Version 1.3 — Last updated: 13 October 2026
MyAvatar ApS ("we", "us", "our") is the data controller for personal data processed through the MyAvatar platform. We are registered in Denmark, CVR DK46477944.
Contact: privacy@myavatar.dk
| Category | Examples | Purpose |
|---|---|---|
| Account data | Name, email, password | Account management |
| Payment data | Billing address, last 4 digits of card | Payment processing (via Stripe) |
| Usage data | Videos created, features used, session logs | Service improvement, billing |
| Content data | Scripts, uploaded images, generated videos | Service delivery |
| Technical data | IP address, browser type, device | Security, analytics |
| CRM e-mail log (added 12 October 2026) | For each e-mail the customer sends from MyCRM: subject, recipient address, which mailbox sent it, provider message/thread id, time, attachment file names, and the first 200 characters of the message body the customer wrote | Stored on the customer's own contact record (activities, type email). Purpose: the customer's own overview of what they sent. The text is the customer's own outgoing words, not third-party content; the full message is never stored (it stays in the customer's mailbox). Deleted with the contact (data-subject erasure, account deletion, CRM retention purge) and with the customer's account; included in the data-subject export and the account export. Customer is controller. |
We do not store full payment card numbers — these are handled by Stripe (PCI-DSS compliant).
| Processing | Legal Basis |
|---|---|
| Account management | Contract (Art. 6(1)(b)) |
| Payment processing | Contract (Art. 6(1)(b)) |
| Service improvement | Legitimate interest (Art. 6(1)(f)) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
| Marketing (if opted in) | Consent (Art. 6(1)(a)) |
We share data with the following categories of processors (last reviewed 7 September 2026):
We do not sell your personal data to third parties.
If you choose to connect your Google Ads account, MyAvatar requests access to the Google Ads API using the https://www.googleapis.com/auth/adwords scope. This connection is optional and is always initiated by you.
We use this access solely to let you create, review, and manage your own advertising campaigns from within MyAvatar's Campaign Engine, acting on your behalf and at your direction. We access only the Google Ads account(s) you explicitly authorise.
MyAvatar's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:
We do not use data obtained through Google APIs to develop, improve, or train generalized AI or machine learning models.
You can disconnect your Google Ads account at any time from your MyAvatar connection settings, which revokes MyAvatar's stored access and refresh tokens. You may also revoke access directly at myaccount.google.com/permissions.
If you choose to connect Google Calendar, MyAvatar requests a single permission: https://www.googleapis.com/auth/calendar.events.readonly. This is a read-only permission. It lets MyAvatar read events from your calendar so it can identify the people you have met with. It does not allow MyAvatar to create, edit, move, or delete any event, and we do not do so.
When you click "Sync Calendar" in MyAvatar's Lead Generation feature, we read events from the period you select and extract the attendees' names and email addresses, so you can turn people you have met into leads in your own CRM. We read your calendar only when you initiate a sync; no background process reads your calendar.
We store the meeting title, time, and attendee name and email address for the events you sync, as contacts in your own CRM. We store an encrypted OAuth token so we can perform the sync you request. We do not store event descriptions, attachments, or meeting contents. Contacts imported from Google Calendar are kept separately from other CRM data and are never shared with data enrichment providers or AI services.
You can disconnect Google Calendar at any time from your MyAvatar connection settings, which revokes MyAvatar's access at Google and deletes the stored token. You can also revoke access directly at myaccount.google.com/permissions.
MyAvatar's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
If you choose to connect your Gmail account, MyAvatar requests a single Google permission: https://www.googleapis.com/auth/gmail.send. This is the narrowest Gmail permission Google offers. It allows MyAvatar to send an email on your behalf. It does not allow MyAvatar to read, search, modify, or delete any message in your mailbox, and we do not do so.
At the moment you connect your account, we make one call to Google to retrieve the email address associated with it, so we can show you which account is connected.
We send an email only when you explicitly click send on a message you have reviewed, to a recipient you have specified. No background process, scheduled job, or automated agent sends email from your account. Messages sent this way come from your own address and appear in your own Gmail Sent folder.
We store your connected email address and an encrypted OAuth token that allows us to send on your behalf. Tokens are encrypted at rest. What MyCRM keeps about an e-mail you send from it is exactly what our GDPR data-handling note (v1.3, section 3, "CRM e-mail log", added 12 October 2026) says:
For each e-mail the customer sends from MyCRM: subject, recipient address, which mailbox sent it, provider message/thread id, time, attachment file names, and the first 200 characters of the message body the customer wrote — Stored on the customer's own contact record (activities, type email). Purpose: the customer's own overview of what they sent. The text is the customer's own outgoing words, not third-party content; the full message is never stored (it stays in the customer's mailbox). Deleted with the contact (data-subject erasure, account deletion, CRM retention purge) and with the customer's account; included in the data-subject export and the account export. Customer is controller.
You can disconnect your Gmail account at any time from within MyAvatar, which revokes MyAvatar's access at Google and deletes the stored token. You can also revoke MyAvatar's access directly through your Google Account at myaccount.google.com/permissions.
MyAvatar's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
If you choose to connect your Microsoft (Outlook / Microsoft 365) mailbox, MyAvatar requests Mail.Send (send an e-mail on your behalf), User.Read (read your own e-mail address once, to show which account is connected) and offline_access (keep the connection without asking you to sign in again). It does not allow MyAvatar to read, search, modify, or delete any message in your mailbox, and we do not do so.
