MyaGuide Reception — Privacy Statement
Document: Privacy Statement · Product: MyaGuide Reception · Version 1.1 · International edition: 2 October 2026
1 Introduction
1.1 This privacy statement explains how Van Riemsdijk & Karman S.L., operating under the name MyaGuide ("MyaGuide", "we"), established in Jávea, Spain, NIF ESB21983580, processes personal data in connection with MyaGuide Reception (the "Service").
1.2 MyaGuide Reception gives residents of shelter and reception locations access to information that the organisation managing the location has approved and published, via a Guide and via Mya, a text interface for questions. This statement applies to (a) employees and other authorized users of a Responsible Organisation who manage the Service and (b) Residents who use the Service without an account.
1.3 Read this statement together with the Terms of Use, the Cookie Statement, the AI & Data document and the Accessibility Statement. Terms with an initial capital letter have the meaning given in the Terms of Use. "Resident" is a functional term for someone who uses the Service at a Location and does not say anything about residence rights, nationality or legal status.
2 Who is responsible for what
2.1 For the location information service, the Responsible Organisation (the organisation, or an implementer designated by it) is the controller. It determines which information is published, who has access and for what purpose. MyaGuide is its processor and acts on its documented instructions. This applies to the published information, the temporary processing of Residents' questions, employee accounts, security logs, language aggregates, content translations and support on behalf of the organisation. The arrangements are set out in a data processing agreement between the organisation and MyaGuide.
2.2 MyaGuide is itself controller only for: its contract and invoice administration with organisations, requests from organisations that are not yet customers, and its own staff.
2.3 For questions about the processing of your data as a Resident, the Responsible Organisation of your Location is the first point of contact. You can also contact MyaGuide (article 14); we will then forward your request.
3 What data is processed
| Category | Data | Explanation |
|---|---|---|
| Residents' questions and answers | Typed question (maximum 1,000 characters), Talk audio, selected language, needed temporary context, short public query, source links and answer | Processed temporarily only to create the answer. Not stored in a database or in the browser. Temporary processing in page and conversation-service memory, subject to the clearing rules in section 4.2 |
| Technical traffic data | IP address, browser and request metadata, Guide identification | Needed to provide and secure the web service. Security limits work with encrypted derivatives, not with your IP address as a key |
| Language requests | Organisation, Location, requested language, week and count | Without identity, question text or IP address. Organisations only see rough counts over four completed weeks; counts below five are hidden, others are rounded down to five |
| Published location information | Opening hours, rules, facilities, contact persons and other content approved by the organisation | May contain business contact details of employees or aid workers; the organisation is responsible for lawful inclusion |
| Employee accounts | Name, business email address, authentication and session data, roles, location assignment, invitations, management and publication history | For authorized access and traceability of management actions |
| Content translations | Title and text of approved content, source and target language | Source information is automatically translated with OpenAI into the other supported languages. The organisation manages the source information; there is no translation approval step. This source-translation flow does not contain resident questions; resident Chat/Talk processing is described in section 6 |
| Support and requests | Name, email address, organisation, subject, message and any attachments you send yourself | For support and answering requests |
| Business administration | Contact persons, contract, capacity and invoice data of organisations | For service provision and invoicing; does not contain resident data |
4 No account, no profile
4.1 You do not need to create an account, register or provide your name or other identifying data to use Mya. The Service is designed so that use does not result in a stored profile about you: no registration of your identity, your presence at a Location or the questions you have asked.
4.2 Conversations and unsent text exist only temporarily in the open page’s memory. They clear after 2 minutes without activity; a warning appears after 90 seconds, giving you 30 seconds to continue. End conversation, closing the chat or Escape, moving the page to the background or locking the device, leaving the page, and changing language or location clear the conversation and input. Refreshing, back/forward navigation and restored tabs start empty. Previous conversations are not recovered; only the language preference may persist. A late response cannot bring back a cleared conversation. End the conversation before handing over a shared device: immediate physical handover cannot be detected.
5 Purposes, legal bases and retention periods
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Providing information to Residents | Question, answer, language; technical traffic data | The Responsible Organisation identifies and documents its applicable legal basis under Article 6 GDPR. Public-task processing applies only where the organisation is legally entrusted with that task | Question and answer: not stored by the application; temporary rate-limit keys: 1 minute to 1 hour; infrastructure logs: according to the agreed retention schedule and hosting configuration |
| Language planning | Language aggregates | The legal basis documented by the Responsible Organisation for its information service | 13 months |
| Management and publication | Employee accounts, roles, content, publication history | The legal basis documented by the Responsible Organisation for its information service; employee data on the basis of the employment relationship | Accounts 12 months after access ends; content during the service; drafts 12 months |
| Security and abuse prevention | Technical traffic data, security logs | The applicable legal basis documented for the service and its security; MyaGuide acts on the organisation’s instructions | According to the agreed retention schedule and hosting configuration; details available on request |
| Translation of content | Approved title and text | The legal basis documented by the Responsible Organisation for its information service | API response storage disabled; provider abuse-monitoring retention can apply, with legal/security exceptions and no zero-retention guarantee |
| Support and requests | Name, contact details, message, attachments | Performance of the service (on behalf of the organisation) or pre-contractual request (MyaGuide) | 12 months after completion; sending logs 30 days |
| Contract and billing | Business details of organisations | Performance of the agreement and applicable Spanish accounting and tax retention obligations | Kept for the applicable statutory periods; specific retention schedules are available on request |
Special categories of personal data (such as health, origin, religion or criminal data) are not requested. Do not type these in a question to Mya; there is no automatic filter that recognizes all sensitive information. Unintentionally entered sensitive information is not stored and is not used further.
