Back to app

Privacy Policy

Last updated: 26 July 2026

1. Who is responsible for your data

Tymly is operated by RJMONDO, S.L. ("Tymly", "we", "us"), a company registered in Spain. We are the data controller for the personal data described in this policy.

  • Company: RJMONDO, S.L.
  • Tax ID (NIF): B66409087 · EU VAT: ESB66409087
  • Registered address: Calle Emilio Lemos 2, Módulo 5, 41019 Sevilla, Spain
  • Contact: support@mytymly.com

2. What we collect

We collect only what we need to run Tymly:

  • Account information — your email address, and your display name and profile picture if you sign in with Google.
  • Calendar and planning data — events, reminders, habits, and the planning preferences you set up inside Tymly.
  • Google Calendar data — if, and only if, you connect your Google account (see section 6).
  • AI assistant messages — the messages you send to the assistant and the replies it returns.
  • Billing data — your subscription plan, status, renewal date and Stripe customer reference. We never receive or store your full card number.
  • Usage and device data — which features you open, plus browser type, language and time zone, used for localization and to improve the product.

3. Why we use it, and on what legal basis

Under the GDPR we must tell you the legal basis for each purpose:

  • Providing the service — scheduling, AI suggestions, reminders, calendar sync and insights. Basis: performance of our contract with you (Art. 6(1)(b)).
  • Processing payments and preventing free-trial abuse — Basis: performance of the contract, and our legitimate interest in preventing fraud (Art. 6(1)(b) and (f)).
  • Sending service messages — account confirmation, password resets, billing notices. Basis: performance of the contract.
  • Improving the product — aggregated, non-identifying analytics. Basis: our legitimate interest in understanding how Tymly is used (Art. 6(1)(f)).
  • Meeting legal obligations — keeping invoices and tax records. Basis: legal obligation (Art. 6(1)(c)).

We do not use your calendar content or assistant messages to train any AI model, and we do not sell your data.

4. Who processes data on our behalf

We share data only with the providers needed to run the service. Each acts as our processor under a data processing agreement:

  • Supabase — database, authentication and backend hosting. Data is stored in the EU (Ireland).
  • Stripe — payment processing, under PCI-DSS standards.
  • OpenRouter / Mistral AI — OpenRouter is the routing processor for the Tymly AI assistant: requests are sent to OpenRouter's EU in-region endpoint (eu.openrouter.ai) and inference is performed by Mistral AI (Mistral Small and Mistral Large). Your message and the relevant schedule context are sent to generate a reply; the details of events synced from Google Calendar are withheld from the model (see section 6), and the Companion assistant makes no separate AI request of its own. Only zero-data-retention endpoints are used, and training on your data is disabled at OpenRouter workspace level — see OpenRouter's zero-data-retention documentation and Mistral AI's legal documents.
  • ElevenLabs — text-to-speech, used only when you play a reply aloud.
  • Resend — delivery of service emails.
  • Google — sign-in and, if you connect it, Google Calendar.
  • Vercel — web hosting and content delivery for the site.
  • Cloudflare — DNS and bot protection (the sign-in challenge).

5. International transfers

Our database, email delivery and all AI processing are hosted inside the European Union. The only processors located outside the EEA are the ones listed below, and your data may be transferred to them:

  • Stripe, ElevenLabs, Vercel and Cloudflare (United States) — transfers rely on Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
  • OpenRouter / Mistral AI — the Tymly AI assistant runs through OpenRouter's EU in-region endpoint: prompts and completions are decrypted and processed within Europe (EU/EEA, UK, Switzerland) and routed only to provider endpoints in that region — if no in-region endpoint can serve a request, it fails instead of leaving the region. As documented by OpenRouter, account and operational records (control plane and billing) are handled outside the region: OpenRouter In-Region Routing.

You may request a copy of the safeguards we rely on by writing to us.

6. Google Calendar and Google user data

Connecting Google Calendar is optional. When you connect it, Tymly reads your events so your schedule stays in sync, and creates, edits or deletes events when you ask it to.

Tymly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use Google Calendar data for advertising, we do not sell it, we do not allow humans to read it except where you explicitly ask us to for support, where required by law, or for security purposes, and we do not use it to train generalized AI models.

You can disconnect Google Calendar at any time from Settings, or revoke access directly at your Google account permissions. Disconnecting stops all further access immediately.

7. How long we keep it

  • Account, calendar and assistant data — for as long as your account exists. Deleting your account erases it immediately.
  • Google Calendar tokens — until you disconnect or delete your account.
  • Technical logs — up to 90 days.
  • Invoices and accounting records — six years, as required by Spanish commercial and tax law.
  • Anti-abuse signal — when you delete your account we keep one non-identifying hash so the 14-day free trial cannot be claimed repeatedly. It contains no personal data and cannot be reversed.

8. Security

Data is encrypted in transit (TLS) and at rest. Access is restricted by row-level security, so you can only ever read or modify your own records. Administrative access is limited and logged.

9. Your rights

You have the right to access your data, correct it, erase it, restrict or object to its processing, and receive it in a portable format. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.

You can delete your account and all associated data yourself from Settings → Danger zone, or read more at mytymly.com/delete-account. For any other request, write to support@mytymly.com and we will respond within one month.

If you believe we have handled your data incorrectly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) at aepd.es, or with the supervisory authority in your own country.

10. Age

Tymly is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.

11. Changes

We may update this policy. Material changes will be announced in the app or by email before they take effect, and the date at the top of this page will change.

12. Contact

RJMONDO, S.L. · NIF B66409087 · Calle Emilio Lemos 2, Módulo 5, 41019 Sevilla, Spain · support@mytymly.com