Legal disclaimer: This privacy policy is a good-faith disclosure of mymodel's data practices. It does not constitute legal advice. We recommend consulting a qualified data privacy attorney before relying on this document for legal compliance purposes.
Contents
1. Who We Are
mymodel, Inc. ("mymodel," "we," "our," or "us") operates getmymodel.com and the mymodel platform. We are a two-sided data marketplace: consumers create a verified Stats Card — their owned demographic and behavioral data profile — and brands purchase consent-gated access to query and engage that audience. When a brand makes an offer, the consumer decides whether to accept and gets paid a minimum of $5 per offer they choose to accept.
This Privacy Policy applies to all data collected through getmymodel.com, our mobile applications, and any related services (collectively, the "Platform").
Contact: [email protected]
2. Data We Collect
We collect two categories of data: what you give us directly, and what we observe through your use of the Platform.
| Category | What It Includes | Required? |
|---|---|---|
| Identity | Name, email address, date of birth, gender identity | Yes — to create your account |
| Demographics | Age, household income range, education, occupation, family status | Yes — forms your Stats Card |
| Purchase Behavior | Product categories you shop, brands you buy from, spending frequency | Yes — core Stats Card data |
| Brand Affinities | Brands you follow, prefer, or have purchased from | Yes — core Stats Card data |
| App & Usage Behavior | Features used, time on platform, offer interaction history | Automatic — for platform functionality |
| Location | City, state, or region (not precise GPS without explicit consent) | Optional — improves offer matching |
| Device & Technical | IP address, browser type, operating system, device identifiers | Automatic — for security and platform delivery |
| Push Notification Interactions | Whether you open, dismiss, or act on offer notifications | Only if you enable notifications |
| Payment Information | Payment method for receiving offer payouts (processed via third-party payment processor; we do not store full payment account numbers) | Required to receive payments |
We do not collect: Social Security numbers, precise GPS location (without explicit consent), health or medical data, or biometric identifiers.
3. How We Collect It
Directly from you
When you sign up, build your Stats Card, set preferences, accept or decline offers, or contact us — you give us information directly. This includes everything you enter into forms or select from options on the platform.
Automatically through the Platform
When you use the Platform, we automatically collect usage data (which features you use, how often, what you click) and technical data (IP address, browser, device). This helps us keep the platform running, secure, and improving.
From third parties (limited)
We may receive data from identity verification services to confirm your account is real, or from payment processors to confirm payout transactions. We do not purchase behavioral data about you from data brokers.
4. Gmail & Google Account Data
When you choose to connect your Gmail account to mymodel, we access your Google account using OAuth authorization. This section governs our use of Google user data and supplements (and where conflicting, supersedes) the general data-handling sections of this policy.
What we access
We request the following Google OAuth scopes during sign-in:
https://www.googleapis.com/auth/gmail.readonly— read-only access to your Gmail messages, message metadata (sender, subject, date, labels), and email attachments. We do not request write, modify, or send permissions for Gmail.openid,email,profile— your basic identity (email address, name, profile picture) to create and authenticate your mymodel account.
How we use Gmail data
We access your Gmail messages solely to build and maintain your Stats Card — a behavioral profile derived from purchase receipts, shipping confirmations, subscription notifications, appointment confirmations, and similar transactional emails. The Stats Card is the core product feature that enables you to receive paid offers from brands.
Specifically, our processing involves:
- Periodic message retrieval. Our background workers periodically retrieve your recent messages (a capped number per refresh cycle, currently every six hours) using your stored OAuth refresh token. We do not retrieve messages older than the configured retention window.
- In-memory analysis only. Retrieved messages are processed in our worker process memory. We pass relevant message content to Anthropic's Claude API (see "Sub-processors" below) to extract structured behavioral signals: brand affinities, purchase categories, recent transactions, and related metadata.
- No persistence of raw Gmail content. We do NOT store the raw content of your Gmail messages in our database. Email bodies, subjects, attachments, and headers are discarded after analysis. Only the derived structured signals (e.g., "shops at Sephora") are stored as part of your Stats Card.
- Sensitive-category filtering. Before any data is stored, we apply a sensitive-category filter that strips signals related to specific medical diagnoses, race/ethnicity, immigration status, disability, legal trouble, domestic violence resources, children's identifiable information, financial distress, explicit adult content, firearms, and active addiction recovery. These categories are filtered out of stored signals regardless of what your messages contain.
