Privacy Policy

1. Who We Are

MyVoice is a public sentiment data platform operated by Balcostics Ltd., a company incorporated in Jamaica. We collect opinions through surveys, polls, and community engagement to generate insights that matter.

For the purposes of the Jamaica Data Protection Act 2020, Balcostics Ltd. is the data controller responsible for your personal data.

2. Data We Collect

Account Data

When you create an account, we collect:

• Email address (required for account verification via one-time password)
• Name, username (optional, provided during profile completion)
• Phone number (optional, required only for mobile top-up redemptions)
• Google account information (name, email, avatar) if you choose to sign in via Google
• Demographics: parish, age, gender, education level, employment status, income bracket, occupation, community, household size
• A location record, only if you allow location, when you sign up, save your parish, and claim points for a survey. It is encrypted, kept for 183 days and not published. Location records help myVoice verify real users and reduce fraud, abuse and scams across the rewards system: surveys, payouts and points. myVoice may also use your parish or location to show things near you, such as jobs in your parish, homes for rent close by, and rain forecasts for farmers in your area. myVoice records your location only at set moments, such as when you sign up, save your parish or finish a survey. It never tracks you live and never collects location when the app is closed. A location record is supporting evidence only. On its own it never flags or restricts an account.

Survey & Poll Response Data

• Your answers to survey questions and poll votes
• A demographic snapshot taken at the time of each response (parish, age group, gender, education, employment, income bracket)
• Time spent on each question and quality score

Device & Technical Data

• Device type (mobile, tablet, desktop), operating system
• Connection type, screen width, timezone, browser language
• IP address (used for security and fraud prevention; payment records keep it as part of the transaction, elsewhere we keep only a coded form)
• Device identifier (used to enforce our one-account-per-person policy and prevent multi-account abuse)
• We set a random device ID and record your phone model, timezone and network type to prevent fraud and duplicate accounts.

Behavioral Data

• Page views and search queries within the platform
• Survey session progress (started, completed, abandoned)
• Points earned, badges achieved, streak activity
• Topics followed, topics saved

AI Chat Data

Messages you send to the MyVoice AI assistant are processed by our AI service provider (see Section 5).

Group & Social Data

• Group messages, membership, and emoji reactions — visible to other group members
• Display name and avatar visible in groups and leaderboards

Payment & Redemption Data

• WiPay: order ID, points package, transaction amount (JMD), IP address
• Reloadly: phone number and top-up amount sent for mobile credit processing

Push Notification Data

Browser push subscription endpoint URL and encryption keys, stored to deliver notifications you have opted into.

Game & Trading Data

• JSE Stock Game: positions, trade history, profit and loss
• Prediction League: match predictions, scores, rankings
• Quick Insights: which topics you opened and what you paid
• Historical daily-game logs (Daily Spin, Mystery Box, and Did You Know were retired; old results stay in your account history)

Field and Household Location

Enumerators on field studies record their device location at the start and end of an interview and at each contact attempt at a household. This is the location of a household, so we treat it as personal data. It is used to check that interviews took place where they should.

Household coordinates are kept for 183 days, then deleted. The status of the reading stays. They never appear in published results, exports or story cards.

Anonymous Users

If you complete a survey without an account, we collect a non-reversible hashed fingerprint to prevent duplicate submissions. Anonymous users may optionally provide parish, age group, and gender.

3. How We Use Your Data

• Platform Services: Delivering surveys, polls, points, leaderboards, badges, prize draws, and AI chat
• Anonymized Datasets: Generating aggregated, anonymized datasets for organizations, universities, NGOs, and research institutions. Your individual identity is never included in datasets sold to third parties.
• AI-Powered Insights: Analyzing survey responses to generate public insights and trends (data is sent to our AI provider — see Section 5)
• JSE Stock Game: Operating the points-based stock trading game using real-time stock data from third-party providers
• Prediction League: Running the EPL prediction league using football fixture data
• Groups: Facilitating group communication and message delivery
• Redemptions & Payments: Processing mobile top-up redemptions and point purchases
• Push Notifications: Delivering web push notifications you have opted into
• Advertising: Conversion tracking for advertising (Google Ads)
• Platform Improvement: Understanding usage patterns to improve the MyVoice experience
• Fraud Prevention: Detecting suspicious activity through quality scoring and rate limiting
• Communications: Sending notifications about new topics, survey results, and platform updates

