1. Introduction
This Privacy Policy explains how GetMyMFA ("we", "us", "our") collects, uses, discloses, and protects personal data when you use our website and services accessible at https://get.mymfa.io (the "Service").
We are a company established in France and process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and applicable French data protection laws.
2. Data controller
The data controller responsible for processing your personal data is:
GetMyMFA 649 Rue Berthelot 10120, Saint-Germain France Email: hello@mymfa.io
3. Personal data we collect
3.1 Data you provide directly
We may collect the following personal data when you use the Service:
- Email address
- Name (where applicable)
- Account credentials
- Communications sent to us (support requests, emails)
3.2 Data collected automatically
When you access the Service, we may automatically collect:
- IP address
- Browser type and version
- Device identifiers
- Pages visited and usage logs
- Date, time, and duration of visits
This data is used strictly for security, performance monitoring, and service improvement.
3.3 Audience measurement
The website https://get.mymfa.io uses two audience measurement tools: Vercel Web Analytics and PostHog (PostHog Cloud EU, hosted in the European Union).
By default, measurement is cookieless. Neither tool sets a cookie or stores any identifier on your device. The IP address and browser characteristics are processed transiently on the server to derive an anonymous, non-reversible visitor hash that is reset every day; the IP address itself is discarded and is not stored, and the hash cannot be used to identify you across websites. We use these tools to count visits and page views, to measure page performance, and to understand how visitors move through the website and the sign-up form (for example which step was reached or abandoned). This processing is based on our legitimate interest in understanding how the website is used and does not require your consent.
With your consent, one optional analytics cookie. When you first visit the website, a small prompt asks whether PostHog may set one cookie. If you accept, PostHog stores a randomly generated identifier in a cookie on your device for 12 months so that your browser is recognised on later visits, and records how the website is used, including a replay of your visit (pages, scrolling, clicks and form interactions). Everything you type into forms is masked before it is recorded, and replays are deleted after 30 days. This website never links the identifier to your name or email address; if you later create a GetMyMFA account from the same browser, the identifier is associated with that account as described in section 3.4, so that we can see which pages led to a sign-up. If you decline, or do not answer, measurement stays cookieless as described above. You can change your choice at any time with the "Cookie preferences" link in the footer of the website. This processing is based on your consent (Article 6(1)(a) GDPR and Article 82 of the French Data Protection Act), which you may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal.
3.4 Product analytics in the console
When you are signed in to the GetMyMFA console (https://client.get.mymfa.io), we record how you use the Service: sign-ins, trial activation, pages opened, codes retrieved (the fact that a code was read, never its content), purchases, API keys created, resources shared or deleted, and errors you encounter. These events are sent to PostHog (PostHog Cloud EU) together with your account identifier, email address, plan and trial status, so that we can follow your account from sign-up to use, help you when something goes wrong and improve the Service. Requests made with your API key are recorded in the same way, attributed to your account. No cookie or identifier is stored on your device for this purpose: your identity comes from your session, and nothing is kept in the browser once you sign out. No session replay is recorded in the console. This processing is based on our legitimate interest in operating and improving the Service (Article 6(1)(f) GDPR); you may object to it at any time by writing to the address in section 14, in which case your account is excluded from analytics.
4. Purposes and legal bases for processing
We process personal data only where a lawful basis exists under Article 6 GDPR:
- Performance of a contract: to provide and operate the Service
- Legal obligations: compliance with applicable laws
- Legitimate interests: security, fraud prevention, service improvement, product analytics of signed-in use (section 3.4)
- Consent: where required (e.g. optional communications, the optional analytics cookie on the website)
We do not use personal data for purposes incompatible with those listed above.
5. Cookies and tracking technologies
The GetMyMFA client application and API use strictly necessary cookies only, which are essential for the proper functioning and security of the Service (for example, session cookies after you log in). No consent is required for these cookies. The product analytics described in section 3.4 set no cookie and store nothing on your device.
The website https://get.mymfa.io uses a single optional cookie: the PostHog analytics cookie described in section 3.3, which is set only after you accept it in the consent prompt and can be refused or withdrawn at any time through the "Cookie preferences" link in the footer. Refusing it has no effect on your use of the website or the Service.
No advertising, social media or cross-site tracking cookies are used anywhere on the website or the Service.
6. Data sharing and recipients
We do not sell or rent your personal data.
Personal data may be shared only with:
- Authorized service providers acting as data processors, currently: Amazon Web Services (hosting, storage and message processing of the Service, eu-central-1 region), Vercel (hosting and audience measurement of the website https://get.mymfa.io), PostHog (audience measurement of the website and, with your consent, the analytics cookie and session replays described in section 3.3; product analytics of the console and API described in section 3.4; PostHog Cloud EU) and Stripe (subscription billing and payment processing)
- Public authorities where required by law
All processors are bound by GDPR-compliant data processing agreements.
7. Data storage and international transfers
Personal data is primarily processed and stored within the European Union. Where transfers outside the EU occur (e.g. infrastructure providers), appropriate safeguards are implemented, including Standard Contractual Clauses (SCCs) or equivalent lawful mechanisms.
8. Data retention
We retain personal data only for as long as necessary for the purposes for which it was collected:
- Account data: for the duration of the account
- SMS and email messages received on your virtual phone numbers and email addresses: 1 year
- Usage and security logs: limited retention periods
- Website analytics cookie (with your consent): 12 months; session replays: 30 days
- Product analytics events (section 3.4): for the life of your account, then deleted with it
- Legal obligations: as required by law
You may request deletion of your data at any time, subject to legal retention requirements.
9. Data security
We implement appropriate technical and organisational measures to protect personal data, including:
- Encryption at rest and in transit
- Access controls
- Secure hosting infrastructure
While no system is completely secure, we continuously improve our safeguards.
10. Your rights under GDPR
You have the following rights:
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to object
- Right to data portability
You may exercise your rights by contacting hello@mymfa.io. We will respond within one month, as required by law.
You also have the right to lodge a complaint with your local data protection authority, including the CNIL in France.
11. Children's data
Our Service is not intended for children under the age required by applicable law. In France, this age is 15 years, unless parental consent is provided.
We do not knowingly collect personal data from children without appropriate consent.
12. Third-party links
Our Service may contain links to third-party websites. We are not responsible for their privacy practices and encourage you to review their privacy policies.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. Changes will be published on this page with an updated revision date. Where required by law, we will notify you of material changes.
14. Contact
For any questions regarding this Privacy Policy or personal data processing, contact:
GetMyMFA Email: hello@mymfa.io
This Privacy Policy is drafted to comply with GDPR and applicable French data protection law.