Privacy Policy
1. Introduction
This privacy notice applies when you visit our website at https://myicor.com/ or communicate with us by email or through our support channels, including in connection with sales, marketing, or events.
The data controller is Paperless Movement, S.L., which operates the myICOR platform and membership. We are committed to protecting your personal data and respecting your privacy. This privacy notice describes what personal data we process on this website, why we process it, on which legal basis, who receives it, how long we keep it, and the rights you have.
2. Scope: Website and Member Application
This notice covers the public website at myicor.com. The myICOR member application at app.myicor.com is a separate surface: processing specific to the member experience (your account, purchases, learning progress, community contributions, and in-product features) is described in the privacy notice available in the application.
3. Who We Are and How to Contact Us
Paperless Movement, S.L.
C/ Mahón 8, 28290 Las Rozas, Madrid, Spain
NIF: ESB72872583
Email: support@myicor.com
If you have any questions about this privacy notice or our data practices, please contact us using the details above.
4. What We Process on This Website, Why, and on Which Legal Basis
This website has no contact forms and no newsletter signup. We deliberately keep the data we process here to a minimum. In full:
Hosting and security (server logs). When you visit any page, our hosting provider processes the technical data your browser sends: IP address, browser and device information, the pages you request, and timestamps. We use this to deliver the website, keep it secure, and diagnose technical problems. Legal basis: our legitimate interest in operating and securing our website (Art. 6(1)(f) GDPR).
Analytics (only with your consent). If, and only if, you consent via our cookie banner, we use Google Analytics 4 to understand how visitors use the site (pages visited, referral sources, approximate location derived from a truncated IP address, and interaction events). No analytics script is loaded and no data is sent to Google before you consent. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via in the footer. If you opted in to analytics cookies and arrived through one of our campaign links, for example from one of our YouTube videos, we also store the campaign parameters from that link in a first party cookie for up to 30 days and, if you create an account within that time, record them once on your account so we know which video or campaign led to your signup (Art. 6(1)(f) GDPR, measuring the effectiveness of our own marketing). If you sign up in the same visit, the campaign parameters can travel with the links you click on our own pages without being stored on your device.
Support chat (only with your consent). If you enable functional cookies via the banner, we load the Intercom messenger so you can chat with us. Intercom then processes your IP address, device information, and the content of any messages you send us. The messenger is not loaded before you consent. Legal basis: your consent for loading the messenger (Art. 6(1)(a) GDPR); answering your questions once you write to us is based on our legitimate interest in responding to your enquiry (Art. 6(1)(f) GDPR) or, where your enquiry relates to a contract, on Art. 6(1)(b) GDPR.
Partner program attribution (referred visits only). If you arrive via a partner's referral link, we use the Dub partner platform to attribute your visit to the partner whose link you clicked, so that the referral you initiated can be fulfilled and the partner can be credited. On such visits the dub_id and dub_partner_data cookies are set for up to 30 days; the latter also remembers any referral discount you are entitled to. Visitors who do not arrive through a referral link are not connected to Dub at all: the attribution script is only loaded on referred visits. Legal basis: our legitimate interest in operating the partner program that the referred visitor takes part in by following the partner's link (Art. 6(1)(f) GDPR); the cookie itself is strictly necessary to fulfil the referral the visitor initiated.
Email correspondence. If you email us, we process your email address, name if given, and the content of your message to reply to you, to keep records, and to establish, exercise, or defend legal claims where necessary. Legal basis: our legitimate interests in responding to communications and keeping records (Art. 6(1)(f) GDPR) or, where your message relates to entering into or performing a contract, Art. 6(1)(b) GDPR.
Fonts. All fonts on this website are served from our own servers. Your visit triggers no font requests to Google or any other third party.
You are not required by law or contract to provide us with any personal data on this website. Without the technical data your browser sends, however, we cannot display the site.
5. Sensitive Data, Automated Decisions
We do not collect any special categories of personal data on this website (such as data about your health, race or ethnicity, religious or philosophical beliefs, sex life or sexual orientation, political opinions, trade union membership, or genetic and biometric data), and no data about criminal convictions and offences. We do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects concerning you.
6. In-Product Search Analytics (Member Application)
When you use the search feature inside the myICOR platform, we process the search terms you enter.
What We Process
We process the search queries you type in-product (including the free text of the query), together with technical context such as which search surface you used, how many results were returned, whether a result was clicked, and — for a limited period — the link between the query and your account.
