Loading session...
← Back to home

Privacy Policy MyTemenos B.V.

Last updated: July 9, 2026

We are MyTemenos B.V. We respect your privacy and private life, but sometimes we need your Personal Data. We consider Personal Data to be any information relating to an identified or identifiable person, in conformity with the General Data Protection Regulation (the GDPR).

This policy explains which Personal Data we use and why (the Privacy Policy). Furthermore, you will read how we process, store and protect your Personal Data. Finally, we outline what rights you have when we process your Personal Data.

This Privacy Policy applies to our website mytemenos.ai (the Website), our online application (the App) and the services or products we provide (the Services). We process your Personal Data in accordance with the GDPR and all other relevant legislation and regulations in the field of protection of Personal Data, including the Dutch GDPR Implementation Act (Uitvoeringswet AVG) and the Dutch Telecommunications Act (Telecommunicatiewet) regarding the use of cookies (the Relevant Legislation).

Minimum Age

You must be at least 18 years of age to use Temenos. By creating an account, you confirm that you are at least 18 years old. If we become aware that a user is under 18, we will terminate their account and delete their data. This age requirement reflects the sensitive psychological nature of our Platform and is in accordance with our AI service provider's usage requirements.

Processing of Personal Data

In order to provide you with our Website, App and Services, we process your Personal Data.

We also process special categories of Personal Data. The nature of Temenos as a platform for psychological self-exploration means that your conversations may contain information relating to your mental health, emotional wellbeing, philosophical beliefs, or spiritual experiences. Such data constitutes special category data within the meaning of Article 9 of the GDPR. We do not require you to share such information, but we recognise that it may arise naturally through your use of the Platform. We only process these special categories of data on the basis of your explicit consent, which is obtained separately before you first use Temenos.

How Do We Receive Your Personal Data?

We receive Personal Data directly from you when you:

  • Create an account on our Website (email address)
  • Subscribe to our Services (payment data)
  • Submit messages to our Platform (conversation content)
  • Use our Platform (IP address, activity metadata such as when Rooms are accessed and when sessions begin)
  • Interact with our Platform in ways that generate usage analytics (such as pages visited, Rooms accessed, session duration, and interaction events, collected via our analytics providers Mixpanel and PostHog)

If you access Temenos through our mobile application, we may additionally receive:

  • Device information (such as device type, operating system, and app version)
  • Push notification tokens (if you enable notifications)
  • Crash and error data (for the purpose of maintaining platform stability)

Who Is the Controller of Your Personal Data?

We are the controller of your Personal Data within the meaning of the Relevant Legislation. At the end of this Policy, you can find our contact details.

What Personal Data Do We Process, For Which Purpose(s), and On Which Legal Basis?

We need some of your Personal Data in order for you to use our Website, App and Services.

We are allowed to process your Personal Data, because we comply with the Relevant Legislation. We lawfully process your Personal Data because we:

  • Have legal bases for processing your Personal Data;
  • Inform you about the processing; and
  • Only process data for specific purposes, and no more than is necessary for that.

We shall only use your Personal Data for the following purposes or for compatible purposes:

Contact Data — Email address

Purpose: To create and manage your account; to authenticate your identity; to communicate with you about your Subscription.

Legal basis: A necessity to perform the contract.

Payment Data — Payment data of the paying party, invoices, subscription transaction overview

Purpose: To process subscription payments; to send invoices; to update our financial administration.

Legal basis: A necessity to perform the contract; a legal obligation (financial record-keeping).

Content Data — Conversation messages, AI-generated responses, IP address

Purpose: To process your inputs and generate AI-powered responses; to store your conversation history for your review and continued use; to maintain platform security and prevent abuse.

Legal basis: A necessity to perform the contract; consent (for storage of conversation history).

Special Categories of Data — Data concerning health, religious or philosophical beliefs

Purpose: To process your conversational inputs within Temenos and generate AI-powered responses, where such inputs may contain information relating to your mental health, psychological state, or philosophical and spiritual beliefs.

Legal basis: Your explicit consent.

Usage and Analytics Data — Pages and Rooms visited, session duration, interaction events, feature usage patterns

Purpose: To understand usage patterns and improve our Services; to identify and fix bugs; to monitor platform stability.

Legal basis: Consent; legitimate interest.

How Your Data Flows

When you send a message in Temenos, the following occurs:

  • Your message is transmitted from your browser to our servers;
  • Your message is forwarded to Anthropic's servers in the United States via their API to generate an AI response;
  • The AI response is returned to our servers;
  • Both your message and the response are displayed to you and stored in our database.

