Privacy Policy

1. Who we are

MyChat is operated by A1 Capital LLP (ТОО «A1 Capital»), Business Identification Number (BIN) 181040038292.

For privacy questions or requests, contact cfo.toniandguy@gmail.com.

We determine how account, billing, security and support information is used to operate MyChat. When you connect WhatsApp and use MyChat to process other people’s messages or contact details, you are responsible for having the necessary authority and lawful basis. We process that connected content to provide the service on your instructions. The precise data-protection roles depend on your use and applicable law.

2. Information we process

• Account information: email address, account name and profile image where available. Password-based accounts use a password hash, not a readable copy of the password. If you choose Google sign-in when available, we receive profile information and authentication information from Google.
• Sessions and connected AI apps: session identifiers, authentication cookies, IP address and browser information, authorized client details, OAuth grants and tokens needed to maintain and revoke access.
• Billing: customer and subscription identifiers, plan, trial and renewal dates, subscription status and payment events reported by Polar. Payment card details are handled by the checkout and payment providers; MyChat does not receive or store your full card number or card security code.
• WhatsApp connections: connection name, linked number, provider instance identifiers, connection state and available profile/synchronization information. We store provider credentials and webhook secrets encrypted at the application level.
• Connected content: imported contacts, chat identifiers, available message content, sender and recipient information, timestamps, attachments, message edits or deletions, and delivery/read statuses. The service may receive incoming messages and outgoing messages sent from your phone as well as through MyChat.
• Prepared actions and messages: drafts, messages, recipient details, attachments, time zone, versions, confirmations, sending outcomes, usage reservations and reports.
• Setup and support: onboarding answers, progress, preferences, and information you provide when requesting help. We store your account contact number separately from any permission previously given for setup assistance.
• Operational information: request and job metadata, failures, security events and information required to diagnose problems. Our application’s operational diagnostics are designed not to include provider-token URLs, QR codes or conversation contents.

3. Why we use this information

We use information to create and secure accounts; connect WhatsApp and authorized AI clients; import and search available conversations; execute requested messages; provide files and reports; maintain subscription access and quotas; prevent abuse; troubleshoot failures; and respond to support and privacy requests.

Where applicable law requires a legal basis, processing may be necessary to provide the service you request, comply with legal duties, or protect legitimate operational and security interests, subject to applicable limits. Where consent is required, we seek it for the relevant purpose. We do not treat consent to one optional purpose as permission for unrelated uses.

4. Account contact number

New users provide a WhatsApp contact number during account setup. This does not connect WhatsApp; linking a number is a separate step. Providing this contact number does not give permission for sales or promotional messages. You can update it in Account settings and request deletion by emailing us.

If you previously opted in to setup assistance, that permission remains separate. You can withdraw it in Account settings without changing your account contact number.

5. Your AI client and MCP

When you authorize an AI application such as ChatGPT or Claude, it can request the MyChat tools available to your account. Tool responses can include messages, contacts and temporary attachment links needed to answer your request. Information returned to the AI client may become part of your conversation with that provider.

MyChat does not provide its own language model for these summaries and drafts. Your chosen AI provider controls its own processing, storage and model-training settings under its policies and your account configuration. Revoking access in MyChat prevents further authorized tool access; it does not delete information the AI provider already received. You can manage connected applications in AI agents.

6. Service providers and other disclosures

We share information needed to deliver the relevant part of the service with:

• DigitalOcean: application hosting and managed PostgreSQL. Our current application and primary database are hosted in Amsterdam, the Netherlands.
• Cloudflare R2: private attachment storage. MyChat provides short-lived protected links rather than public storage URLs. An authorized AI client or browser may retrieve a file using a valid access link.
• Third-party WhatsApp connectivity provider: WhatsApp linking, synchronization, message exchange, attachment handling and status notifications. This provider processes connected account information and message content needed for those operations.
• Polar and its payment partners: checkout, merchant-of-record services, subscription management, invoices and payment-related duties. See Polar’s Checkout Buyer Terms and its legal and privacy information.
• The AI applications you authorize: data requested through MyChat tools, as described above.
• PostHog: onboarding analytics hosted in the United States (PostHog US Cloud). Events are sent through our analytics subdomain, p.mychat.is.
• Google, if you use Google sign-in: authentication and the profile information needed for your account.
• Email delivery providers, when configured: recipients and contents of service emails or support communications they deliver.
• Telegram: operational notifications to our team. These can include account email addresses, registration or login events, subscription events and connection/job identifiers or names. They are not intended to contain WhatsApp conversation contents, QR codes or provider secrets.

