Privacy
policy.

1. Who we are and what this policy covers

MyMFA is developed and the mymfa.cz, mymfa.eu, mymfa.de and mymfa.at websites are operated by MyOffice s.r.o., company registration no. 29188997, U viaduktu 881/21f, Chrlice, 643 00 Brno, Czech Republic. Contact for privacy questions and deletion requests: info@myoffice.cz.

This policy covers MyMFA for Android and iOS, the related authentication service and this website. iOS is available for testing through TestFlight; this text does not announce an App Store release. Both platforms support local OTP and QR codes. iOS also supports encrypted backup export and import and APNs notifications. Android implements FCM notifications; availability depends on the installed version and server configuration. We update this policy before changing data processing.

For business sign-ins, your organisation generally determines the purposes and rules of processing as the data controller. MyOffice may provide operation and support as its processor under a contract and instructions. MyOffice acts as controller for its own website, communications with you and its own test operations. Your organisation's administrator can explain the specific rules for its environment.

2. What data is processed

OTP codes on your phone — Android and iOS

When you add an OTP account, the app stores its label, any name or email address, issuer, secret and code parameters in protected local storage. Codes are calculated on the phone and this data is not sent to our servers or the account provider. The exception to local storage is an encrypted backup export initiated by you, as described below. Use of a code to sign in to another service is governed by that service’s rules.

Service icons and provider catalog

In versions with service icons, the app locally matches an account label or issuer against a catalog and may automatically download an icon directly from the recognized service’s public HTTPS website or a website you enter. The entire catalog is updated from the fixed URL https://mymfa.cz/data/providers.v1.json; your accounts are not searched on a server. The service website and DNS operator may observe the IP address, requested domain, time and technical request details. The selected domain itself may reveal an interest in that service. These requests do not send OTP secrets, codes, account names, email addresses or biometrics; the app adds no cookies or referrer. Icons and the catalog are stored in a private local cache. If an icon is unavailable, local artwork is used and TOTP still works offline. Third-party website and DNS logs follow their operators’ policies; our catalog requests follow the website log retention periods below.

Device pairing and business authentication

During pairing, the app sends a one-time pairing code, device label and public cryptographic key. The server creates a device identifier and access token; the app protects the token in local storage and the server retains its verification hash. iOS uses a separate mTLS client identity for each paired business account; the server also processes client certificate data needed to authenticate the device. Private signing and mTLS keys remain protected on the device.

During authentication, the app receives from the server the organisation and user identity, identifiers for the business account, target system, device, challenge, attempt and session, the expiry time and challenge security parameters. It sends back the challenge identifier, approval or rejection, the entered verification number and a digital signature. The server processes the authentication status and security events. The mobile app does not request or transmit your business account password.

Camera and biometrics

Android and iOS request camera access to scan QR codes. Images are decoded locally; MyMFA does not save them as photographs or send them to a server. Pairing code contents may subsequently be used for pairing. You can deny or revoke camera permission in system settings and enter the link manually.

Biometric authentication is handled by the operating system. MyMFA does not receive fingerprints, facial images or biometric templates. The system permits a protected operation after successful authentication under the device and app rules. iOS uses system user authentication; Android requires supported strong biometrics for functions that require it.

APNs and FCM notifications

When notifications are enabled, iOS uses Apple Push Notification service (APNs); Android versions with push support use Google Firebase Cloud Messaging (FCM). The provider processes a delivery token and technical data needed for delivery, including a Firebase installation ID for FCM. The app registers the token, platform, app and environment identifiers and notification language with the authentication server. A notification contains a generic prompt to open MyMFA, event and device identifiers and an expiry time. It does not carry OTP secrets, biometrics, passwords, account names or permission to approve a login. Details are retrieved over an authenticated connection to our server; a notification never approves access. You can disable notifications in system settings. Disabling their display does not itself delete the server registration or provider records.

Delivery registrations are used while pairing and notifications remain active. When the app reports that notifications have been disabled, the server removes the delivery registration; invalid tokens may also be removed after a provider response. Revoking a device blocks further delivery. Related audit records and operational backups follow the periods below. Data retained directly by Apple or Google follows their own terms, rather than our server log retention periods.

Firebase data processing and retention information.

User backups on iOS

You can initiate export or import of a password-protected backup. It contains OTP accounts including their secrets and descriptive business account data, such as the organisation, account label and server addresses. It does not contain private signing or mTLS keys or access tokens; restoring business access requires new pairing. The file is encrypted on the device before being handed to Files. You choose the location: the phone, iCloud Drive or another provider. The selected provider receives the encrypted file and related metadata under its own rules. MyOffice does not automatically receive the backup or its password and cannot recover the password. This is neither automatic pairing synchronisation nor a server operational backup.

Operational data, website and support

When a network connection is made, the server processes the IP address and technical HTTP request data. Operational and security logs may include the time, requested address, request result and client information. When you contact support, we process your email address, message and any information you choose to provide.

The mymfa.cz, mymfa.eu, mymfa.de and mymfa.at websites do not use analytics or advertising cookies or tracking pixels. Fonts and images are served locally. MyMFA does not use advertising, analytics or automatic crash-reporting SDKs. It does not read contacts, SMS, the microphone, location or the advertising identifier. Distribution platforms and operating systems may independently process diagnostics under their own rules and your settings; APNs and FCM notifications are described separately.

3. Why we use data

Data is used to create and manage pairing, calculate local OTP codes, verify and secure sign-ins, prevent abuse, resolve operational issues and handle your requests. We do not use it for advertising profiles or sell it.

