This Privacy Notice explains how MyDay ("we", "us") collects, uses, and protects your personal data when you use the MyDay service.
Who we are
MyDay is the controller of your personal data for the purposes of UK GDPR and equivalent laws.
What we collect
- Account data: email address, display name, role (parent / organisation), authentication credentials.
- Profile content: children's first names, the routines, activities, symbols and photos you upload.
- Usage data: basic logs (timestamps, device type, IP address) for security and reliability.
- Support messages: any correspondence you send us.
How we use your data
- To create and operate your MyDay account (contract performance).
- To deliver the routines and picture symbol board features (contract performance).
- To prevent fraud and keep the Service secure (legitimate interests).
- To respond to support requests (legitimate interests).
- To comply with legal obligations (legal obligation).
Who we share data with
- Hosting and infrastructure providers who run the database, storage and authentication systems on our behalf.
- Paddle.com Market Limited, our Merchant of Record, for payment processing, subscription management, tax compliance, and invoicing.
- Professional advisers (legal, accounting) where strictly necessary.
- Authorities where required by law.
International transfers
Some of our service providers are located outside the UK/EEA. Where personal data is transferred internationally we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.
Retention
We keep your personal data only for as long as we need it:
- Active accounts: account and profile data (including children's profiles, routines, symbols, uploaded photos and calendar events) are kept for as long as your account is active.
- Inactive accounts: if you have not signed in for 24 months, we will notify you by email and, unless you sign in again within 30 days, permanently delete your account and all associated data.
- Account deletion: when you deactivate your account from Settings, your profile, children, routines, symbols, uploaded photos, calendar events and feedback are permanently deleted within 30 days.
- Support messages and feedback: retained for up to 24 months after your last contact so we can follow up and improve the service.
- Security and access logs: retained for up to 12 months for fraud prevention and troubleshooting.
- Billing records: where applicable, retained by our payment processor for up to 7 years to comply with tax and accounting law.
- Backups: deleted data may persist in encrypted backups for up to 35 days before being overwritten.
Your rights
Subject to applicable law you have the right to access, rectify, erase, restrict or object to processing of your personal data, the right to data portability (use "Download my data" in Settings), and the right to withdraw consent. You also have the right to lodge a complaint with your local supervisory authority. We will respond within 1 month of a verified request.
Security
We use industry-standard technical and organisational measures (TLS in transit, encryption at rest, scoped access controls) to protect your data.
Children's data and parental consent
MyDay is designed to support children with autism and other additional learning needs, but the service is only for use by parents, legal guardians, caregivers and authorised support organisations— not by children directly on their own account. Child portals are activated by a parent through an invite link and hold no email, password or contact details for the child.
Under the UK GDPR and EU GDPR (Article 8), where personal data about a child is processed on the basis of consent, that consent must be given or authorised by the holder of parental responsibility for any child under the applicable age of digital consent (13 in the UK; 13–16 in EU/EEA member states, depending on national law).
By creating an account and adding a child profile, routines, symbols or photos to MyDay, you confirm that you are the parent or legal guardian of that child (or have the explicit permission of the parent or legal guardian, for organisations), and you provide consent on the child's behalf for us to process that information for the purposes described in this Notice.
You can withdraw consent at any time by deleting the child's profile, deactivating your account, or contacting us. Organisations using MyDay on behalf of families must obtain and document parental consent before adding a child to the service and remain responsible for that consent.
We do not knowingly collect personal data directly from children, do not use children's data for advertising, do not profile children, and do not sell children's data.
Contact
For any privacy question or request, contact us through your in-app Settings page.