly by registered Users.
• MYAL as Data Processor: When Visitors view a public user profile (e.g., myal.link/username), MYAL acts as a Data Processor on behalf of the registered profile owner, collecting aggregate, anonymized traffic statistics to provide privacy-first analytics.

3. Information We Collect

A. Account & Profile Information (Registered Users)

When you register for an account and curate your digital identity, you directly provide us with:

• Identity Credentials: Full name, verified email address, unique chosen handle (myal.link/yourname), and cryptographic password hash (stored using secure salted hashing algorithms).
• Public Profile Content: Headline, professional bio, avatar headshot, cover banner photo, location, curated links, destination URLs, linked social accounts, and visual theme choices. All profile content you choose to publish is intentionally public to visitors on the internet.
• Account Communications: Support inquiries, feedback submissions, and technical bug reports delivered to [email protected] or [email protected].

B. Payment & Subscription Information

Paid subscriptions (MYAL Pro and Business) are powered by our authorized online reseller and Merchant of Record, Paddle.com Market Ltd ("Paddle"):

• No Raw Card Storage: All credit card numbers, PayPal details, Apple Pay / Google Pay credentials, and banking details are processed directly and exclusively by Paddle under PCI-DSS Level 1 compliance. MYAL never sees, collects, processes, or stores your raw payment cards or banking credentials.
• Billing Metadata: Paddle securely transmits non-sensitive transaction metadata to MYAL (such as Paddle Customer ID, Subscription ID, billing plan tier, payment status, and renewal dates) solely to provision your active Pro features.

C. Public Profile Visitor Analytics (Cookieless & Anonymized)

When a Visitor opens a public MYAL profile, our platform collects privacy-preserving, non-personally identifiable metrics:

• Aggregate Performance Metrics: Total page impressions, unique visits, link click-through counts, and referrer websites.
• Coarse Geographic & Device Details: Country and city-level geolocation (derived from IP address and immediately discarded without storing the IP), browser family, operating system, and device category (Mobile vs. Desktop).
• Zero Persistent User Tracking: We compute an anonymized, irreversible cryptographic hash using a daily rotating system salt to tally unique daily visits. This hash cannot be reverse-engineered into an IP address or personal identity and prevents cross-site or cross-day surveillance.

4. How We Use Your Information (Legal Bases)

We process personal and profile data only when supported by a valid lawful basis under applicable privacy legislation:

• Performance of a Contract: To authenticate your account, maintain your public handle, serve your profile globally, and provision your subscribed features.
• Legitimate Interests: To protect platform integrity, prevent malicious spam and phishing links, monitor system uptime, and improve user interface performance.
• Legal Compliance: To comply with financial accounting obligations, respond to statutory law enforcement orders, and enforce our Terms and Conditions.
• Explicit Consent: Where you have opted in to receive product announcements or promotional communications (which you may opt out of at any time).

5. External Tracking Pixels & Third-Party Integrations

MYAL Pro allows power users to optionally connect external marketing and tracking scripts (such as Meta Pixel, Google Analytics, LinkedIn Insight Tag, and TikTok Pixel) to their public profile pages:

• User Responsibility: If you choose to embed external tracking scripts on your public MYAL profile, you acknowledge that you are solely responsible for ensuring your profile complies with all applicable privacy regulations (including providing required cookie banners, consent collection, and privacy notices to your visitors).
• Built-In Default: If no external pixels are configured, MYAL operates 100% cookieless for all profile visitors, requiring no intrusive cookie consent popups.

6. Cookies & Local Storage

We believe in minimal, purposeful cookie usage:

• Essential Authentication Cookies: Strictly necessary session tokens and JWTs required to keep you securely logged into your user dashboard.
• Preferences & UI Cache: Local storage flags to remember your dark/light mode preference or editor state.
• Zero Ad-Network Cookies: MYAL does not use third-party behavioral advertising cookies or sell visitor tracking profiles to data brokers.

7. Data Sharing & Third-Party Service Providers

We do NOT sell, rent, monetize, or trade your personal data or visitor data under any circumstances. We share data only with verified sub-processors necessary to run the service:

• Merchant of Record & Billing: Paddle.com Market Ltd (United Kingdom) for secure payments, tax handling, and subscription billing.
• Cloud Infrastructure & Edge Delivery: High-security cloud servers and edge networks for 99.9% availability, automated backups, and instant CDN caching.
• Transactional Email Services: High-deliverability transactional email gateways for account verification and password reset links.
• Legal Disclosures: In rare cases, when required by subpoena, court order, or applicable law to protect the legal rights, safety, or security of MYAL, our users, or the public.

8. Data Retention & The Right to Be Forgotten

You maintain complete control over the lifecycle of your data:

• Account Lifespan: We retain your account data and published profile content for as long as your account remains active.
• Instant Account Deletion: You can permanently delete your account and all associated data at any time via your Dashboard Settings > Danger Zone. Upon account deletion, your credentials, profile info, uploaded avatars, banners, and links are immediately and irrevocably purged from active production databases.
• Statistical Data: Aggregated, non-personal performance counts (such as total link clicks) may remain in anonymized historical reports.

9. Your Rights Under GDPR (EEA & UK Users)

If you reside in the European Economic Area or United Kingdom, you possess statutory rights regarding your personal data:

• Right of Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You may edit your profile and account information anytime directly in your Dashboard.
• Right to Erasure ("Right to be Forgotten"): You may request the permanent deletion of your account and personal data.
• Right to Restrict or Object to Processing: You may object to data processing grounded in legitimate interests.
• Right to Data Portability: You may request an export of your account and link data in a structured, machine-readable format.
• Right to Lodge a Complaint: You have the right to contact your local Data Protection Supervisory Authority if you believe our data practices violate your rights.

To exercise any of these rights, simply email our dedicated privacy team at [email protected].

10. Your Rights Under CCPA / CPRA (California Residents)

The California Consumer Privacy Act and California Privacy Rights Act grant California residents specific disclosures:

• No Sale or Sharing of Personal Information: MYAL has not sold, rented, or shared personal information for cross-context behavioral advertising in the preceding 12 months, and will never do so.
• Right to Know & Delete: You have the right to request disclosure of the categories of personal data collected and the right to request full deletion without discriminatory treatment.

11. Data Security & Encryption

We apply rigorous engineering practices to protect your data against unauthorized access, alteration, or disclosure. All data transmissions are encrypted using modern TLS 1.3 / HTTPS cryptographic protocols. Passwords are never stored in plaintext and are hashed using industry-standard salted hashing algorithms. Our infrastructure is continuously protected by firewalls, rate limiters, and automated security scans.

12. Children's Privacy

MYAL is intended exclusively for adults and professionals. We do not knowingly solicit or collect personal information from individuals under the age of 18 (or under 13 in compliance with COPPA). If we discover that personal data from a child has been collected inadvertently, we will immediately delete the associated account and data.

13. Modifications to This Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, technological, or legal developments. When significant updates are made, we will notify users via an announcement on the dashboard or by updating the "Last updated" date at the top of this page. Your continued use of the Platform after the effective date of an updated policy signifies your agreement to the changes.

14. Contact Our Data Protection Team

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please reach out to us:

• Privacy & Data Protection Officer: [email protected]
• General Support & Legal: [email protected]
• Official User Documentation: Visit our New User Guide for platform guidance.