Exactly as for Gmail: an e-mail is sent only when you explicitly click send on a message you have reviewed, to a recipient you have specified. Messages sent this way come from your own address and appear in your own Sent Items folder.
Your connected email address and an encrypted token that allows us to send on your behalf (encrypted at rest), and — for an e-mail you send from MyCRM — the same CRM e-mail log as described above, word for word.
You can disconnect your Microsoft mailbox at any time from within MyAvatar (Settings), which deletes the stored token. You can also revoke MyAvatar's access directly in your Microsoft account at account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work or school accounts).
MyAvatar's YouTube features use YouTube API Services.
By using MyAvatar's YouTube integration, you agree to be bound by the YouTube Terms of Service. Any personal data processed by Google in connection with these features is handled in accordance with the Google Privacy Policy.
If you choose to connect your YouTube channel, MyAvatar requests two permissions:
https://www.googleapis.com/auth/youtube.upload — allows MyAvatar to upload a video to your channel when you choose to publish one.https://www.googleapis.com/auth/youtube.readonly — allows MyAvatar to read your channel name and ID, and to read public performance statistics (views, likes, comment counts) for videos published through MyAvatar.We do not request permission to edit or delete your videos, manage playlists, change thumbnails, moderate comments, or otherwise modify your channel, and MyAvatar does not perform any of these actions.
We upload a video only when you initiate publishing — either by clicking publish directly, or by scheduling a publication that you have set up yourself. We read channel information at the time you connect, so we can show you which channel is linked. We read video statistics in order to display performance data for your own published videos inside MyAvatar.
We store your channel ID and channel title, an OAuth token allowing us to publish on your behalf, and performance statistics for videos published through MyAvatar. We do not store copies of videos already on your channel, and we do not access videos that were not published through MyAvatar.
You can disconnect your YouTube channel at any time from within MyAvatar, which revokes MyAvatar's access at Google, deletes the stored token, and stops all further access. You can also revoke MyAvatar's access directly through your Google Account at myaccount.google.com/permissions.
If you wish to have stored YouTube data deleted, contact us at the address in the Contact section of this policy.
MyAvatar's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can connect an AI assistant that supports the Model Context Protocol (MCP), for example Claude, to your MyAvatar account. This is optional. Only you can start it, and you can switch it off at any time.
The assistant acts in your account, under your instructions, and only through these four functions:
A connected assistant cannot publish or post anything to your social channels, delete anything, change your settings, billing or connections, see other users’ content, or use any MyAvatar admin function. MyAvatar’s servers enforce these limits themselves; they do not rely on the assistant behaving well.
This section explains how MyAvatar protects the data described above, including all data obtained through Google APIs (Google Ads, Google Calendar, Gmail, and YouTube).
All traffic between your browser and MyAvatar is protected with TLS (HTTPS). The connection between the MyAvatar application and its database is also encrypted with TLS.
The OAuth access and refresh tokens for every connected Google service (Google Ads, Google Calendar, Gmail, and YouTube) are encrypted before they are written to the database, using authenticated symmetric encryption (Fernet / AES-128-CBC with HMAC-SHA256). The encryption key is held in a restricted server configuration file, separate from the database and readable only by the MyAvatar service account, so access to the database alone is not sufficient to read your tokens.
Your tokens are decrypted only in memory, only for the moment needed to perform an action you initiated (such as sending an email you clicked send on, or syncing the calendar period you chose). The decryption key is never stored in the database. Access to the production systems holding this data is limited to authorized MyAvatar personnel and contractors who are bound by confidentiality obligations, for the purpose of running and maintaining the service.
The MyAvatar application is hosted with Hetzner Online GmbH in Germany. The database is a managed PostgreSQL service hosted with Scalingo in France. Both are within the European Union.
If you are a California resident, you have the right to:
We do not sell your personal information.
To exercise your rights, contact: privacy@myavatar.dk
You have the right to:
You can withdraw an AI assistant’s access at any time under Settings → Connections, without affecting videos already made.
To exercise your rights: privacy@myavatar.dk
You may also lodge a complaint with the Danish Data Protection Authority (Datatilsynet): www.datatilsynet.dk
| Data type | Retention period |
|---|---|
| Account data | Until account deletion + 30 days |
| Billing records | 5 years (legal requirement) |
| Generated videos | Until deleted by user or account termination |
| Usage logs | 12 months |
| AI-assistant (MCP) connection keys and safety log | Keys: 1 hour (access) / 30 days (renewal) or until disconnect; expired or revoked key records deleted after 30 days; safety log 12 months; all deleted on account deletion |
We operate from Denmark (EU). Some third-party providers are located outside the EU/EEA. For such transfers, we rely on Standard Contractual Clauses approved by the European Commission.
We use essential cookies for authentication and session management. Analytics cookies require your consent. See our Cookie Policy for details.
MyAvatar is a B2B SaaS platform intended exclusively for business users aged 18 and over. Our Service is not directed at children, and we do not knowingly collect personal data from minors.
MyAvatar is a tool for creating video content. Users who produce content targeting children's audiences are solely responsible for ensuring their content complies with applicable regulations (including COPPA, GDPR-K, and advertising standards) in their respective jurisdictions. MyAvatar does not assume liability for the end use or distribution of user-generated content.
We will notify you of material changes to this Privacy Policy by email or prominent notice on the platform at least 30 days before they take effect.