Privacy Policy

2.1 Information You Provide Directly

Account Information:

• Name, email address, and contact details
• Username and password
• Date of birth or age (to apply age-appropriate protections and, where relevant, advertising rules)
• Educational institution affiliation
• Parent/guardian contact information (for under-18 users)

Educational Data:

• Academic records and grades
• Certificates and achievements
• Course enrollment information
• Educational institution details

Journal Content:

• Personal reflections and diary entries
• Written assignments and projects
• Photos and multimedia content uploaded to journals
• Comments and interactions with educational content

2.2 Information We Collect Automatically

Technical Information:

• IP address (from standard server logs)
• Device type, operating system, and browser type
• App version and platform (mobile/web)
• Diagnostic and error logs

Advertising Information (adult accounts only):

MyStory does not currently display advertisements. When advertising is introduced, and only for account holders who are adults under the law of their country (18 or over, or 16 or over where that is the local threshold), we or our advertising partners may also process:

• An advertising identifier provided by your device or browser
• Records of the ads shown to you, and whether you tapped or dismissed them
• Approximate location at country or region level
• General interest categories, where you have agreed to personalised advertising

We do not collect or use advertising data for accounts belonging to, or managed on behalf of, anyone under 18. See section 5.

2.3 Information from Third Parties

Educational Institutions:

• Academic records and achievements
• Enrollment status and course information
• Educational activities and certificates
• Assessment results and feedback

External Agencies:

• Training certificates and qualifications
• Program participation records
• Achievement badges and recognition

3.1 Primary Purposes

Service Provision:

• Creating and managing user accounts
• Enabling journaling and reflection features
• Facilitating collaboration between students, institutions, and agencies
• Providing customer support and technical assistance

Educational Enhancement:

• Tracking academic progress and achievements
• Enabling institutions to post activities and certificates
• Providing personalized learning experiences
• Generating progress reports

Safety and Security:

• Monitoring for inappropriate content or behavior
• Implementing safeguarding measures for children
• Detecting and preventing fraud or abuse
• Maintaining platform security and integrity

3.2 Secondary Purposes

Communication:

• Sending service updates and notifications
• Educational institution communications
• Safety and security alerts

Improvement:

• Testing new features and functionality
• Conducting research on educational outcomes
• Generating anonymized statistics and insights

Advertising (adult accounts only):

• Showing advertisements within the Service to adult account holders
• Showing personalised advertisements where an adult account holder has agreed to them
• Measuring whether ads were delivered, viewed, or interacted with, and preventing ad fraud
• We do not show advertising to users under 18, and we do not use children's data for advertising

Legal Compliance:

• Meeting regulatory requirements
• Responding to legal requests
• Protecting our legal rights and interests
• Complying with safeguarding obligations

We process your personal data under the following legal bases:

Contract Performance:

• Providing the MyStory service
• Managing user accounts

Legitimate Interests:

• Improving our service
• Fraud prevention and security
• Business analytics and research

Legal Obligation:

• Safeguarding children
• Responding to legal requests
• Tax and accounting requirements
• Regulatory compliance

Consent:

• Certain data sharing with third parties
• Personalised advertising to adult account holders, and the use of advertising identifiers or similar technologies
• Processing special category data (where applicable)

Vital Interests:

• Child protection and safety
• Emergency situations requiring immediate action

5.1 Children's Privacy Standards

We design MyStory to meet the UK Children's Code (Age Appropriate Design Code). MyStory is initially offered in the United Kingdom, the United States, Canada, and India, and we also follow the children's privacy rules that apply in each country where we operate, including the US Children's Online Privacy Protection Act (COPPA), Canadian federal and provincial privacy law, and India's Digital Personal Data Protection Act 2023.