How long we keep Gmail-derived data
- Your OAuth refresh token: Retained while your account is active and Gmail connection is enabled. Revoked and deleted upon disconnection or account deletion.
- Derived behavioral signals (Stats Card): Retained while your account is active. Individual purchase events are pruned after 18 months. Upon account deletion, all derived signals are removed within 30 days.
- Raw Gmail content: Not retained. Discarded immediately after analysis in each refresh cycle.
Who we share Gmail-derived data with
We do not share your Gmail content or raw email data with any third party.
Derived Stats Card signals (not raw email content) are shared with brands ONLY when (a) a brand has sent you a specific offer through the platform, (b) you have explicitly accepted that offer, and (c) the brand pays for time-bounded access to your Stats Card. You can decline any offer for any reason. Brands never receive raw Gmail content or per-purchase dollar amounts.
Sub-processors
We use the following sub-processors in connection with Gmail data:
- Anthropic, PBC — natural language processing of email content for behavioral signal extraction. Per Anthropic's commercial terms, prompt content sent to the Claude API is not used to train Anthropic's models and is not retained beyond the duration of the API request, except as required for short-term abuse monitoring.
- Render Services, Inc. — application hosting and database storage for derived signals (not raw email content).
- Google LLC — original data source via the Gmail API.
Limited Use compliance
Our use of information received from Google APIs adheres to Google's API Services User Data Policy, including the Limited Use requirements. Specifically:
- We use Google user data only to provide and improve user-facing features that are prominent in the mymodel application — building and maintaining your Stats Card.
- We do not transfer Google user data to others except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale of assets (with notice to you).
- We do not use Google user data for serving advertisements.
- We do not allow humans to read Google user data except (a) with your specific consent, (b) for security purposes (such as investigating abuse), (c) to comply with applicable law, or (d) when the data has been aggregated and anonymized.
Disconnecting Gmail
You can disconnect Gmail at any time from the Settings screen in the mymodel mobile app. Disconnection immediately revokes your stored OAuth refresh token, stops all future Gmail message retrieval, and does not retroactively delete derived signals already stored in your Stats Card. To remove existing signals as well, delete your account.
You can also revoke mymodel's access directly through your Google Account at myaccount.google.com/permissions. Revoking access there immediately stops our ability to retrieve your messages even if our in-app disconnect has not yet run.
Account deletion
You can delete your mymodel account at any time from the Settings screen in the mobile app. Account deletion permanently removes your Stats Card, all derived signals, your OAuth tokens, and all associated records within 30 days, except for records we are legally required to retain (such as transaction records for tax compliance, per the retention schedule in section 11). You may also request deletion by emailing [email protected].
5. How We Use Your Data
- Operating the Platform: Creating and maintaining your account, delivering your Stats Card, processing offer acceptances, and sending payouts.
- Matching you with relevant offers: We use your Stats Card data to surface offers from brands that match your profile. You always see the offer before any data is shared with the brand.
- Platform improvement: Analyzing how people use features to improve the experience. This analysis is done on aggregated or anonymized data wherever possible.
- Communication: Sending you offer notifications (if you've opted in), platform updates, and responses to your support requests.
- Fraud prevention and security: Detecting and preventing fake accounts, fraudulent offer claims, and unauthorized access.
- Legal compliance: Fulfilling legal obligations, responding to lawful requests, and enforcing our Terms of Service.
We do not use your data to train AI models without your explicit consent. We do not sell your personal information to third parties.
6. Sharing With Brands
Your consent controls everything. A brand cannot access your individual data until you explicitly accept their offer. Before you accept, you see exactly what data the brand is requesting access to, for how long, and what they're paying. You choose yes or no — and that decision is always reversible.
Before you accept an offer
Brands can see aggregate, anonymized audience statistics only — for example, "there are 4,200 users in this audience segment." They cannot see any individual data, names, or contact information.
After you accept an offer
When you accept a brand's offer, you grant that brand temporary, limited access to the specific data categories you've consented to. This access is:
- Limited to the data types disclosed at the time of the offer
- Time-bound to the offer duration specified (e.g., 30 days)
- Revocable — you can withdraw consent at any time through your account settings
- Non-transferable — the brand cannot sell or re-share your data with other parties
Brands do not receive
Brands never receive your name, email address, phone number, payment information, or precise location data as part of an offer transaction. What they receive is the behavioral and demographic data from your Stats Card that you explicitly approved.
