Privacy Policy

This Privacy Policy explains how Midaspair ("Midaspair", "we", "us", or "our") collects, uses, shares, and protects information when you use the Midaspair mobile application and related services (the "Service"). Midaspair helps founders build a business: daily mindset lessons, a private AI coach, idea validation and AI business-plan generation, and opt-in matching with potential co-founders. By creating an account or using the Service, you acknowledge the practices described below.

1. Who we are

Midaspair provides an AI-powered companion for founders and aspiring entrepreneurs: daily mindset content, a private AI coach, idea validation, AI-assisted business-plan generation, and optional co-founder matching. The data controller for personal data processed through the Service is the entity operating Midaspair. Contact details are in section 14.

2. Information we collect

2.1 Information you provide

Category	Examples
Account	Name, email, password (hashed), date of birth, language, profile photo, optional gender, country.
Co-founder matching (optional)	Match profile: headline, bio, role, skills, industries, what you're looking for, profile photos, and a single private "selfie on file" used only for trust & safety (see section 2.4). Swipes, likes, and matches you create.
Business ideas & plans	Idea title, description, target customer, location, website, and financial figures you enter; AI-generated validation results and business plans.
Conversations	Text and voice messages you exchange with the AI coach or with a matched co-founder, images you choose to send, AI-generated replies, and journal entries you write.
Support	Messages and attachments you send when contacting us.

2.2 Information collected automatically

• Device & technical: device model, OS version, app version, language, time zone, crash logs, performance traces.
• Usage: screens viewed, features used, in-app events (without the content of your conversations).
• Network: IP address (truncated where feasible), approximate region derived from IP.
• Push tokens: a device push token if you enable notifications.

2.3 Information from permissions you grant

• Microphone: only when you record a voice message or start a voice session.
• Camera / Photo Library: only when you attach an image or set a profile photo.

We do not access your microphone, camera, contacts, or location in the background.

2.4 Photos and selfies — no facial recognition

Midaspair lets you add profile photos to your co-founder match profile and a single private “selfie on file.” These are ordinary photographs. We do not use facial recognition, we do not create, derive, or store face geometry, faceprints, face templates, or any other biometric identifier, and we do not perform liveness detection or automated face matching. The selfie on file is stored privately, is never shown to other users, and is only ever viewed by a member of our trust & safety team if your profile is reported — to check, by eye, that the account belongs to a real person and is not an impersonation. You can delete your photos and selfie at any time from your match profile, or delete your whole account from Settings → Delete my account. Photos and selfies are not sent to our third-party AI provider.

3. How we use information

• To provide and operate the Service (accounts, mindset lessons, AI coach replies, idea validation, business-plan generation, co-founder matching, messaging, notifications).
• To personalize coaching prompts, lessons, and reflections to your goals and preferences.
• To match you with potential co-founders when you opt into matching.
• To maintain safety: detect crisis signals, abusive content, and verify that match profiles are genuine.
• To diagnose crashes and improve reliability and performance.
• To prevent fraud, abuse, and violations of our Terms.
• To comply with legal obligations.

4. Legal basis for processing (EEA / UK)

• Contract — to deliver the Service you signed up for.
• Consent — for optional features such as voice processing, sensitive personal categories, and marketing communications. You can withdraw consent at any time.
• Legitimate interests — for safety, fraud prevention, security, and product improvement, balanced against your rights.
• Legal obligation — to respond to lawful requests and meet regulatory duties.

5. How we share information

We do not sell personal data and we do not share it for cross-context behavioral advertising. We share only as follows:

• Service providers (processors) who help us operate the Service under contract — cloud hosting, storage, push notifications, analytics, error monitoring, email delivery.
• AI providers for generating responses (see section 6).
• Other members only when you opt into co-founder matching — your match profile and the messages you send in a match conversation are shared with the member you matched with. Your private “selfie on file” is never shown to other members.
• Legal & safety when necessary to comply with law, enforce our Terms, or protect rights, property, or safety.
• Successors in a merger, acquisition, or asset transfer, with continued protections.

6. AI services (third-party processing)

Some Midaspair features are powered by a third-party AI provider, OpenAI, L.L.C. (United States), which acts as our data processor. What we send: only the content described below — never your email, password, account credentials, profile photos, or selfie. Your permission: the first time you use an AI feature, the app shows an in-app disclosure naming OpenAI and the data involved, and asks for your consent; if you decline, your content is not sent and the AI feature does not run. Midaspair uses OpenAI for two features:

• AI Coach. When you send a message to the in-app coach, the message and a minimal amount of conversation context are transmitted to OpenAI for inference. Crisis-keyword detection happens on our servers before the message reaches OpenAI, so messages that match safety patterns never leave our infrastructure.
• AI business-plan generation. When you generate or validate a business plan, the idea details you submit (title, description, target customer, location, website, and any financial figures) are sent to OpenAI to produce the plan sections. Sections may also be enriched with public market-research data via OpenAI's web-research tools.

