1. Who We Are
MyVoice is a public sentiment data platform operated by Balcostics Ltd., a company incorporated in Jamaica. We collect opinions through surveys, polls, and community engagement to generate insights that matter.
For the purposes of the Jamaica Data Protection Act 2020, Balcostics Ltd. is the data controller responsible for your personal data.
Data & Platform Inquiries: research@balcostics.com
Legal & Privacy Inquiries: law@balcostics.com
2. Data We Collect
Account Data
When you create an account, we collect:
- Phone number (required for verification via one-time password)
- Name, email address (optional, provided during profile completion)
- Demographics: parish, age, gender, education level, employment status, income bracket, occupation, community, household size
Survey & Poll Response Data
- Your answers to survey questions and poll votes
- A demographic snapshot taken at the time of each response (parish, age group, gender, education, employment, income bracket)
- Time spent on each question and quality score
Device & Technical Data
- Device type (mobile, tablet, desktop), operating system
- Connection type, screen width, timezone, browser language
- IP address (used for security purposes, not stored long-term)
Behavioral Data
- Page views and search queries within the platform
- Survey session progress (started, completed, abandoned)
- Points earned, badges achieved, streak activity
- Topics followed, topics saved
AI Chat Data
Messages you send to the MyVoice AI assistant are processed by our AI service provider (see Section 5).
Anonymous Users
If you complete a survey without an account, we collect a hashed fingerprint (SHA-256, non-reversible) to prevent duplicate submissions. Anonymous users may optionally provide parish, age group, and gender.
3. How We Use Your Data
- Platform Services: Delivering surveys, polls, points, leaderboards, badges, prize draws, and AI chat
- Anonymized Datasets: Generating aggregated, anonymized datasets for organizations, universities, NGOs, and research institutions. Your individual identity is never included in datasets sold to third parties.
- AI-Powered Insights: Analyzing survey responses to generate public insights and trends (data is sent to our AI provider — see Section 5)
- Platform Improvement: Understanding usage patterns to improve the MyVoice experience
- Fraud Prevention: Detecting suspicious activity through quality scoring and rate limiting
- Communications: Sending notifications about new topics, survey results, and platform updates
4. Legal Basis for Processing
Under the Jamaica Data Protection Act 2020, we process your data on the following bases:
- Consent: You provide informed, specific, and freely-given consent when you create your account and accept this Privacy Policy. You may withdraw consent at any time.
- Contract Performance: Processing necessary to operate the points economy, prize draws, and platform features you have opted into.
- Legitimate Interest: Platform security, fraud prevention, and maintaining the integrity of survey data.
5. Data Sharing & Cross-Border Transfers
We share your data with the following third-party service providers:
| Provider | Location | Purpose |
|---|
| Anthropic (Claude AI) | United States | Survey analysis, AI chat, content moderation |
| Twilio | United States | OTP SMS delivery for phone verification |
Important: We do not sell your personal data. Organizations that purchase datasets from MyVoice receive only anonymized, aggregated data. No personally identifiable information (name, phone number, email) is ever included in datasets.
Cross-border transfers to the United States are made in compliance with Section 45 of the Jamaica Data Protection Act 2020, on the basis of your explicit consent and the necessity of providing the contracted services.
6. Your Rights Under the Jamaica Data Protection Act
Under the Jamaica Data Protection Act 2020, you have the following rights:
- Right to Access: Request a copy of all personal data we hold about you. Use the “Export My Data” feature in your profile settings or email us.
- Right to Rectification: Correct inaccurate or incomplete personal data via your profile page.
- Right to Object: Object to the processing of your data for specific purposes.
- Right to Data Portability: Receive your data in a structured, machine-readable format (JSON export available in-app).
- Right to Withdraw Consent: Withdraw your consent at any time. This does not affect the lawfulness of processing carried out before withdrawal.
- Right to Erasure: Request deletion of your account. We will anonymize your personal information while retaining anonymized survey response data for aggregate analysis.
- Right to Prevent Automated Decisions: Object to decisions made solely by automated processing that significantly affect you.
To exercise any of these rights, email law@balcostics.com or use the relevant features in your profile settings. We will respond within 30 days.
You also have the right to lodge a complaint with the Office of the Information Commissioner (OIC) of Jamaica at oic.gov.jm.
7. Data Retention
| Data Type | Retention Period |
|---|
| Account data (profile) | While account is active + 12 months after deletion |
| Survey responses | Retained indefinitely in anonymized form (demographic snapshots only, no PII) |
| OTP verification codes | Deleted after 10 minutes |
| AI chat messages | Retained for 90 days, then deleted |
| Points & transaction logs | Retained indefinitely (audit trail, hash-chain integrity) |
| Page views & search logs | Retained for 12 months, then aggregated |
8. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption in transit using HTTPS/TLS for all communications
- JWT token authentication with token version revocation capability
- Rate limiting on all endpoints to prevent abuse
- Input validation and sanitization to prevent injection attacks
- HttpOnly cookies for secure session management
- Hash-chain audit trail for points economy integrity
- Response quality scoring to detect fraudulent submissions
In the event of a data breach, we will notify the Office of the Information Commissioner within 72 hours of becoming aware of the breach, as required by the Data Protection Act. We will also promptly notify affected data subjects.
9. Cookies & Tracking
MyVoice does not use third-party tracking cookies. We use:
- localStorage: To store your authentication token and UI preferences (e.g., onboarding state)
- HttpOnly cookie: For secure session authentication
- Fingerprint hashing: SHA-256 hash of browser fingerprint + IP address for anonymous response deduplication. This hash is not reversible and cannot identify you.
- Page view logging: We record which pages you visit and how long you spend on them to improve the platform experience
- Search logging: We record search queries to improve search results and understand trending topics
10. Children's Data
MyVoice is intended for users aged 13 and older. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at law@balcostics.com and we will promptly delete the information.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The version number and effective date are displayed at the top of this page. For material changes that affect how we process your data, we will notify you through the platform and may require you to re-consent before continuing to use MyVoice.