Anthropic stores inputs and outputs for up to 30 days for abuse monitoring, after which they are deleted; content flagged as a possible Usage Policy violation may be retained for up to 2 years, and associated trust-and-safety classifier scores for up to 7 years. Anthropic may retain data longer where required by law or court order. Anthropic does not use API data for model training.

Additionally, your conversation text may be processed by OpenAI, LLC to generate text embeddings used for search and retrieval functionality within Temenos. OpenAI receives only the conversation text necessary to create these embeddings, without your name, email address, or other identifying account information. OpenAI is also used for audio transcription and image generation. OpenAI stores inputs and outputs for up to 30 days for abuse monitoring, after which they are deleted; OpenAI may retain data longer where content is flagged for severe-risk investigation or where required by law or court order. OpenAI does not use API data for model training.

Analytics, Interest, and Consent

To invoke the legitimate interest basis, we balance our interests against your interests, fundamental rights and freedoms. In this way, we assess whether our interest, in processing the Personal Data, outweighs your privacy interest.

We process usage and analytics data collected through Mixpanel and PostHog on the basis of your consent, which you provide via our cookie settings, and legitimate interest. This processing helps us understand how users interact with Temenos, identify technical issues, and improve our Services. This data includes information about which Rooms you access, how long your sessions last, and which features you use. It does not include the content of your conversations. You may withdraw your consent at any time via our cookie settings or by contacting us at support@mytemenos.ai, without affecting the lawfulness of processing carried out before withdrawal.

Based on careful consideration of the interests and risks involved, we have concluded that your privacy interest does not outweigh our interest. Therefore, we believe we can invoke our legitimate interest in processing these Personal Data.

However, this assessment is subjective. Do you disagree with the processing of your Personal Data based on our legitimate interest? If so, you can always object to this. We will then reassess, and possibly discontinue the processing of your Personal Data.

Are You Obliged to Share Your Personal Data With Us?

In some cases, the processing of your Personal Data is necessary. This is relevant, for example, when we have to process your Personal Data in order to perform a contract with you or to provide a service to you. Without your Personal Data, we cannot provide our Service to you.

How Do We Secure Your Personal Data?

We make every effort to protect your Personal Data from loss, destruction, use, alteration or dissemination by unauthorized persons. We ensure that those who have nothing to do with your Personal Data cannot access it. We do this through the following measures:

  • Payment data is processed by Stripe, Inc. or Moneybird, both of which are PCI DSS compliant or ensure PCI DSS compliance
  • Your conversation data is stored under a randomly generated identifier (UUID) that is separate from your account contact details, ensuring that your psychological sessions are separated from your personal identity within our database
  • Access to any data we do have is strictly limited to employees on a 'need to know' basis

We constantly check our security measures for effectiveness, and if necessary adjust our processes. That way, your Personal Data is always protected and accessible in the event of a failure.

How Long Do We Store Your Personal Data?

We shall not store your Personal Data longer than the period in which we need them for the aforementioned purposes. We delete the Personal Data after we no longer need them for the purpose we process them for. The following is a list of the categories of Personal Data and the retention periods:

Contact Data

We retain your contact information for as long as your account is active and as necessary to provide our Services.

Payment Data

We retain your payment data for as long as necessary to meet our financial and tax requirements and obligations (7 years under Dutch fiscal law).

Conversation Data

We retain your conversation data for as long as your account is active. You may delete your conversation data at any time through the Delete Data function in Temenos. Upon account deletion, remaining conversation data is permanently deleted or anonymised within 30 days.

Content Data (IP address, activity metadata)

We retain content data for as long as necessary to provide you with our Services in an integral and continuous manner.

Data Held by Anthropic

Up to 30 days for standard processing. Content flagged as a possible Usage Policy violation may be retained for up to 2 years; associated trust-and-safety classifier scores for up to 7 years. Longer where required by law or court order.

Device and App Data

We retain device information and crash data for as long as necessary to maintain platform stability and resolve technical issues, and no longer than 12 months.

Usage and Analytics Data (Mixpanel and PostHog)

We retain analytics data for as long as necessary to improve our Services. Mixpanel and PostHog retain event data in accordance with our configured retention settings.

Data Held by OpenAI

Up to 30 days for standard processing. Longer where content is flagged for severe-risk investigation or where required by law or court order.

With Whom Do We Share Your Personal Data?

We may share your Personal Data with data 'processors' within the meaning of the Relevant Legislation. We conclude a data processing agreement with these parties, which entails that they shall process your Personal Data carefully and that they shall only receive the Personal Data they need to provide their service. These parties shall only use your Personal Data in accordance with our instructions and not for their own purposes. Our processors are:

(a) Anthropic PBC (San Francisco, United States) — AI service provider. Tasks: receiving and processing user text inputs; generating and returning AI-powered conversational responses; temporary processing of conversation context necessary for response generation. Anthropic does not use your data for AI model training. Data is transferred to the United States on the basis of the EU Standard Contractual Clauses (Module Two: controller to processor) incorporated into Anthropic's Data Processing Addendum.