We have a data-processing agreement with OpenAI. Under OpenAI's API terms, your content is not used to train their models, and it is not retained on OpenAI's side beyond the operational minimum. You can withdraw consent by deleting your data or your account at any time; doing so stops further AI processing of that content.

AI outputs can be inaccurate. They are not a substitute for professional financial, legal, medical, or psychological advice. You can request a full export or deletion of your data — including AI conversation history and generated plans — at any time from Settings → Export my data and Settings → Delete my account in the app.

7. Retention

• Account data is retained while your account is active.
• Conversations are retained until you delete them or your account.
• Backups are rotated on a rolling schedule (typically 30 days).
• Crash and diagnostic logs are retained for up to 90 days.
• Records we are legally required to keep (e.g. tax, fraud) are retained for the period required by law.

8. International data transfers

Personal data may be processed in countries other than your own, including the United States and the European Economic Area, depending on where our service providers operate. Where required, transfers are governed by Standard Contractual Clauses or an adequacy decision.

9. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data ("right to be forgotten").
• Port your data in a structured, machine-readable format.
• Object to or restrict certain processing.
• Withdraw consent for processing based on consent.
• Lodge a complaint with your local data protection authority.

You can exercise most of these rights directly from the app (Settings → Account). To request deletion or export, see our Account Deletion page or email us at the address in section 14.

9.1 California (CCPA / CPRA) residents

California residents have rights to know, delete, correct, and limit the use of sensitive personal information, plus the right not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising.

10. Security

We use encryption in transit (TLS 1.2+) and at rest, scoped database access, audit logging, multi-factor authentication for administrative access, and least-privilege controls. No system is perfectly secure; we work continuously to harden ours. See the Security overview for more.

11. Children & minors

Midaspair accepts users aged 6 and older. Different protections apply depending on age and region:

• Under 13 (or under 16 in the EEA / EU): a parent or legal guardian must give verifiable consent before the account becomes usable. We collect the parent's email address at sign-up, send a one-time consent link, and only activate the account after the parent has clicked it on our consent page. This is how we comply with the U.S. Children's Online Privacy Protection Act (COPPA) and the EU GDPR-K rules.
• Ages 13–17 (outside EU): the user signs up directly. The AI runs in a stricter "minor mode" with hardened content filters and crisis-handling rules.
• Under 6: not permitted on Midaspair.

What we collect from minors

Email, display name, date of birth, country, language, optional gender, profile photo, conversation content, AI-derived memory facts, mood logs, and parent's email (for under-13/EU under-16 only). We do not collect or display precise location, device contacts, or social graph from outside the family nest.

Lawful basis for processing minors' data

Consent of the parent or guardian (Article 8 GDPR; COPPA §312.5). For 13–17 users outside the EU we rely on the user's own consent, obtained at registration when they accept this policy.

Special protections we apply to minor accounts

• No behavioral or targeted advertising. Ever.
• Minors' personal data is not used to train AI models.
• The AI runs in age-banded "child mode" (6–12) or "minor mode" (13–17) with stricter content guardrails and a hard rule to redirect crisis topics to a trusted adult and a regional helpline.
• One household member's private chat is never exposed to another member's AI session.
• Sensitive features (e.g. open-ended voice sessions) may be disabled for minor accounts.

Retention & deletion

A minor's account and all derived data (chats, memory facts, files) are deleted within 30 days of a verified deletion request from the minor or the consenting parent.

Parental rights

If you are a parent or legal guardian, you may request access to, correction of, or deletion of your child's data; withdraw consent; or ask us to stop further processing. Email privacy@midaspair.com from an address we can use to verify your relationship with the child. Full details on our Children's Privacy page.

12. Wellbeing-adjacent information

Midaspair is a founder mindset and business-coaching companion, not a medical, mental-health, or therapy service. We do not diagnose, treat, or cure any condition, and the app is not a substitute for professional care. As part of normal use, the Service may collect and store free-text content that can touch on your emotional state, including:

• Daily mindset check-ins, mood logs, and reflective prompts.
• Journal entries you write.
• Free-text chat content discussing stress, motivation, or setbacks.

This information is treated with the same encryption-in-transit, access controls, and retention rules as the rest of your account data, and is never sold or used for behavioral advertising. If a conversation triggers our safety pipeline (e.g. self-harm cues), we surface a region-appropriate crisis-resource referral inside the app; we do not transmit that signal to third parties.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the app or by email before they take effect. The "Last updated" date at the top of this page indicates the latest revision.

14. Contact us

For privacy questions or to exercise your rights, contact us at:
privacy@midaspair.com