Why We Process It
- Your recent searches — so we can show you your own recent searches and let you continue where you left off
- Popular searches — so we can show, in aggregated form, which search topics are popular across our members, to aid discovery
- Internal product improvement — so we can understand, in aggregate, what members are looking for (including searches that return no results) and improve our content and search accordingly
Legal Basis
The legal ground for this processing is our legitimate interests (Art. 6(1)(f) GDPR) in providing and improving the search functionality of our platform and in understanding aggregate demand. We have carried out and documented a balancing assessment to ensure this processing does not override your interests, rights, and freedoms.
Aggregation and Safeguards
"Popular searches" and our internal analytics are based on aggregated data and are not attributed to you individually. A search topic only appears in aggregated views once it has been searched by a sufficient number of distinct members, so that no individual member's search can be identified from them. Your own recent searches are visible only to you.
Retention
We remove the link between a search query and your account after 30 days, and we delete the underlying individual search records after 90 days. Aggregated, non-identifying statistics may be kept for longer.
Recipients / Processors
Search data is stored and processed on our behalf by Supabase (our database and backend hosting provider), acting as our data processor under a data processing agreement. Where this involves a transfer of data outside the EEA, appropriate safeguards (such as EU Standard Contractual Clauses) are in place.
Your Right to Object
Because this processing is based on our legitimate interests, you have the right to object to it at any time on grounds relating to your particular situation (Art. 21 GDPR). If you object, we will stop processing your search data for these purposes unless we can demonstrate compelling legitimate grounds that override your interests. You can object directly in your account settings, where you can turn off the use of your searches to improve search, or by contacting us at support@myicor.com.
Your Other Rights
Your further data-protection rights — including access, rectification, erasure, restriction, and portability — are set out in the "Your Rights" section of this privacy notice and apply to this processing.
7. Ask myICOR (AI Assistant)
What it is
Ask myICOR is an AI assistant available to Inner Circle members, administrators and hosts. It answers your questions using content published inside the myICOR community that you are already entitled to see.
Who is responsible
Paperless Movement, S.L. is the controller for this processing. The supervisory authority is the Agencia Española de Protección de Datos (AEPD).
What we process
The questions you type, the community content retrieved to answer them, the answer text the AI generates, the sources it cites and where each citation appears inside the answer, and technical measurements such as response time, token counts and your thumbs up or thumbs down.
Why we process it
To provide the assistant you asked for (Article 6(1)(b) GDPR, performance of your membership contract), and to keep the feature working, prevent abuse, control cost and measure quality (Article 6(1)(f) GDPR, our legitimate interests).
Why other members' content appears in answers
Content you publish in the community can be quoted, with a link back to the source, in answers shown to members who were already entitled to read it. The basis is Article 6(1)(f). You can object at any time under Article 21 by contacting us at support@myicor.com, and we will exclude your contributions from AI answers.
Follow-up questions and your conversation history
The assistant supports follow-up questions, and you can reopen your past conversations from the thread list. To make that work we store the text of your questions, the text of the AI answers, and the position of each citation inside the answer on our servers. Answer text and citation positions are kept for 30 days after you last open the conversation, and in no case longer than 12 months, after which they are deleted and the conversation becomes read-only. Your questions and conversation titles are kept for up to 12 months. You can delete any conversation yourself at any time, which deletes it permanently.
Logs
A record of each question, without the answer text, is kept for up to 12 months for abuse prevention, cost control and quality measurement, and is then deleted or anonymised.
Who else receives it
Your questions and the retrieved community excerpts are sent to Anthropic PBC in the United States, which processes them on our behalf as a processor under a data processing agreement incorporating the EU standard contractual clauses. Anthropic does not use this content to train its models. This content is not retained by Anthropic by default; limited retention applies for abuse detection and legal purposes.
AI notice
Answers are generated by an AI system. They can be wrong or incomplete. Always check the cited sources.
Your rights
You can request access to your conversation history and its deletion at support@myicor.com. If content you published was quoted in an answer, you can request access to those excerpts and their deletion.
Locked preview
Members without access to the assistant may see a locked preview. If you interact with it we record that the interaction happened, on which surface, your membership tier, and the length of anything you typed. We do not store the text you typed. The basis is Article 6(1)(f).
