Privacy Policy

Introduction

Welcome to MenoAI ("we," "our," or "us"). We are committed to protecting your privacy and handling your data in an open and transparent manner. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our AI-powered menopause companion service.

We understand the sensitive nature of health-related conversations and take your privacy extremely seriously. Your trust is paramount to us.

1. Information We Collect

1.1 Information You Provide

• Account Information: When you sign up via Google OAuth, we collect your name, email address, and profile picture from your Google account.
• Profile Information: Optional information you choose to provide, such as display name, custom profile picture, and bio.
• Conversation Data: Messages you send to our AI companion, including text and voice transcriptions.
• Voice Data: When you use voice input, your speech is processed by your browser's built-in Web Speech API. Audio is NOT sent to our servers - only the text transcription.

1.2 Automatically Collected Information

• Usage Data: Information about how you use our service (e.g., features used, pages visited).
• Technical Data: IP address, browser type, device information, and timestamps.
• Analytics Data: We use privacy-focused analytics (PostHog) to understand usage patterns. We do NOT track message content, only metadata like "message sent" or "feature used."

1.3 Information We DO NOT Collect

• We do NOT record or store your voice audio
• We do NOT share your conversation content with third parties for marketing
• We do NOT sell your personal data
• We do NOT use your health information for advertising

2. How We Use Your Information

We use your information for the following purposes:

• Provide Our Service: To deliver AI-powered conversational support and emotional companionship.
• Personalization: To remember your conversation history and provide contextual, empathetic responses.
• Safety Monitoring: To detect crisis situations (e.g., self-harm mentions) and provide appropriate resources.
• Improve Our Service: To analyze usage patterns (not message content) and improve features.
• Communication: To send important service updates, security alerts, or respond to your inquiries.
• Legal Compliance: To comply with legal obligations and protect our rights.

3. AI Processing & Third-Party Services

3.1 OpenAI API

We use OpenAI's API to generate AI responses. Your messages are sent to OpenAI for processing. According to OpenAI's data usage policy:

• OpenAI does NOT use API data to train their models
• Data is retained for 30 days for abuse monitoring, then deleted
• See OpenAI's privacy policy: https://openai.com/privacy

3.2 Web Speech API (Voice Features)

Voice recognition is processed entirely in your browser using the Web Speech API provided by:

• Chrome/Edge: Google's speech recognition service
• Safari: Apple's on-device speech recognition
• Important: Your audio is NOT sent to our servers. Only the text transcription is stored.

3.3 Other Third-Party Services

• Supabase: Database and authentication (GDPR compliant, EU data residency available)
• Netlify: Web hosting (SOC 2 Type II certified)
• Render: Backend API hosting
• PostHog (optional): Privacy-focused analytics (does NOT track message content)
• Sentry (optional): Error tracking (sensitive data filtered out)

4. Data Storage and Retention

4.1 Where Your Data is Stored

Your data is stored securely in the cloud:

• Database: Supabase (PostgreSQL), encrypted at rest and in transit
• Files: Supabase Storage (profile pictures), with user-specific access controls
• Backups: Automated daily backups with 7-day retention

4.2 How Long We Keep Your Data

• Conversations: Retained for 30 days, then automatically anonymized (content replaced with "[REDACTED]")
• Account Information: Retained until you delete your account
• Safety Logs: Retained for 90 days for compliance and safety monitoring
• Analytics Data: Aggregated and anonymized after 90 days

4.3 Automatic Anonymization

To protect your privacy, we automatically anonymize conversations after 30 days:

• Message content is replaced with "[REDACTED - Retention period expired]"
• Conversation metadata (timestamps, user ID) is retained for service improvement
• This ensures your sensitive health conversations are not stored indefinitely

5. Your Rights (GDPR & Privacy Laws)

You have the following rights regarding your personal data:

• Right to Access: Request a copy of all personal data we hold about you.
• Right to Rectification: Correct inaccurate or incomplete data (edit your profile anytime).
• Right to Erasure ("Right to be Forgotten"): Request deletion of your account and all associated data.
• Right to Data Portability: Request your data in a machine-readable format (JSON export).
• Right to Restrict Processing: Request temporary suspension of data processing.
• Right to Object: Object to certain types of data processing (e.g., analytics).
• Right to Withdraw Consent: Withdraw consent for data processing at any time.

6. Security Measures

We implement industry-standard security measures to protect your data:

• Encryption: All data is encrypted in transit (HTTPS/TLS) and at rest (AES-256).
• Authentication: Secure OAuth 2.0 authentication via Google.
• Access Control: Row-Level Security (RLS) ensures users can only access their own data.
• Regular Security Audits: Automated vulnerability scanning and security updates.
• Minimal Data Collection: We only collect data necessary to provide our service.
• Employee Access: Strictly limited and logged access to production data.

Data Breach Notification: In the unlikely event of a data breach, we will notify affected users within 72 hours and report to relevant authorities as required by law.

7. Cookies and Tracking

7.1 Essential Cookies

We use essential cookies to maintain your login session and remember your preferences. These cannot be disabled as they are necessary for the service to function.

7.2 Analytics Cookies (Optional)

If you consent, we use PostHog for privacy-focused analytics. You can opt out in your browser settings.

7.3 Third-Party Cookies

We do NOT use third-party advertising or tracking cookies.

8. Children's Privacy

MenoAI is designed for adults experiencing perimenopause and menopause. Our service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately at hello@cheilagibbs.com.

9. International Data Transfers

Your data may be processed in countries outside your own, including the United States. We ensure appropriate safeguards are in place:

• EU Users: Supabase offers EU data residency (data stored in EU).
• Standard Contractual Clauses: We use EU-approved clauses for data transfers.
• Privacy Shield: Our providers comply with applicable data protection frameworks.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on this page
• Updating the "Last updated" date at the top
• Sending an email notification for significant changes

Your continued use of MenoAI after changes are posted constitutes acceptance of the updated Privacy Policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices:

EU Residents: You have the right to lodge a complaint with your local Data Protection Authority if you believe your privacy rights have been violated.