Depending on the circumstances, MyOffice's own processing relies on performance of a contract or steps before entering into one, legitimate interests in service security and handling requests, or a legal obligation. For business accounts, your organisation determines the applicable legal basis. An operating system permission does not itself replace a legal basis under the GDPR.

The authentication system automatically checks whether an approval is valid and correct and may deny access. If you experience problems, contact your organisation's administrator, who can investigate and arrange another approved sign-in method. The service does not create advertising or behavioural profiles.

4. Who can access data

Business authentication data is available to authorised administrators in your organisation and operations or support staff to the extent necessary for their tasks. If a contracted supplier is involved, it may process data only for the agreed purpose, with appropriate protection and confidentiality and under the controller's instructions. Competent authorities may receive data where required by law.

Google Play, Apple App Store and TestFlight independently process data relating to accounts, distribution, testing and use of their services under Google's privacy policy and Apple's privacy policy. Apple (APNs) and Google (FCM) deliver notifications within the scope described above. Your chosen storage service handles exported backups. These services may involve processing outside the European Economic Area under the relevant provider’s terms and safeguards.

For business deployments, your organisation's controller provides information about the specific hosting, suppliers and any transfers outside the European Economic Area. If the controller arranges such transfers, it must meet the GDPR requirements, for example through an adequacy decision or appropriate contractual safeguards.

Protection in transit and at rest

The app communicates with approved authentication servers over HTTPS with certificate validation; iOS also uses mTLS for business accounts. Keys are protected by device system storage, including Keychain and, depending on key type, Secure Enclave on iOS. Android disables automatic app data backup. iOS does not automatically synchronise pairings through iCloud; manually saving an encrypted export to iCloud Drive is a separate user choice. Server data access is restricted to authorised personnel.

5. How long we retain data

• Local OTP accounts: until deleted in the app; on Android, also until app data is cleared. On iOS, uninstalling alone is not a reliable way to erase Keychain. Manually exported backups remain in your chosen location until deleted under the storage provider’s rules; the server backup period below does not apply to them.
• Pairing: local data is retained while the pairing is in use; server registration must be revoked by an administrator. Uninstalling the app alone does not revoke server registration. On iOS, you cannot rely on uninstallation to remove all Keychain items.
• Authentication challenges in the current pilot: a challenge is valid for 90 seconds. Its record becomes eligible for removal from the active state 24 hours after expiry and is removed on subsequent server processing. This rule does not apply to separate audit logs or backups.
• Security audit logs: the default period is 90 days from the event to investigate unauthorised access and handle incidents.
• Routine operational and web logs: 30 days from creation unless required to handle a specific security incident or covered by the regulated regime described below.
• Operational backups of MyMFA data: no more than 30 days from backup creation. After deletion from the active system, data may remain in a separate backup until this period ends. Backups are used only for recovery; previous deletions and access revocations are reapplied during restoration. A security log archive follows its own retention period, not the operational backup period.
• Support communications: while the request is being handled and for 12 months after it is closed.

We set these default periods for MyMFA operations provided by MyOffice. In deployments subject to the higher-obligation regime under Czech cybersecurity law, security and relevant operational logs within the prescribed scope are retained for 18 months from the event, unless a reason for longer retention is documented. This is a specific rule under Section 22(5)(c) of Czech Decree No. 409/2025 Coll.; it does not automatically apply to all data, backups or MyMFA deployments. Where another organisation operates the service, that organisation determines and communicates the specific periods.

At the end of the applicable period, data is deleted or irreversibly anonymised. Only data needed for a specific incident, legal claim or legal obligation may be retained longer, to the extent necessary and while that reason remains. The need for such retention is reviewed on an ongoing basis.

When handling a deletion request, the controller also considers related records and backups. If some data must be retained, you will be told why and for how long, or the criteria used to determine that period. Revoking a device does not automatically delete all historical records.

6. Deleting data and cancelling pairing

MyMFA does not create a separate consumer account with MyOffice. It stores local OTP accounts and allows device registration for existing business access. Follow the procedure for the data you want to delete:

1. OTP account on Android and iOS: select the OTP account’s delete action in the app and confirm. On Android, you can also clear all local data in the app’s system settings. Delete exported backups separately in Files or with your chosen provider, including the trash and any additional copies. Deleting an OTP account does not delete previously exported files. First arrange an alternative way to sign in to the affected services.
2. Business device registration and related server data: ask your organisation's administrator to revoke the registration and delete MyMFA data. You can also contact info@myoffice.cz with the subject “MyMFA — deletion request”. You can submit a request without having the app installed.

Include your organisation, account identifier or contact email, and whether you want to cancel pairing, delete data or both. Do not send your password, OTP secret, pairing QR code or access token. Where necessary, we will verify your identity in a proportionate way; requests for data controlled by your organisation are handled with its controller. Cancelling pairing does not delete your employer's business account or an account with another service.

We respond to GDPR requests without undue delay, generally within one month. If the law allows an extension due to the complexity or number of requests, we will explain the reasons within that period.

7. Your other rights

Subject to the GDPR, you may request access to your personal data, rectification, erasure, restriction of processing and portability. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Send your request to your organisation's controller or to info@myoffice.cz.

You also have the right to lodge a complaint with the Czech Office for Personal Data Protection or another competent supervisory authority.

8. Children and changes to this policy

MyMFA is intended for account security and business use and is not directed at children. When features, processed data or recipients change, we will update this policy and its revision date. We will communicate material changes in the app or through the service administrator as appropriate to their nature.