8. Announcement Emails to Members (Member Application)
If you have an account with us, we send occasional emails about myICOR to the address you used to create it: new features, changes to the product, and things we are running for members. We do this because you are a member and you gave us that address to create your account. Legal basis: our legitimate interest in keeping our own members informed about the service they signed up for (Art. 6(1)(f) GDPR), together with Art. 21.2 of the Spanish Law 34/2002 (LSSI-CE), which permits commercial communications by email to people with whom we already have a contractual relationship, about products similar to the ones they hold with us.
You can stop them at any time and it costs you nothing. Every one of these emails carries an unsubscribe link that works in one click, and you can also turn them off in your account settings under Notifications. We tell you this when you create your account, and we repeat it in every message we send.
This does not affect service emails such as password resets, receipts, and notices about your account or your trial. Those are part of running your account rather than commercial communications, so this section does not cover them.
10. Recipients and Processors
We share personal data only with the following categories of recipients, and only to the extent described in this notice:
- Vercel Inc. (USA): hosting and content delivery for this website, including server logs.
- Google LLC (USA): Google Analytics 4, only after your consent.
- Intercom, Inc. (USA): support messenger, only after your consent.
- Dub Technologies, Inc. (USA): partner program attribution, only on referred visits.
- Anthropic PBC (USA): AI answer generation for the Ask myICOR assistant, as our processor under a data processing agreement.
- Professional advisers (lawyers, bankers, auditors, insurers) where necessary.
- Government bodies and regulatory authorities where we are legally required to disclose.
- Third parties in the context of a merger, acquisition, or sale of parts of our business, in which case this notice continues to apply to your data.
All service providers act as our processors under data processing agreements (Art. 28 GDPR) or as independent controllers where the law so provides, and may only process your data on our instructions and for the purposes described here.
11. International Transfers
Some of our service providers are based in the United States, so their processing involves a transfer of personal data outside the European Economic Area. We rely on the following safeguards:
- EU-US Data Privacy Framework (DPF): Vercel Inc., Google LLC, and Intercom, Inc. are certified under the DPF, which the European Commission has recognised as providing an adequate level of protection (Art. 45 GDPR).
- Standard Contractual Clauses (SCCs): transfers to Dub Technologies, Inc. are based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), which we apply as the safeguard for this transfer.
You can request a copy of the relevant safeguards by contacting us at support@myicor.com.
12. Data Retention
We keep personal data only as long as necessary for the purposes described in this notice:
- Server logs are retained by our hosting provider for a limited period for security and diagnostics, then deleted.
- Your cookie consent record is kept for 12 months, after which we ask again.
- The
dub_idanddub_partner_dataattribution cookies expire after 30 days; attribution records needed to account for partner commissions are kept for the duration of the partner program relationship and applicable statutory limitation periods. - Google Analytics event data is retained for up to 14 months, then deleted automatically.
- Campaign attribution recorded at signup is kept as part of your account data and is deleted with your account.
- Email correspondence and support conversations are kept as long as needed to handle your matter and thereafter only as required for statutory retention duties or the establishment, exercise, or defence of legal claims.
13. Data Security
We have put in place appropriate technical and organisational measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. Access to personal data is limited to those who have a business need to know; they process it only on our instructions and are subject to a duty of confidentiality.
14. Your Rights
Under the GDPR you have the right to:
- Request access to your personal data (Art. 15)
- Request correction of your personal data (Art. 16)
- Request erasure of your personal data (Art. 17)
- Request restriction of processing (Art. 18)
- Receive your data in a portable format (Art. 20)
- Object to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21)
- Withdraw any consent at any time, with effect for the future, without affecting the lawfulness of processing before withdrawal (Art. 7(3)); for cookies, use the link in the footer
To exercise any of these rights, contact us at support@myicor.com. We will respond within one month.
You also have the right to lodge a complaint with a supervisory authority, in particular with the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es, which is the authority responsible for us, or with the supervisory authority of the EU member state where you live or work.
15. Third-Party Links
Our website includes links to third-party websites. Clicking those links may allow third parties to collect data about you. We do not control these websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.
16. Changes to This Notice
We may update this privacy notice from time to time. We will post the updated notice on this page and update the "Last Updated" date. Material changes to consent-based processing will trigger a fresh consent request.
17. Questions
If you have any questions about this privacy notice or our data practices, please contact us at support@myicor.com.