Your data: location, export and switching

MyPIF is provided by Aeternus Progressus, Lda., a company established in Portugal, using the infrastructure below. Your PIFs, the files you upload and your account are stored in Ireland, in the European Union.

Our Data Processing Agreement at mypif.eu/dpa lists these providers as sub-processors, with the contract and transfer safeguard for each.

The infrastructure that stores your data is in Ireland and is subject to Irish and EU law. Our application servers also run in Ireland. We are subject to Portuguese and EU law.

Some of our providers are established in the United States or Singapore, or can access data from there. The AI processing takes place in the United States. Authorities in those countries may therefore seek access to data under their own law. The next section describes how that access is limited.

These are the technical, organisational and contractual measures that protect the data we hold for you against access or transfer by a government outside the EU that would conflict with EU or Portuguese law.

• Technical. Your data is stored in Ireland. It is encrypted in transit and, by our providers, at rest.
• Organisational. We disclose your data to an authority only under a valid order under EU or Portuguese law. We tell you of any request unless the law forbids it, check whether it is lawful, challenge it where there are reasonable grounds, and disclose only the minimum it lawfully requires.
• Contractual. Our providers in the United States and Singapore act under the EU-US Data Privacy Framework or the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), or both. Under the Standard Contractual Clauses, a provider that receives a legally binding request from a public authority must notify us where it is allowed to, review the legality of the request, challenge it where there are grounds, and disclose only the minimum permissible.

Those contractual commitments are written for personal data. We apply the same approach to all the data we hold for you.

You can export all the data you put into MyPIF and all the data the service produces from your use of it. This is the complete list:

• the original files you uploaded;
• the fields extracted from each PIF, and your edits to them;
• the versions of each PIF and of the pages generated from it;
• translations;
• quality scores and AI suggestions, each marked as generated by AI;
• the public and private pages generated for each PIF;
• sharing settings and the lists of people you have shared each PIF with;
• your account and organisation data, including your plan and subscription history;
• the metadata of all the above, such as dates of creation and change, status and language.

The only data we do not export is our own internal prompts, model settings and configuration, which are our trade secrets and are not your data.

You can get your data in these formats, free of charge.

The JSON export is one file with an object for your account and organisation, and a list of your PIFs. Each PIF holds its extracted fields, its versions, translations, scores and AI suggestions, its generated pages, its sharing settings and recipient list, the names of its original files, and its metadata. Dates are given in ISO 8601 format.

Known limitations. PDF and Word files present a PIF for reading and editing; they are not designed to be imported into another service. The JSON export follows MyPIF's own structure, because no common European specification exists yet for PIF data. Links to your public and shared pages stop working once your data is erased, and the people you shared PIFs with will need to be invited again from your new service.

You can switch to another provider, move your data to your own systems, or ask us only to erase it, at any time and on any plan, including the free plan. To start, write to geral@mypif.eu from the email address of your account and tell us which of the three you want.

• Notice period. At most two months. Switching starts on the date you give in your request, which can be up to two months after we receive it. If you give no date, it starts when we receive the request.
• Transitional period. Up to 30 days from the end of the notice period. During it we export your data, give you and your new provider reasonable help, keep the service running, tell you of any known risk to continuity, and keep your data secure. You may extend this period once, for as long as you consider appropriate.
• If 30 days is technically not feasible. We tell you within 14 working days of your request, with our reasons, and propose another transitional period of no more than 7 months. The service keeps running meanwhile.
• End of the contract. The contract ends when switching is complete, and we tell you so. If you asked only for erasure, it ends at the end of the notice period.
• Retrieval period. For at least 30 days after the transitional period ends, you can still retrieve your data.
• Erasure. After the retrieval period, we erase all your exportable data and digital assets within 30 days, and confirm the erasure to you in writing.

If you close your account without switching, you have the same 30-day retrieval period, followed by erasure within 30 days.

We charge nothing for switching, for exporting your data or for erasing it. There are no early-termination penalties. If you leave or switch before the end of a yearly plan, we refund the unused whole months.

We keep this page up to date. If a provider or a location changes, we update it and, where our Data Processing Agreement requires, tell you 30 days in advance.

Questions about your data: geral@mypif.eu. Aeternus Progressus, Lda., Rua dos 3 Lagares, N.º 1, Incubadora Fablab, 6230-421 Fundão, Portugal.