4. Legal Basis for Processing

Under the Jamaica Data Protection Act 2020, we process your data on the following bases:

• Consent: You provide informed, specific, and freely-given consent when you create your account and accept this Privacy Policy. You may withdraw consent at any time.
• Contract Performance: Processing necessary to operate the points economy, prize draws, and platform features you have opted into.
• Legitimate Interest: Platform security, fraud prevention, and maintaining the integrity of survey data.

5. Data Sharing & Cross-Border Transfers

We share your data with the following third-party service providers:

Important: We do not sell your personal data. Organizations that purchase datasets from MyVoice receive only anonymized, aggregated data. No personally identifiable information (name, phone number, email) is ever included in datasets.

Cross-border transfers to the United States, Trinidad & Tobago, and Germany are made in compliance with Section 45 of the Jamaica Data Protection Act 2020, on the basis of your explicit consent and the necessity of providing the contracted services.

6. Your Rights Under the Jamaica Data Protection Act

Under the Jamaica Data Protection Act 2020, you have the following rights:

• Right to Access: Request a copy of all personal data we hold about you. Use the “Export My Data” feature in your profile settings or email us.
• Right to Rectification: Correct inaccurate or incomplete personal data via your profile page.
• Right to Object: Object to the processing of your data for specific purposes.
• Right to Data Portability: Receive your data in a structured, machine-readable format (JSON export available in-app).
• Right to Withdraw Consent: Withdraw your consent at any time. This does not affect the lawfulness of processing carried out before withdrawal.
• Right to Erasure: Request deletion of your account. We will anonymize your personal information while retaining anonymized survey response data for aggregate analysis.
• Right to Prevent Automated Decisions: Object to decisions made solely by automated processing that significantly affect you.

To exercise any of these rights, email law@balcostics.com or use the relevant features in your profile settings. We will respond within 30 days.

You also have the right to lodge a complaint with the Office of the Information Commissioner (OIC) of Jamaica at oic.gov.jm.

7. Data Retention

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit using HTTPS/TLS for all communications
• JWT token authentication with token version revocation capability
• Rate limiting on all endpoints to prevent abuse
• Input validation and sanitization to prevent injection attacks
• HttpOnly cookies for secure session management
• Tamper-evident audit trail for points economy integrity
• OTP codes are hashed (SHA-256) before storage and expire after 10 minutes
• Response quality scoring to detect fraudulent submissions

In the event of a data breach, we will notify the Office of the Information Commissioner within 72 hours of becoming aware of the breach, as required by the Data Protection Act. We will also promptly notify affected data subjects.

9. Cookies & Tracking

We use the following storage and tracking technologies:

• localStorage: To store your authentication token and UI preferences (e.g., onboarding state)
• sessionStorage: Temporary UI state (dismissed banners, form progress)
• HttpOnly cookie: For secure session authentication
• Service Worker (PWA): Caches pages and API responses for offline access and faster loading
• Google Analytics (GA4): Aggregate, anonymized usage analytics to understand feature engagement and improve the platform
• Fingerprint hashing: A non-reversible hash used to prevent duplicate anonymous submissions. This hash cannot identify you.
• Page view logging: We record which pages you visit and how long you spend on them to improve the platform experience
• Search logging: We record search queries to improve search results and understand trending topics

10. Children's Data

MyVoice is intended for users aged 13 and older. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at law@balcostics.com and we will promptly delete the information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The version number and effective date are displayed at the top of this page. For material changes that affect how we process your data, we will notify you through the platform and may require you to re-consent before continuing to use MyVoice.

12. Contact & Complaints