La versión en inglés es la autoritativa; traducción en curso.
MP Board – Privacy Policy
DRAFT v0.3 – reviewed by Roberto Teng (MynaParrot SL); external legal review recommended before wide launch. Last updated: DRAFT – to confirm
In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD), we inform you under Arts. 13 and 14 GDPR and Art. 11 LOPDGDD.
1. Two roles – please read
2. Who is responsible (controller)
3. What data, why, legal basis and retention
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Create and run your account, provide the Service | Name, email, organisation, password hash, language, connected server URLs | Contract – Art. 6(1)(b) | While the account is active, then deleted within 30 days, except as below |
| Store the BBB shared secret to call your server | Shared secret (encrypted) | Contract – Art. 6(1)(b) | Deleted immediately when you remove the server or close the account |
| Security, abuse prevention, access logs | IP address, browser, timestamps, actions performed | Legitimate interest in securing the Service – Art. 6(1)(f) | DRAFT – to confirm months |
| Billing for paid add-ons | Billing name, address, VAT ID, invoices (card data held by the payment processor only) | Contract and legal obligation – Art. 6(1)(b),(c) | 6 years (Art. 30 Spanish Commercial Code), 4+ years tax law |
| Support requests | Messages, attachments | Contract – Art. 6(1)(b) | DRAFT – to confirm months after closing the ticket |
| Service emails (security, changes to terms) | Contract / legal obligation | While the account is active | |
| Product news and offers | Email, name | Consent – Art. 6(1)(a); or for existing customers, similar products under Art. 21 LSSI | Until you unsubscribe |
| Usage analytics to improve the Service | Pseudonymised usage events | Legitimate interest – Art. 6(1)(f) DRAFT – to confirm | DRAFT – to confirm months |
Where we rely on legitimate interest you can object at any time (Art. 21). We do not make decisions based solely on automated processing producing legal effects (Art. 22). We do not sell personal data.
Meeting data stored on behalf of customers: MP Board stores meeting, session, attendance/analytics and recording metadata from connected servers so it can show history and reports. Retention: free plan 30 days, paid plans up to 12 months (or shorter if the customer chooses), then deleted automatically.
Access: only MynaParrot's own team, from within the EU/EEA, has access to production systems.
Data we obtain indirectly (Art. 14): when acting as processor we receive meeting data from your server via its API; categories: meeting names/IDs, participant names, roles, join/leave times, recording metadata (IDs, names, dates, duration, size, playback/MP4 URLs), and Learning Analytics data sent by BBB at the end of a meeting (attendees, join/leave times, talk time, chat/poll/emoji activity counts). Audio/video files are not copied..
4. Recipients
We do not disclose data to third parties except: service providers acting as our processors under contract (hosting Hetzner Online GmbH, Germany, email Resend, payments Stripe Payments Europe Ltd. (Ireland), support/analytics none at launch) – see the current list at DRAFT – to confirm; and public authorities when legally required.
5. International transfers
Data is hosted in the EU/EEA (Germany, Hetzner DRAFT – to confirm). If a provider processes data outside the EEA, we rely on an adequacy decision (Art. 45, e.g. EU-US Data Privacy Framework for certified companies) or Standard Contractual Clauses (Art. 46(2)(c), Commission Decision 2021/914) with supplementary measures where needed.
6. Your rights
You may request access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), and withdraw consent at any time without affecting prior processing (Art. 7(3)). Write to bob@mynaparrot.com with proof of identity. We answer within one month (Art. 12(3)). You may complain to the Agencia Española de Protección de Datos (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid) or your local supervisory authority.
7. Security
We apply appropriate technical and organisational measures (Art. 32), including encryption of shared secrets at rest, TLS in transit, tenant isolation, access control and logging. See the DPA Annex II.
8. Cookies
See our Cookie Policy at https://toolkit.mynaparrot.net/es/cookies/ (Art. 22.2 LSSI).
9. Minors
The Service is not directed to persons under 18. Under Art. 7 LOPDGDD, minors under 14 cannot consent; we do not knowingly collect their account data.
10. Changes
We will notify material changes by email or in-app.
11. Languages
This policy is available in English, Spanish and Portuguese.