Parental Controls:

• Requiring parental account setup for under-18 users
• Providing parental dashboards and oversight tools
• Enabling parents to control data sharing preferences
• Obtaining parental consent before a child's record is created

Child-Friendly Design:

• Age-appropriate privacy settings as default
• Clear, understandable privacy information for children
• Minimal data collection necessary for service provision
• Periodic review of child data for continued necessity

Enhanced Protections:

• No advertising of any kind is shown to users under 18, and no child data is used for advertising or advertising profiling
• Stricter content moderation for child users
• Limited data sharing for child accounts
• Enhanced security measures for child data

5.2 Parental Rights

Parents/guardians who manage accounts for children can:

• Access their child's personal data
• Request correction of inaccurate data
• Request deletion of their child's data
• Control data sharing with educational institutions
• Withdraw consent at any time
• Receive copies of their child's data

6.1 Educational Institutions

We share relevant data with your registered educational institutions to:

• Enable posting of activities and certificates
• Facilitate academic progress tracking
• Support educational collaborations
• Provide institutional progress reporting

Data shared may include:

• Academic performance and progress
• Journal entries (where educationally relevant and consented)
• Engagement with educational activities
• Achievement and certification records

6.2 External Agencies

With your consent, we may share data with approved external agencies for:

• Training and certification programs
• Educational opportunities and activities
• Career development and guidance
• Skills assessment and recognition

6.3 Service Providers

We share data only with service providers necessary to operate MyStory:

Technology Providers:

• Cloud hosting and media storage services
• Transactional email and communication services (service and security notifications only)
• Authentication services (Firebase Authentication, when you sign in with Google or Apple)

Payment Providers:

• App store billing (Apple App Store, Google Play) for in-app subscriptions
• A card payment provider for subscriptions bought on our website, mainly by organisations. We do not store your full card details.

Advertising Partners (adult accounts only, once advertising is introduced):

• Advertising networks, such as Google AdMob
• Sponsors and partner educational institutions whose advertisements we may carry

Where advertising is shown to an adult account holder, we may share an advertising identifier, approximate country or region, and ad interaction data with these partners so that the advertisement can be delivered and measured. We never share data about users under 18 with advertising partners. We do not sell your personal data.

6.4 Legal Disclosures

We may disclose your information when required by law or to:

• Comply with legal processes or court orders
• Protect child safety and welfare
• Investigate fraud or security incidents
• Enforce our Terms of Service
• Protect our legal rights and interests

6.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of the business transaction, subject to the same privacy protections.

7.1 General Retention Periods

Account Data: Retained while your account is active. If you delete your account, see 7.2. If an account simply becomes inactive and is closed by us, basic account records are kept for up to 12 months

Journal Content: Retained according to user preferences, with option for immediate deletion

Educational Records: Retained for 7 years after course completion (standard educational practice)

Advertising Data (adult accounts only): Retained for no longer than 13 months from collection

7.2 Deleted Accounts and Backups

When you delete your account, your data is removed from the live Service promptly. Copies held in our encrypted backups are overwritten on our normal backup cycle and are fully erased no later than 90 days after deletion. During that period backups are used only to restore the Service after a failure.

7.3 Safeguarding Records

Records of safeguarding concerns and child protection incidents are kept for the minimum period required by the law and regulatory guidance of the country in which the concern arose. Where no minimum period applies, we keep them only for as long as necessary to protect the child involved. You can ask us what period applies to a specific record by contacting safeguarding@mystory.global.

7.4 Child Data

For users under 18:

• Data is reviewed periodically for continued necessity
• Enhanced deletion rights apply
• Parents can request immediate deletion at any time

7.5 Legal Requirements

Some data may be retained longer when required by:

• Legal obligations
• Safeguarding requirements
• Ongoing legal proceedings
• Regulatory compliance

8.1 Transfer Safeguards

When we transfer data outside the UK/EEA, we ensure appropriate safeguards through:

• Adequacy decisions by the UK government
• Standard Contractual Clauses (SCCs)
• Binding Corporate Rules
• Certification schemes

8.2 Third-Party Services

Some of our service providers may be located outside the UK/EEA:

• Cloud storage providers (with appropriate safeguards)

Under UK GDPR, you have the following rights:

9.1 Access Rights

Request copies of your personal data

Receive information about how your data is processed

Obtain data in a portable format

9.2 Correction Rights

Request correction of inaccurate data

Update your account information

Amend incomplete records

9.3 Deletion Rights

Request deletion of your personal data

Exercise "right to be forgotten"

Parents/guardians can request deletion of a child's account directly from the child's profile in the parent dashboard (deletion is scheduled after a short grace period and the child's access is revoked immediately), or by contacting dataprotection@mystory.global

9.4 Restriction Rights

Limit how we process your data

Object to certain types of processing

Restrict processing during disputes

9.5 Objection Rights

Object to processing based on legitimate interests

Object to any automated decision-making that affects you

9.6 Portability Rights

Receive your data in machine-readable format

Transfer data to another service provider

Request an export of your journal content and records by contacting dataprotection@mystory.global

10.1 Cookies and Similar Technologies

The MyStory website uses first-party cookies and similar state: authentication and session tokens to keep you signed in and to secure the Service, and a language-preference cookie that remembers your chosen display language. We do not use analytics cookies.

