This policy describes how Myra Security GmbH ("we", "us") processes personal data when you use the MYRA AI product — the web application at ai.myra.eu and the MYRA AI mobile apps for iOS and Android. It supplements our corporate privacy policy, which covers our public website, sales process, and DDoS-protection, WAF, CDN, and bot-management products. Where the two policies overlap, this policy prevails for MYRA AI.
Myra Security GmbH
Landsberger Str. 187, 80687 München, Germany
Phone: +49 89 41 41 41 – 345
Email: info@myrasecurity.com
We have appointed an external Data Protection Officer:
Christian Volkmer
Projekt 29 GmbH & Co. KG
Ostengasse 14, 93047 Regensburg
Tel.: +49 941 298693-0 · Fax: +49 941 298693-16
Email: info@projekt29.de
MYRA AI is a hosted gateway that routes conversational inference requests from end users to large language model providers selected by your organisation's administrator. Your administrator configures which providers, models, and policies apply to your account.
Email address, display name, organisation (tenant), role, language preference, and authentication state. We use email for login (one-time code) and for service-related notifications.
If you sign in or register with a Google account (“Sign in with Google”), Google transmits your name, e-mail address, profile picture URL and a Google account identifier (OpenID Connect subject) to us. We store only the name, the e-mail address and the account identifier, and use them solely to create and sign you in to your Myra AI Workspace account and to display your name. They are stored on EU servers for the lifetime of your account, are never sold and are not shared with third parties except as described in section 5, and are deleted with the account (section 9; audit entries follow the retention in section 7). Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Legal basis: Art. 6(1)(b) GDPR.
When you register, we store with your account the campaign parameters and the advertising click ID of the link you arrived through, if it carried any, and the host name of the website you came from. We use this to measure which marketing channels and ads lead to registrations and purchases (legitimate interest, Art. 6(1)(f) GDPR). For this, we may report your registration or purchase (its time and, for a purchase, the price) to the advertising platform whose ad you clicked, from your browser or from our servers. The data is kept as long as your organisation's account exists, and you may object to this processing at any time (Art. 21 GDPR).
The prompts you send, the assistant responses you receive, files you upload for processing, and any project-level instructions configured by your administrator. Conversations are stored in our database under your account so you can return to them.
When you use the iOS or Android app we additionally process:
IP address, request timestamps, user-agent, gateway and model selected per request, error codes, and rate-limit counters. Server access logs are kept only transiently for operational monitoring; request records stored in our database are subject to the retention limits described in section 7.
If you flag a model response as offensive, inaccurate, or unsafe, we record the reported message, the conversation ID, your account ID, and the time of the report so we can review it and improve our content filtering.
We do not collect contacts, calendar, photos, microphone input, camera input, precise or approximate location, or advertising IDs. The mobile apps contain no third-party advertising or analytics SDKs.
When you send a prompt, MYRA AI forwards it to the model provider selected for your gateway. The table below is our sub-processor register — the same list as in our Trust Center (its entries are maintained in German). It covers the AI model providers your prompts may be sent to, depending on what your administrator has configured, as well as the contracted web-search providers described in section 5.2 and the push services described in section 5.4:
Your administrator can also use self-hosted open-weight models (e.g. vLLM) operated by Myra Security GmbH (EU) or by your organisation itself.
Each AI model provider processes prompts and responses under its own terms. Where your administrator configures a custom endpoint for one of these AI model providers, your prompts are sent to that endpoint instead of the provider's standard host. Your administrator controls which providers are enabled for your gateway. We have data processing agreements with the providers we enable by default; where your administrator connects an additional provider using your organisation's own credentials, that provider processes your data under its own terms and your organisation's agreement with it.
Our Trust Center shows the same list together with upcoming changes and the change history.
If web search is enabled for your gateway, MYRA AI forwards your search query to a web-search provider. Which one is used depends on your gateway configuration:
Some AI model providers can perform web search themselves; where that is used, your search query is sent to the model provider handling your request rather than to a separate search provider.
A gateway uses one search provider at a time, according to its configuration. We have data processing agreements with the contracted search providers (Brave and Linkup).
MYRA AI does not enable any tool connector by default. Whether the assistant may use an external tool or connector is always a choice you or your administrator make. When such a connector is enabled and the assistant uses it, the tool-call arguments derived from your prompt are sent to the third-party service that provides that tool, which processes them under its own terms.
