Privacy Policy

This Privacy Policy explains how Toby Stapleton, carrying on business as MyPip ("MyPip", "we", "us", "our"), a sole proprietor based in British Columbia, Canada, collects, uses, and protects personal information when you use the MyPip website at mypip.io and the MyPip application at my.mypip.io (together, the "Service").

If you have questions, contact us at privacy@mypip.io (postal: 1907 W 10th Avenue, Vancouver, BC, Canada).

1. Who we are and which laws apply

MyPip helps you find and reach potential customers. You give us your website, and we find people who fit, score how well they match you, research them, and prepare suggested messages so you can reach out yourself.

We are based in Canada, so our handling of personal information is governed by Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, British Columbia's Personal Information Protection Act (PIPA). Because we have users and find people in other regions, this policy also reflects the EU and UK GDPR and the California Consumer Privacy Act (CCPA/CPRA) where those laws apply to you.

For personal information about our users, MyPip is the organisation accountable for it (the "controller" under GDPR). For information about the potential customers we find for you ("Contacts"), the position is different and is described in Section 6.

2. Information we collect

a. Information you give us

• Account details: your email address and name. When you sign in with Google or Discord, we receive these from that provider (see Section 4). When you sign in by email, you give us your email and verify it with a one-time code. We do not store passwords.
• Business profile: your website URL, a description of your business, and the customer profile you define or that we generate for you.
• Content you create: your messages with the MyPip assistant, the suggested messages and steps we generate, and your settings (notification preferences, timezone, connected channels).
• Billing details: handled by our payment processor, Stripe. We do not store full card numbers.

b. Information we collect automatically

• Usage and device data: pages viewed, features used, approximate location derived from your IP address, browser and device type, and log data, collected through our analytics provider, PostHog.
• Cookies and similar technologies: used for sign-in, security, and analytics. See Section 9.

c. Information from third parties

• Contacts: to provide the Service, we search public sources and third-party providers to find and add detail about potential customers for you (see Section 6).

3. How we use your information

We use personal information to:

• create and authenticate your account and keep the Service secure;
• provide the core Service, which means finding people, scoring fit, adding context, preparing suggested messages, and delivering your daily brief to the channel you choose;
• operate AI features (we send relevant content, such as your website text and your messages to the assistant, to our AI provider to generate results);
• process payments and manage your subscription;
• send service and transactional emails (sign-in codes, your daily brief, replies);
• send product and marketing messages where permitted, which you can opt out of at any time;
• analyse and improve the Service; and
• meet legal obligations and enforce our Terms.

Our lawful bases (GDPR), and consent under Canadian law: performing our contract with you; your consent (for example marketing and non-essential cookies); our legitimate interests in operating, securing, and improving the Service; and compliance with legal obligations. Under PIPEDA we rely on your consent, which may be express or, for less sensitive uses, implied by your use of the Service.

4. Google and Discord sign-in

When you choose Sign in with Google, we request your basic Google profile and email (email, profile, openid scopes) only to create and authenticate your MyPip account. When you choose Sign in with Discord, we also use the guilds.join scope to add you to the MyPip community server so our assistant can message you there.

Google API Services, Limited Use. MyPip's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the sign-in feature. We do not sell it, use it for advertising, or share it except as needed to provide the Service or as required by law.

5. How we share information (sub-processors)

We do not sell your personal information. We share it with service providers who process it on our behalf, under contract, to run the Service:

• Supabase: authentication and database hosting
• Railway: application hosting
• Anthropic (Claude): AI generation (research, scoring, chat, suggested messages)
• Exa, Tavily, Parallel, ScrapeCreators: finding people, web search, and enrichment
• Stripe: payment processing
• Resend: transactional and inbound email
• PostHog: product analytics
• Google, Discord: sign-in
• Slack, Discord: delivering your brief to channels you connect

We may also disclose information to comply with the law, enforce our Terms, or in connection with a sale or reorganisation of the business.

Some providers are outside Canada, including in the United States. When we transfer personal information internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, and we remain accountable for it under PIPEDA.

6. Contacts (information about potential customers)

A core function of MyPip is to find potential customers for you. To do this we collect information about individuals at businesses ("Contacts") from public profiles and public posts, for example names, job titles, employer, public profile links (such as LinkedIn), and the public posts they have made. We collect public profile information only. We do not collect or store private contact details such as email addresses or phone numbers for Contacts.

For Contacts, you are the controller and MyPip acts as your processor, handling this information on your instructions to deliver the Service. The lawful basis is typically legitimate interests (business-to-business contact). You are responsible for making sure your use of Contacts complies with the laws that apply to you, including marketing, anti-spam, and data-protection rules. Business users who want a data processing agreement can request one at privacy@mypip.io.

Any person can ask us to remove their information by contacting privacy@mypip.io, and we will remove it and, where appropriate, let the relevant user know.

7. Automated processing and AI

To run the Service, we use AI to research people, score how well a Contact matches you (a score from 0 to 100), summarise context, and draft suggested messages. This involves automated processing, and scoring a person is a form of profiling.

These results are suggestions for you to review and act on. We do not use solely automated decisions to produce legal or similarly significant effects about you, our user. Any decision to contact a person, and the message that is sent, is made by you. We also limit the personal data we share with our AI provider when generating these results. Where you interact with our assistant, you are interacting with an AI system.

8. Data retention

We keep personal information for as long as your account is active and as long as we need it to provide the Service. After you close your account, we delete or anonymise your personal information within 90 days, except where we must keep certain records longer to meet legal, tax, or accounting obligations (for example, financial records that Canadian tax rules require us to retain).

9. Cookies

We use strictly necessary cookies for sign-in and security, and analytics cookies (PostHog) to understand and improve the Service. You can control non-essential cookies through our cookie banner and your browser settings.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent.

• Canada (PIPEDA / BC PIPA): you can access and correct your personal information, and you can complain to the Office of the Privacy Commissioner of Canada or, where it applies, the Office of the Information and Privacy Commissioner for British Columbia.
• EU / UK (GDPR): you have the rights above and can complain to your supervisory authority.
• California (CCPA/CPRA): you have the right to know, delete, correct, and opt out of "sale" or "sharing". We do not sell your personal information.

To exercise any right, email privacy@mypip.io. We will respond within the time the law requires.

11. Security

We use industry-standard measures (encryption in transit, access controls, and reputable infrastructure providers) to protect personal information. No system is perfectly secure, but we work to protect your information and will notify you and the relevant regulators of breaches where the law requires.

12. Children

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from them.

13. Changes to this policy

We may update this policy from time to time. We will post the new version here, update the "Last updated" date, and notify you of material changes.

14. Contact

Toby Stapleton, carrying on business as MyPip 1907 W 10th Avenue, Vancouver, BC, Canada privacy@mypip.io