(b) OpenAI, LLC (San Francisco, United States) — AI service provider (embeddings). Tasks: processing user conversation text to generate vector embeddings for search and retrieval functionality within Temenos. OpenAI does not use API customer data for model training. Data is transferred to the United States on the basis of the EU Standard Contractual Clauses incorporated into OpenAI's Data Processing Addendum.

(c) Stripe, Inc. (San Francisco, United States) — Payment service provider. Tasks: processing subscription payments; validating payment methods; executing recurring billing transactions; fraud detection and prevention; processing refunds. Stripe is certified under the EU-US Data Privacy Framework.

(d) Moneybird B.V. (Amsterdam, the Netherlands) — Accounting and invoicing service. Tasks: processing invoices; maintaining financial administration and records as required by Dutch fiscal law. Data is processed within the Netherlands.

(e) Supabase Pte. Ltd. (Singapore; infrastructure hosted in the US) — Hosting and database infrastructure. Tasks: hosting and operating the Temenos platform; storing and managing user account data and conversation data; authenticating user sessions; providing database infrastructure for the application; maintaining backups of stored data. Your data is stored on servers within the US.

(f) Vercel Inc. (San Francisco, United States) — Website hosting and delivery. Tasks: hosting and serving the Temenos website and web application; processing HTTP requests including IP addresses and request metadata; content delivery and performance optimisation. Data is transferred to the United States on the basis of the EU Standard Contractual Clauses incorporated into Vercel's Data Processing Addendum.

(g) Mixpanel, Inc. (San Francisco, United States; data stored in the EU) — Analytics service provider. Tasks: collecting and analyzing user interaction data and behavioral events within Temenos for the purpose of product improvement and understanding usage patterns. Your analytics data is stored on servers within the EU.

(h) Apple Inc. (Cupertino, United States) — If you access Temenos through a mobile application distributed via the Apple App Store, the store operator may process certain data in connection with the download, installation, and subscription management of the application, in accordance with their own privacy policies. If you subscribe to Temenos through an application store, the store operator may act as an additional payment processor. As the App Store operator, Apple processes this data as an independent controller under its own privacy policy and international transfer mechanisms.

(i) Google LLC (Mountain View, United States) — Application store operator, advertising, and analytics services. Tasks:

  • Application store: If you access Temenos through a mobile application distributed via the Google Play Store, Google may process certain data in connection with the download, installation, and subscription management of the application, in accordance with its own privacy policy. If you subscribe to Temenos through an application store, the store operator may act as an additional payment processor.
  • Google Analytics: collecting and analyzing website and app usage data and behavioral events to understand usage patterns and improve our product.

Data is transferred to the United States on the basis of the EU Standard Contractual Clauses incorporated into Google's data processing terms. Google is also certified under the EU-US Data Privacy Framework.

(j) GitHub, Inc. (San Francisco, United States) — Source code hosting. Tasks: hosting and version control of the Temenos application source code. GitHub does not process end-user personal data but is included here for the sake of transparency.

(k) Expo (Exponent, Inc.) (Palo Alto, United States) — Mobile application build and delivery service. Tasks: providing the build infrastructure (Expo Application Services / EAS) used to compile and distribute the Temenos mobile application; delivering over-the-air updates to the app; and, if enabled, storing device push tokens and transmitting push notification content in order to send notifications to your device. Expo acts as a data processor when it processes end-user data on behalf of the developer. Data is transferred to the United States on the basis of the EU Standard Contractual Clauses incorporated into Expo's Data Processing Addendum.

(l) CookieYes Limited (Milton Keynes, United Kingdom) — Consent management platform. Tasks: displaying the cookie consent banner on the Temenos website; recording, storing and managing your consent preferences; scanning and categorizing cookies; and generating consent records to demonstrate compliance. The CookieYes application is hosted in AWS data centres. The United Kingdom is recognized by the European Commission as providing an adequate level of data protection, so no additional transfer mechanism is required for transfers to CookieYes in the UK.

(m) RevenueCat, Inc. (Brandon, Florida, United States) — Subscription and in-app purchase management service. Tasks: managing in-app subscription and purchase state across the Apple App Store and Google Play Store; validating purchase receipts; and providing subscription analytics and entitlement management for the Temenos mobile application. RevenueCat stores customer data in AWS data centers located in the United States. Data is transferred to the United States on the basis of the EU Standard Contractual Clauses incorporated into RevenueCat's Data Processing Addendum.