A connector may be one of the options MYRA makes available for you to choose from, one you authorise with your own account (for example a notes, ticketing, or chat service you already use), or a custom connector you or your administrator configure. MYRA does not control which connectors you enable or where the underlying service is based, and it may be located outside the EU. Your administrator can review and manage the connectors available in your workspace.
Push notifications are delivered through Apple Push Notification service (Apple Inc., United States) on iOS and Firebase Cloud Messaging (Google LLC, United States) on Android. Notification payloads contain only what is needed to render the notification and to open the relevant conversation.
Login codes and service emails are sent from Myra Security's own mail server; we do not use a third-party email delivery provider.
Application servers and databases run on Myra Security GmbH's own virtualisation cluster (QEMU/KVM) in a data centre in Germany. Myra operates and controls the hypervisor, storage, and databases; MYRA AI is not hosted on a third-party public-cloud platform.
We disclose data to law-enforcement or regulatory authorities only where we are legally required to do so.
We do not sell personal data, and we do not share it for third-party advertising. To measure the success of our own ads, we may report a registration or purchase to the advertising platform whose ad you clicked (see section 3).
Several recipients listed in section 5 are based outside the European Economic Area — most in the United States, and, depending on which providers your administrator enables, also Canada and countries without an EU adequacy decision such as China. Transfers to providers we enable by default rely on a European Commission adequacy decision where one exists (for example Canada), the EU–US Data Privacy Framework where applicable, and otherwise on the European Commission's Standard Contractual Clauses (SCCs) together with supplementary technical measures. Additional model providers (section 5.1) and tool connectors (section 5.3) that you or your administrator choose to enable process data under their own terms and under your organisation's or your own agreement with them; you or your administrator decide whether to enable them, and some may be based outside the EU. The one recipient we contact automatically, without any such safeguard, is the optional weather service wttr.in (section 5.2): it is contacted only for gateways without EU residency enforcement, and is never contacted when EU residency is enforced.
Subject to GDPR you have the right to access, rectify, erase, or port your personal data, the right to restrict or object to processing, and the right to withdraw consent. To exercise any of these, contact info@myrasecurity.com. You also have the right to lodge a complaint with a supervisory authority; our lead authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).
MYRA AI offers two distinct paths, with different effects on your data.
In the app, open Profile → "Delete Account" and confirm. This has the following effects:
Your conversations, uploaded files, feedback, content reports, and the account record itself are retained so an administrator can restore your account on request. Restoration is performed only by an administrator on your written request to info@myrasecurity.com; you cannot reactivate the account yourself.
You can permanently erase your data yourself in the app: open Profile → "Erase all my data" and confirm by typing your email address. This takes effect immediately and is irreversible — your conversations, uploaded files, feedback, content reports, and account record are removed and cannot be restored by you or an administrator. If you cannot sign in, you can instead request erasure by writing to info@myrasecurity.com from your registered address with the subject "Erase my MYRA AI data"; we will confirm completion within 30 days. Records that we are legally required to retain (for example billing and tax records, see section 7) are kept for the statutory period.
MYRA AI surfaces output from large language models. Model output can be inaccurate, incomplete, biased, or otherwise inappropriate. Do not rely on it for medical, legal, financial, or safety-critical decisions without independent review. Do not enter information you would not want stored or processed by the model providers listed in section 5.
Each assistant message can be reported from inside the app (long-press or overflow menu → "Report"). Reports are reviewed by our team and used to improve filtering. Reports do not generate automated responses.
Connections to MYRA AI are encrypted in transit with TLS (TLS 1.2 or higher), terminated at our edge. Provider API keys, OAuth secrets, and other credentials are encrypted at rest using authenticated symmetric encryption (AES-256 with HMAC) and a master key held outside the application database. Access to production systems is restricted to authorised personnel.
MYRA AI is not directed to children. The service is intended for users aged 18 and over. We do not knowingly process personal data from children. If you believe a child has used the service, contact info@myrasecurity.com and we will delete the account.
When we make material changes we will update the effective date at the top of this page and, where appropriate, notify you in the app.
Questions about this policy or your data: info@myrasecurity.com.