7. Service Providers & Third Parties
We work with trusted service providers who access your data only to help us operate the Platform. These include:
- Cloud infrastructure & hosting — servers that store and process platform data
- Payment processors — to send you payouts from accepted offers
- Identity verification — to confirm real user accounts and prevent fraud
- Analytics — to understand aggregate platform usage (no individual profiling for advertising)
- Email & notification delivery — to send you platform communications
All service providers are contractually required to protect your data, use it only for the services they provide to us, and comply with applicable privacy law.
We do not share your data with advertisers, data brokers, or social media platforms except as part of an offer you've accepted (such as an audience export to Meta or Google, which only occurs with your consent as part of a brand offer).
8. Push Notifications
If you enable push notifications, we use them to alert you when a brand has made you an offer that matches your Stats Card. Notification data (whether you opened, dismissed, or ignored a notification) is used solely to improve offer delivery timing — it is not shared with brands.
You can disable push notifications at any time through your device settings or account preferences. Disabling notifications does not affect your ability to earn from offers — you'll still see them in the app, just without the push alert.
10. Your Rights (CCPA & California Law)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
These rights are free to exercise. We will not discriminate against you — in pricing, service quality, or offer availability — for exercising any privacy right.
Right to Know
You can request a copy of the personal information we've collected about you in the past 12 months, including what categories of data, what we used it for, and who we shared it with.
Right to Delete
You can request that we delete your personal information. We will honor this request and direct our service providers to delete your data as well, subject to limited exceptions (such as data we're legally required to retain).
Right to Correct
You can update or correct inaccurate information in your account at any time through account settings, or by contacting us.
Right to Opt Out of Sale or Sharing
We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioral advertising without your consent. You can opt out of any data sharing at any time by withdrawing consent from active brand offers through your account settings.
Right to Limit Use of Sensitive Personal Information
You can limit our use of sensitive personal information (such as precise location or demographic details) to what is strictly necessary to provide the Platform. Contact us to restrict specific data uses.
Right to Non-Discrimination
Exercising any of these rights will not affect your ability to use the Platform, receive offers, or get paid.
How to Exercise Your Rights
Email us at [email protected] with the subject line "Privacy Request." We will respond within 45 days. Complex requests may require up to 90 days with notice. We may need to verify your identity before processing your request.
11. Data Retention
| Data Type | Retention Period |
|---|---|
| Account and Stats Card data | As long as your account is active, plus 30 days after account deletion |
| Offer transaction records | 7 years (required for financial/tax record-keeping) |
| Platform usage logs | 12 months rolling |
| Push notification interaction data | 90 days |
| Support communications | 3 years from last interaction |
| Data shared with brands under accepted offers | Governed by the offer terms; brands are contractually required to delete after the offer period ends |
When you delete your account, we begin deletion of your personal data within 30 days, except where longer retention is legally required (such as financial records).
12. Security
We take data security seriously — it is foundational to our product. We employ industry-standard protections including:
- Encryption in transit (TLS) and at rest for all personal data
- Access controls — only personnel with a specific need can access personal data
- Regular security assessments and vulnerability testing
- Contractual data security requirements for all service providers
No system is 100% secure. If we become aware of a data breach that affects your personal information, we will notify you as required by applicable law, and no later than 72 hours after becoming aware of the incident.
13. Children's Privacy
mymodel is not intended for users under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected data from a minor, we will delete that data promptly.
If you believe a minor has created an account on mymodel, please contact us at [email protected].
14. Changes to This Policy
We will update this policy when our data practices change. For material changes — changes that significantly affect your rights or how we use your data — we will notify you by email (at the address on your account) at least 30 days before the change takes effect. You will have the opportunity to close your account or withdraw consent if you disagree with the updated terms.
Non-material changes (clarifications, typos, minor edits) will be noted by updating the "Last updated" date at the top of this page.
15. Contact Us
For any privacy questions, data requests, or concerns:
mymodel, Inc.
Privacy inquiries: [email protected]
Website: getmymodel.com
We respond to all privacy requests within 45 days.