Data Protection Policy
MAY is built to keep each customer's business data separated and protected. This policy summarises the principles we use for access, integrations, retention and security across the service.
1. Customer data separation
MAY keeps each business account logically separated and applies access checks so people and AI employees operate only with the information they are authorised to use.
2. Access control
Workspace access is authenticated and governed by roles and permissions. Platform administration and customer business administration are separate operational scopes. Elevated support access should be time-limited and auditable where used.
3. Data minimisation and purpose
MAY should collect and process only the information required for the configured customer journey, CRM record, workflow, security need or integration. Businesses are responsible for defining appropriate data fields and customer-consent practices for their use case.
4. Knowledge, catalogue and AI responses
Business knowledge and structured catalogue information remain limited to the relevant business account. MAY is designed to use information approved by that business for customer answers rather than treating generic AI memory as authoritative business data.
5. Credentials and integrations
Integration credentials are treated as secrets and should be stored through protected platform configuration rather than in prompts, documents or ordinary chat messages. Connected systems remain subject to their own security and access policies.
6. Retention, export and deletion
Retention periods depend on customer configuration, service requirements and applicable agreements. MAY includes mechanisms for authorised data export and deletion workflows. Backup copies may persist temporarily according to normal backup-expiry processes.
7. Logging and audit
MAY maintains operational and audit information appropriate to security, support and accountable automation. Sensitive secrets should not be written into normal application logs.
8. Incident handling
Suspected security incidents are investigated and contained according to operational severity. Where a contractual or legal notification obligation applies, affected customers are informed through the appropriate channel.
9. Subprocessors and infrastructure
MAY may use infrastructure and service providers to deliver hosting, identity, communications, AI processing, observability and integrations. Provider access is limited to the functions necessary to deliver the service.
10. Customer responsibilities
Customers are responsible for appropriate user access, accurate business data, lawful customer communications, permissions for connected systems, and deciding which workflows require human approval or additional compliance controls.
11. Contact
Data-protection questions can be sent to hi@thisismay.ai. Customer-specific data-processing terms may be documented separately where required.