Advertising technologies are not in use today. When advertising is introduced, cookies, device advertising identifiers, or similar technologies may be used to deliver and measure advertisements on adult accounts only, and only where local law allows or where you have agreed. No advertising cookies or advertising identifiers are used on accounts belonging to, or managed on behalf of, anyone under 18.

The MyStory mobile app does not use cookies, web beacons, or cross-app or cross-website tracking. Authentication and session tokens are stored securely on your device (device keychain / secure storage) only to keep you signed in.

10.2 Managing Local Data and Advertising Choices

You can clear locally stored data, including the language-preference cookie, through your browser settings (web) or by signing out or uninstalling the app (mobile).

Adult account holders can reset or limit their device advertising identifier in their device settings. Free accounts will see advertisements, and these cannot be switched off; paid subscribers will have advertising preferences they can adjust. Where personalised advertising requires your consent, you can withdraw that consent at any time and continue to see non-personalised advertisements instead.

11.1 Technical Safeguards

Encryption:

• Data is encrypted in transit using industry-standard TLS
• Credentials and tokens are stored securely

Access Controls:

• Role-based access permissions for personnel
• Access to production systems is restricted and reviewed

Monitoring:

• Security logging and monitoring
• Periodic security reviews

11.2 Organizational Safeguards

Staff Practices:

• Privacy and safeguarding awareness for personnel
• Incident response procedures

Policies and Procedures:

• Privacy-by-design principles
• Periodic policy reviews and updates

11.3 Incident Response

In the event of a data breach:

• Containment and investigation
• Notification to supervisory authorities where required (for example, within 72 hours under UK GDPR)
• User notification when legally required or where there is a high risk to individuals
• Remedial and preventive action

MyStory integrates with a limited set of third-party services. This Privacy Policy does not apply to third-party sites or services you may access. We recommend reviewing their privacy policies.

Third-Party Services We Use:

• Firebase Authentication (only if you choose to sign in with Google or Apple), to verify your identity
• Your registered educational institution's systems, where you participate with an institution
• App store billing providers, and a card payment provider for website subscriptions
• Advertising providers such as Google AdMob, once advertising is introduced, on adult accounts only

13.1 Notification of Changes

We may update this Privacy Policy periodically. When we make material changes:

• Users will be notified via email and in-app notifications
• Parents/guardians will be notified directly for child accounts
• The updated policy will be posted on our website
• Continued use implies acceptance of changes

13.2 Significant Changes

For significant changes affecting:

• Children's data processing
• Data sharing arrangements
• Legal bases for processing
• International transfers

We will seek renewed consent where legally required.

14.1 Privacy Inquiries

Data Protection Officer: dataprotection@mystory.global

General Privacy Questions: dataprotection@mystory.global

14.2 Company Details

Harmony International Limited, registered in the Isle of Man, Company Number 135072C

14.3 Supervisory Authority

If you're not satisfied with our response to your privacy concerns, you can contact:

• Information Commissioner's Office (ICO)
• Website: https://ico.org.uk
• Telephone: 0303 123 1113

14.4 Urgent Safeguarding Concerns

For urgent child protection matters: safeguarding@mystory.global

Child/Minor: Any user under the age of 18

Adult Account Holder: A user who has reached the age of legal adulthood in their country (18, or 16 where that is the local threshold)

Educational Institution: Schools, colleges, universities, and other registered educational providers

External Agencies: Third-party organizations providing educational services, training, or certification

Parent/Guardian: Legal guardian responsible for a child user's account

Personal Data: Any information relating to an identified or identifiable individual

Personalised Advertising: Advertising selected using information about your interests or activity

Processing: Any operation performed on personal data

Service: The MyStory platform and associated services

This Privacy Policy is effective as of stated Last Updated date and governs the collection, use, and disclosure of information through the MyStory platform.