6 How Mya works
6.1 Mya helps with the information your organisation has published for this location. You can type or speak. OpenAI processes your question and the location information needed to make an answer; for Talk, OpenAI also processes audio. There is no video avatar. For general public information outside the location, Mya can search the internet using a short search query instead of your full conversation. Do not share names, identification numbers, medical details or other personal or confidential information; automatic checks do not recognise everything. Mya shows source links for external information. A listed opening time does not guarantee that a service is available now. Information can be incorrect or outdated. For personal or professional help, Mya refers you to staff; for urgent help, approach a staff member on site immediately.
6.2 MyaGuide does not keep a permanent resident conversation or resident profile. During an active conversation, the service temporarily processes questions, audio and the information needed to answer. Existing clearing rules still apply. MyaGuide disables OpenAI API response storage and does not instruct model training. This does not guarantee zero provider retention: security and abuse monitoring can retain data. Existing processor and international transfer arrangements remain applicable. OpenAI also provides automatic source translation and analysis of filtered document text for private proposals.
7 Recipients of personal data
7.1 MyaGuide engages the following sub-processors. They process solely for the stated purpose and are contractually bound by the same protection obligations.
| Sub-processor | Purpose | Data | Location and transfer |
|---|---|---|---|
| Cloudflare, Inc. (US) | Hosting, security and delivery of the Service | Temporary traffic of Residents and staff, network metadata | Global delivery network; processing locations depend on the applicable hosting configuration; EU-US Data Privacy Framework and EU standard contractual clauses |
| Supabase, Inc. | Database and staff authentication | Published content, staff accounts, publication history, language aggregates; no conversations | Ireland (eu-west-1); EU standard contractual clauses for any support access from outside the EEA |
| OpenAI Ireland Ltd | Chat, Talk, public web searches, automatic translation and document analysis | Resident questions, needed temporary context and location information; Talk audio; short public queries; approved content and filtered document text | International processing under the applicable OpenAI DPA and transfer safeguards; response storage disabled, no EU-only or zero-retention guarantee |
| Fly.io, Inc. | Hosting the conversation service | Temporary question, source information, context and technical metadata; no permanent resident conversation | Conversation host in Amsterdam; possible international support/infrastructure processing; applicable DPA and transfer safeguards must be demonstrable, no EU-only guarantee |
| Plus Five Five, Inc. (Resend, US) | Sending invitation and support email | Recipient, message content, sending data | US; EU standard contractual clauses |
| Google Ireland Limited (Google Workspace) | Support mailbox | Support email and attachments | Processing locations depend on the applicable Google Workspace configuration; EU-US Data Privacy Framework and EU standard contractual clauses |
7.2 The Responsible Organisation sees its own staff, content and administrative data and coarse language reports. It cannot retrieve an individual question or answer from a Resident; these are not stored.
7.3 In addition, data may be shared with professional advisers where necessary, with authorities when the law requires it, and with a legal successor in the event of a transfer of the business with continuation of this protection. MyaGuide does not sell personal data and does not use Residents' data for training, advertising or product analysis.
8 Transfers outside the EEA
Some sub-processors are established in or have access from the United States. Transfers rely on the EU-US Data Privacy Framework for certified recipients and otherwise on the EU standard contractual clauses (Decision (EU) 2021/914), supplemented by an assessment of the level of protection and, where necessary, additional measures. A copy of the applicable safeguards can be requested via article 14.
9 Security
MyaGuide takes technical and organizational measures to protect personal data, including encrypted transport, role-based access control, separation between organisations in the database, limited logging, backups managed under the applicable processing agreements and configured retention settings and a monitored reporting channel for incidents. No method of storage or transport is completely secure. MyaGuide does not claim certification according to a specific security standard.
10 Your rights
10.1 You have the right of access, rectification, erasure, restriction of processing, objection and data portability, insofar as the GDPR grants these, and the right to lodge a complaint with a supervisory authority: the competent supervisory authority, including the Agencia Española de Protección de Datos (Spain).
10.2 There is no stored copy of your conversation with Mya that can be accessed or deleted. A request will however be assessed for data that do exist, such as support messages or published content in which you are mentioned.
10.3 Address your request in the first instance to the Responsible Organisation of your Location. A request sent to MyaGuide will be forwarded by us within two working days. We do not ask for more identifying data than necessary to handle your request.
11 Children and vulnerable Residents
Locations may house families, unaccompanied minors and people in a vulnerable situation. The Service does not ask for age or identity and does not try to determine whether a user is a minor. Data minimization applies equally to every Resident. Supervision of the use of digital services by minors at a Location is the responsibility of the Responsible Organisation.
12 Cookies
Conversations are not stored in cookies or browser storage. Only the chosen language may be remembered as a browser preference. No analytics, marketing or tracking cookies are used on the pages for Residents. See the Cookie Statement.
13 Changes
We may amend this statement. In the event of a material change, a new effective date will be stated and we will display a notice in the Service at the start of a new session. Organisations will be informed separately.
14 Contact
Van Riemsdijk & Karman S.L. (MyaGuide)
Jávea, Spain
reception@myaguide.com
15 Version history
| Version | Date | Changes |
|---|---|---|
| 1.0 | 6 September 2026 | First final version, in accordance with the Reception Service Agreement and data processing agreement v1.0. Replaces all previous drafts |