We may also disclose information when required by applicable law, to protect people or the service, resolve a dispute, or as part of a business transfer with appropriate safeguards and notices. We do not sell your WhatsApp conversation content.

7. International processing

The current hosting location described above is outside Kazakhstan. Our providers and the AI applications you choose may process information in other countries under their own arrangements. Data-protection requirements may differ between countries. International processing remains subject to applicable transfer and localization requirements; this policy does not waive those obligations. Contact us for questions about the locations or arrangements relevant to your data.

8. How long information is kept

• Imported WhatsApp messages and stored attachments are subject to a retention limit of up to 90 days, with automated cleanup. Importing history does not guarantee a complete archive of your phone.
• After subscription access ends, reading and sending WhatsApp data through MyChat is blocked. Remaining WhatsApp data is scheduled for cleanup after 30 days unless access is restored within the applicable retention period.
• Unused temporary uploads and unattached draft files are generally cleaned up after a day. Prepared messages and their referenced files may be retained for their lifecycle, subject to the attachment limit and access-expiry cleanup.
• Shared QR connection links expire after 24 hours and become unusable after a successful connection or when access is revoked. They do not grant access to your whole account.
• Account, authorization, consent and billing records have separate lifecycles. We retain them while needed to provide the account, meet applicable legal duties, handle requests or disputes and protect the service. The WhatsApp message limit is not a promise that every account record is erased after 90 days.
• Backups are separate from live data. DigitalOcean maintains managed database backups, and deployment backups are kept on our application server for seven days. Deleted information may remain in restricted backup copies until those copies expire under their applicable rotation.

Cleanup is performed by background jobs and may take processing time. Information already received by a recipient, WhatsApp, our WhatsApp connectivity provider, Polar or an AI provider is subject to that party’s retention and deletion arrangements as well.

9. Cookies, browser storage and security

We use necessary authentication and session cookies, OAuth-flow state and browser storage for preferences such as theme. A temporary QR link page may use session storage to retain its access token on that device. These features are needed for the requested functionality or your chosen preferences.

MyChat uses PostHog for onboarding analytics. It records explicit setup steps and conversion events using an internal account identifier, and stores local completion markers and setup choices to avoid duplicate events and attribute later steps. It does not record sessions, phone numbers, emails, message contents, QR codes or OAuth parameters. Analytics is processed by PostHog US Cloud in the United States, through our managed reverse proxy at p.mychat.is. We do not include advertising trackers. Provider checkout or AI-client pages may use their own cookies under their policies.

We use HTTPS, encrypted provider credentials, access checks and private file storage. Once content is imported into MyChat or passed to an AI client, it is processed outside your WhatsApp device; we do not describe that content as remaining exclusively within WhatsApp’s end-to-end encryption. No service can promise absolute security. Keep your sign-in credentials and temporary connection links private.

10. Your choices and requests

You can disconnect WhatsApp connections, revoke AI-app access, manage billing and update your account contact number and withdraw any previous setup-assistance permission through the available account controls. Disconnecting an account does not instantly erase its retained history or copies already received by third parties.

To request access, correction or deletion, withdraw consent, or exercise other rights available under applicable law, email cfo.toniandguy@gmail.com. Include enough information to identify your account, but do not send passwords, payment card details or provider keys. We may need to verify your identity and assess legal retention requirements before acting. Account deletion is handled by request; there is no automatic self-service account-deletion control at present.

You may also raise concerns with the competent data-protection authority where applicable. The service is intended for adults, and we do not knowingly solicit accounts from children under 18.

11. Changes to this policy

We may update this policy as the service or applicable requirements change. We will update the date above and provide additional notice or request consent where required. Contact details for the operator are listed at the beginning of this policy.