Privacy Policy

The data controller for the processing described here is:

Ergonational ApS, CVR no. 43769936
Else Alfelts Vej 17F, 2300 Copenhagen, Denmark
Email: [email protected]

We have not appointed a Data Protection Officer. Any request or question concerning personal data reaches us at the email above or via our contact form.

• Account & contact data — name, email, role (visitor / expert / admin), and authentication identifiers.
• Billing data — purchase records and the payment metadata returned by our payment processor. We do not store full card numbers.
• Expert biometric & likeness data — for experts who build a twin: voice recordings, facial/portrait imagery, and the recorded consent and identity artefacts. These are special-category (biometric) data under Art. 9.
• Conversation data — the messages you exchange with a twin, and derived usage (e.g. minutes consumed).
• Technical data — a first-party visitor identifier and standard server logs needed to run and secure the service. To stop abuse of the free-minute allowance (e.g. resetting it by clearing cookies), we also keep a salted one-way hash of your IP address as an abuse-prevention counter. We do not store the raw IP for this purpose, and the hash cannot be reversed to identify you.

Where we rely on consent — in particular for an expert's biometric data — you can withdraw it at any time (see section 7). Where we rely on legitimate interests, you can object (see section 7).

We use the following service providers to deliver the product. Each acts as a processor or independent controller under a data-processing agreement:

We do not sell personal data. We share it only as needed to run the service or where required by law.

Several of the providers listed above process data in the United States. For these transfers outside the EU/EEA we rely, per provider, on the EU–US Data Privacy Framework where the provider is certified and/or on Standard Contractual Clauses with supplementary measures. We will tell you the specific provider and mechanism for any category on request.

• Account data — for the life of the account, then deleted within 90 days of closure (except records we must keep, below).
• Billing records — 5 years from the end of the financial year, as required by the Danish Bookkeeping Act (Bogføringsloven).
• Expert biometric/likeness data — kept only while the twin is live. When the expert revokes consent or closes the twin, the cloned face and voice are deleted at our voice and avatar processors and in our systems within 30 days.
• Conversation history — kept while your account is active, deleted when you delete it or within 90 days of account closure.
• Abuse-prevention IP hash — the salted, one-way IP hash used to cap free minutes is purged on a rolling 30-day window.

Subject to the conditions in the GDPR, you have the right to:

• Access — a copy of the personal data we hold about you (Art. 15).
• Rectification — correction of inaccurate or incomplete data (Art. 16).
• Erasure — deletion of your data where the conditions apply (“right to be forgotten”, Art. 17).
• Restriction — limiting how we process your data (Art. 18).
• Portability — receiving your data in a structured, machine-readable format (Art. 20).
• Objection — objecting to processing based on legitimate interests (Art. 21).
• Withdraw consent — withdrawing any consent at any time, without affecting processing already carried out (Art. 7(3)). For experts this includes revoking the likeness/voice/name licence, which switches the twin off.

You can exercise access, erasure, portability and consent-withdrawal directly from your account's Data Rights controls when signed in, or by contacting us at [email protected]. We aim to respond within one month.

You also have the right to lodge a complaint with the Danish supervisory authority, Datatilsynet (datatilsynet.dk), or with the supervisory authority in your EU country of residence.

We use strictly-necessary cookies by default: a first-party visitor identifier (mayaido_vid) and the sign-in/session cookies set by our authentication provider. These are exempt because they are essential to provide a service you have requested.

On aimaydo.com, analytics (Google Analytics and Microsoft Clarity) load only after you opt in through the cookie banner; rejecting or ignoring the banner means they never load.

Where our conversation widget is embedded on a partner's website, we use Microsoft Clarity session analytics to operate, secure and improve the embedded service, on the basis of our legitimate interests (Art. 6(1)(f)); in that embedded context any storage the browser allows is partitioned to the embedding site. You can object to this processing at any time (see section 7). Google Analytics is never loaded in the embedded widget without consent.

Twin replies are generated by AI and are always labelled as such. They are information, not professional advice. We do not use your conversations to make decisions that produce legal or similarly significant effects about you without a legal basis and appropriate safeguards.

We will update this policy as the product evolves, and will revise the date at the top when we do. If a change is material, we will give reasonable notice.