Privacy Policy

MyDirector-OS is operated by Ian Fordyce Smith trading as MyDirector-OS ("MyDirector-OS", "we", "us", "our"), a sole trader established in Guernsey. For the personal data we process about you in connection with your account and use of the Service, we act as the data controller. This Privacy Policy explains what we collect, why, who we share it with, and your rights.

1. Personal data we collect

• Account data — name, email address, password (hashed), and authentication identifiers.
• Profile and content — directorships, companies, meetings, documents, board packs, resolutions and any other content you choose to upload.
• Support and communications — messages you send us and our responses.
• Usage and device data — minimal telemetry including IP address, browser/device identifiers, pages visited and actions taken, used to operate and secure the Service.
• Billing identifiers — a subscription/customer reference from Paddle (our Merchant of Record). Card details and billing addresses are collected and stored by Paddle, not by us.

2. Why we process your data and legal basis

• To provide the Service (creating your account, storing your content, delivering features) — performance of our contract with you.
• Security and fraud prevention (detecting abuse, protecting accounts) — our legitimate interests and legal obligations.
• Service improvement and analytics (understanding usage, fixing bugs) — our legitimate interests.
• Customer support — performance of our contract and our legitimate interests.
• Service announcements and transactional emails — performance of our contract.
• Marketing emails (if any) — your consent, which you can withdraw at any time.
• Legal and regulatory compliance — compliance with our legal obligations.

Your data is private to you and is not used to train AI models.

3. Who we share data with

We share personal data only with the following categories of recipients, under written data processing terms:

• Paddle.com Market Ltd — our Merchant of Record. Paddle processes payments, manages subscriptions and issues invoices on our behalf. See Paddle's privacy notice at paddle.com/legal/privacy.
• Infrastructure and hosting providers — for hosting the application, database and file storage.
• Email delivery providers — for transactional and account emails.
• Professional advisers — accountants, auditors and lawyers where reasonably necessary.
• Authorities — where required by law, court order or to protect our rights.

We do not sell your personal data.

4. Data retention

We retain your account and content for as long as your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable period (typically 30 days), except where we are required to retain certain records (for example, billing records held by Paddle for accounting purposes, or data we must keep to comply with legal obligations). You can export or delete your data from within your account at any time.

5. International transfers

Some of our service providers may process data outside Guernsey, the UK or the EEA. Where this happens, we rely on appropriate safeguards such as adequacy decisions, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses, to ensure your data receives an equivalent level of protection.

6. Your rights

Under the Data Protection (Bailiwick of Guernsey) Law, 2017 (and, where applicable, the UK GDPR and EU GDPR), you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request erasure ("right to be forgotten");
• restrict or object to certain processing;
• data portability;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with the Office of the Data Protection Authority in Guernsey (odpa.gg), or with your local supervisory authority if you are resident in the UK or EEA.

We will respond to verified requests within one month.

7. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), encryption of board packs and personal documents at rest, role-based access controls, row-level security in our database, audit logging and regular backups. No system is perfectly secure, but we take protection of your data seriously.

8. Cookies

We use a small number of essential cookies required to sign you in and keep your session active. We do not currently use third-party advertising or marketing cookies. If we add analytics cookies in future, we will update this notice and (where required) request your consent via a cookie banner.

9. Children

The Service is not intended for individuals under 18 and we do not knowingly collect their data.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or via the Service.

11. Contact

For any privacy questions or to exercise your rights, contact us via our contact page. The data controller is Ian Fordyce Smith trading as MyDirector-OS (Guernsey).