Privacy notice
Last updated 9 November 2026
Who we are
TOMYMP LTD, trading as To My MP (“we”, “us”), operates tomymp.co.uk. We are the data controller for the personal data described here. Registered in England and Wales, company no. 17361132, registered at 3 Rothsay Street, London, SE1 4UH, United Kingdom. For any privacy question or request, contact support@tomymp.co.uk.
What we collect, and why
- Writing to your MP. By default we do not store your postcode, address, or the concern you write. The text you enter is sent to our AI provider (OpenAI) to generate your letter, which is returned to your browser for you to send yourself. If you tick the optional “Help track impact” box, we keep only the first part of your postcode (for example OX1), a short AI summary of your concern, which MP you wrote to, and the date you consented, never your full postcode, address, or full text, so you can report back on whether your MP responds. If you are signed in, it is linked to your account.
- Documents you attach (B2MP). They are read in your own browser and used for that generation. Their text is held with the generation for up to 7 days and then deleted. If you save the result as a campaign, the brief it was built from is kept with the campaign so it can be extended later. If you tick “Save to my library” on a document we keep its extracted text, never the original file, until you delete it from your library.
- Accounts. If you create an account we store your name, email and a securely hashed password (via our authentication provider, Supabase).
- Payments. Paid features are handled by Stripe. Card details are entered on Stripe’s own secure checkout and never reach our servers. We record your Stripe customer reference, which plan you bought, whether it is active, and which version of the terms you accepted.
- B2MP work. Campaigns, tasks, scorecards, Hansard watches and anything your organisation saves, with who created or changed them, so your team can work on them together.
- Usage and security. Which features each account uses and their AI cost, errors, and the IP address of requests, to run the service, keep it secure and stop abuse.
- Enquiries & reports. If you request a consultation or report incorrect information, we keep what you send us (including your email, if provided) to respond and to fix issues.
Special category data
A message to your MP can reveal your political opinions, which is “special category” data under UK GDPR. We only process it with your explicit consent, which you give by ticking the consent box before generating a letter. You can withdraw consent at any time by not using the tool, or by contacting us to delete stored data.
Our lawful basis, and how long we keep it
| What | Lawful basis | Kept for |
|---|---|---|
| Writing to your MP | Explicit consent (it can reveal political opinions) | Not stored, unless you opt in to tracking |
| Impact tracking | Explicit consent | Until you ask us to delete it |
| Your account | Contract (to provide the service you signed up for) | Until you delete it |
| B2MP work and attached documents | Contract with your organisation | Generations: 7 days. Saved campaigns and library: until deleted, and no more than 60 days after a subscription ends |
| Payments | Contract, and legal obligation (tax records) | Six years, as tax law requires |
| Usage, security and error logs | Legitimate interests (running and protecting the service) | Until no longer needed to run the service, or you ask us to delete them |
| Enquiries and fault reports | Legitimate interests (answering you, fixing problems) | Until the matter is dealt with and no longer needed |
Who we share it with
We use these processors to run the service: OpenAI (to generate text; it may keep requests for up to 30 days to monitor for abuse, and does not train on them), Supabase (accounts and database), Vercel (hosting), Stripe (payments), Resend (sending our emails), Cloudflare Turnstile (telling people from bots on our forms), Upstash (counting requests to stop abuse), and postcodes.io (turning a postcode into a constituency). We do not sell your data or use it for advertising.
Some of these providers are based in, or use servers in, the United States. Where your data leaves the UK, we rely on the safeguards in each provider’s data processing terms, such as the UK–US data bridge.
If you are a journalist
We hold a small amount of professional contact information about journalists at UK national news outlets, so that our clients can send stories to the right desk rather than to everyone. This section explains it, because we collected it from public sources rather than from you.
What we hold. Your name, your outlet, your role or beat, the formats you work in, and a work email address. That address is either one you have published yourself, or one worked out from your employer’s usual email format. Where it is worked out rather than published, it is clearly labelled as unverified, and we record where every piece of information came from and when.
What we do not hold. No personal contact details, no home address, no private phone number, and nothing about your views or opinions.
Why. Our lawful basis is legitimate interests: helping a relevant story reach a journalist who covers that subject. We have carried out and recorded a balancing test weighing that against your own interests, and we will share it on request.
How we limit it. We only cover a defined list of national outlets, we only suggest journalists who have recently written on the subject in question, and we cap suggestions at a handful per campaign. If you have publicly stated a preference, for example that you do not take PR pitches, we treat that as a stop and do not provide your details at all.
Your rights. You can ask us what we hold about you, correct it, or object to it entirely. If you object we will remove you and keep a record of that removal, so a later refresh cannot quietly add you back. Email support@tomymp.co.uk. You can also complain to the Information Commissioner’s Office (ico.org.uk).
We re-check or delete this information every six months, so nothing sits here indefinitely on the strength of an old byline.
Your rights
You have the right to access your personal data, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent at any time. Signed-in users can request a copy or deletion from their account page; anyone can email support@tomymp.co.uk. We reply within one month.
If you are unhappy with how we have handled your data, please tell us first at the same address and we will look into it. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Cookies
We use only essential cookies needed to keep you signed in. We do not use advertising or third-party tracking cookies.
This policy is provided in good faith and describes our current practices. Please review it periodically; we will update the date above when it changes.