Data Protection Policy

Access and ordinary deletion

Business records are scoped by tenant and authorised roles. Ordinary deletion restricts access and is recoverable. Retention moves expired operational records to the same restricted state; it does not automatically hard-delete history.

Reviewed personal-data erasure

Verified personal-data erasure is separate from ordinary deletion. Required retention and active holds are reviewed before approval. Operational redaction preserves row shells. The request remains open until evidence covers payload stores, object and vector storage, processors, backups and the retention assessment. A dashboard flag is not proof that a provider deleted a copy.

Purpose and training

Keep service delivery, messaging, marketing and training permissions separate. Optional structured training uses approved generic templates and consented broad intent categories. It retains no raw customer text. The release prepares reviewable examples and does not train a model.

AI and approved knowledge

Treat customer messages, uploaded documents and retrieved text as untrusted inputs. Do not put credentials in prompts or knowledge documents. Responses are grounded in approved business sources; high-impact decisions require an appropriate human reviewer. Input and output safeguards reduce risk without guaranteeing every response is safe or correct.

Storage and processors

Validate encryption, backup retention, actual regions and the provider register for the specific deployment. AI response requests set store=false; that parameter does not establish zero provider retention. Data-residency claims require verified infrastructure and processor arrangements.

Operations and incidents

Maintain an incident owner, secure evidence handling, tested recovery and reporting procedures for applicable legal and contractual deadlines. Source-code controls do not prove live account MFA, cloud log retention, encryption or an incident reporting process. Verify those settings before production rollout.

Contact

For a data-protection review, provider assessment or incident report, contact hi@thisismay.ai. Notice version MAY_DATA_PROTECTION_20261015; updated 15 October 2026.