(n) Plus Five Five, Inc. (San Francisco, United States) — Transactional email service provider (Resend). Tasks: sending transactional and account-related emails (such as sign-up confirmations, password resets, and notifications) on our behalf; processing recipient email addresses and message content for the purpose of delivery. Data is transferred to the United States on the basis of the EU Standard Contractual Clauses incorporated into Resend's Data Processing Addendum.

(o) PostHog, Inc. (San Francisco, United States) — Product analytics service provider. Tasks: collecting and analyzing product usage data and behavioral events within Temenos for the purpose of product improvement and understanding usage patterns; may include session recording and feature-flag functionality depending on configuration. Your analytics data is hosted in the US (PostHog Cloud US, Virginia). Data is transferred to the United States on the basis of the EU Standard Contractual Clauses.

If we have a legal obligation to share your Personal Data, we will do so. This is the case, for example, if a public authority legally requires us to share your Personal Data.

Transfer of Personal Data

We process your Personal Data within the European Economic Area (EEA) where possible. Your conversation data is stored on servers in the US (via Supabase), your invoicing data is processed within the Netherlands (via Moneybird), and your financial records are maintained under Dutch fiscal law.

Additionally, certain processors process Personal Data in the United States. These include Anthropic and OpenAI (AI services), Stripe (payment processing), Supabase (hosting and database infrastructure), Vercel (website hosting), Expo (mobile build and delivery), RevenueCat (subscription management), Plus Five Five, Inc. / Resend (transactional email), PostHog (product analytics), Google (app store, analytics), and GitHub (source code hosting). All EU-US data transfers are protected by the EU Standard Contractual Clauses incorporated into the respective Data Processing Addendums, and/or the EU-US Data Privacy Framework where the processor is a certified participant. We do not transfer your Personal Data to any other countries or parties without a lawful basis.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours. If the breach is likely to result in a high risk to you personally, we will also inform you without undue delay.

Cookies and Similar Technologies

Our Website and Platform use cookies and similar technologies. Cookies are small text files that are stored on your device when you visit our Website or use our Platform. When you access Temenos through our mobile application, we may use similar technologies such as local storage and device identifiers to achieve the same functionality.

We use the following types of cookies and similar technologies:

  • Functional/essential cookies: these are necessary for the Platform to function, including authentication cookies that keep you logged in to your account and session cookies that maintain your connection during use. These cookies do not require your consent under the Dutch Telecommunications Act (Telecommunicatiewet).
  • Analytics cookies and similar technologies: We use Mixpanel and PostHog to understand how our Platform is used. Mixpanel is configured to persist identifiers in your browser's localStorage rather than cookies, using its EU ingestion endpoint. PostHog is configured in cookieless mode. These analytics technologies are deployed only where you have consented via our cookie settings.

We do not use advertising cookies or cookies that track your behaviour across other websites.

Your Rights

You have the following rights under the GDPR:

The Right of Access

You can request access to your Personal Data. You can also export your data directly through the Export Data function in the settings menu of Temenos.

The Right to Rectification

You can request us to correct, limit or delete your Personal Data. In the event of fraud, non-payment or other wrongful acts, we can store some of your Personal Data in a register.

The Right to Erasure

You can delete your conversation data at any time through the Delete Data function in the settings menu of Temenos. You can also delete your entire account by contacting us at support@mytemenos.ai. Upon account deletion, your data will be permanently deleted as soon as possible, but at minimum within 30 days.

The Right to Data Portability

You can request a copy of your Personal Data in a structured, commonly used and machine-readable format. You can also export your data directly through the Export Data function in the settings menu of Temenos.

The Right to Object

You can object to the processing of your Personal Data.

The Right to Withdraw Consent

You can always withdraw your permission to process your Personal Data. From the moment of your withdrawal, we cannot process your Personal Data anymore. This may affect your ability to use Temenos.

The Right to File a Complaint

You can file a complaint at the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) if you are of the opinion that we wrongfully process your data.

Modifications to the Privacy Policy

We may modify this Privacy Policy. If we substantially modify the Privacy Policy, we shall place a notification on our Website and in our App together with the new Privacy Policy. We shall notify registered users by email in case of a substantial modification. If you do not agree with the changes, you may delete your account.

Disclaimer

Temenos is a tool for personal development and self-reflection, not a replacement for professional therapy or medical treatment. If you need psychological help:

We are not therapists and do not have a treatment relationship with you. For the full terms of use, please refer to our General Terms and Conditions.

Contact

In the event that you wish to exercise your rights, or in the event of other questions or remarks regarding our Privacy Policy, you can contact us via the following contact details:

MyTemenos B.V.

Hof van Delftstraat 22

2631 AH Den Haag

Chamber of Commerce: 42033350

Email: support@mytemenos.ai