Who we are
Miiwa Ltd, a company registered in Cyprus (company registration number HЕ 492913; registered address: Tagmatarchi D. Pouliou and K. Pantelidi, Melina Court, 2nd floor, 8011 Paphos, Cyprus), operates the Miiwa platform.
If you have any questions regarding this privacy policy or how we process personal data, you can contact us at info@miiwa.ai.
What this privacy policy covers
Miiwa is an AI-powered work platform where specialized AI agents – also referred to as digital specialists – are configured around a company's relevant knowledge, rules, data, and workflows. Users utilize these digital specialists as ready-made tools for defined tasks.
Miiwa designs, configures, tests, and maintains the digital specialists as part of the implementation and the agreed solution. Access to features enabling users to build or modify agents themselves is not part of the standard solution unless explicitly agreed otherwise with the customer.
For selected customers, the agreed solution may also include integrations with third-party systems. Such integrations are only established where specifically agreed with the customer.
This privacy policy applies to the Miiwa platform, our website, customer and user access, workspaces, digital specialists and their runs, as well as our onboarding, implementation, support, and commercial relations.
The specific information processed depends on the individual customer's solution and the data the customer chooses to make available in Miiwa.
Our role in the processing of personal data
Miiwa may process personal data in different roles depending on the context.
When we process information in connection with our own website, customer administration, invoicing, sales, support, and security, Miiwa acts as the Data Controller.
When a customer uses Miiwa to process personal data as part of their own workflows, the customer acts as the Data Controller, and Miiwa processes the information as a Data Processor on the customer's behalf. This processing is regulated by the Data Processing Addendum (DPA) applicable between the customer and Miiwa. In these cases, Miiwa processes personal data solely in accordance with the customer's documented instructions and for the purpose of delivering the agreed service.
What information we process
We process the information necessary to deliver, operate, manage, and secure Miiwa. This may include, but is not limited to:
- Account Information: Name, email address, organization, role, and login-related information.
- Agreement and Invoicing Information: Commercial and administrative data.
- Technical Information: Log data, session information, and necessary system metadata.
- Security Information: Data used for access control, troubleshooting, and protection of the Platform.
- Customer Data: Data that the customer or the customer's users enter, upload, or otherwise make available.
- Company Knowledge and Context: Documents, workflows, rules, instructions, examples, and other materials.
- Prompts: User input and instructions for the digital specialists.
- Generated Outputs: Answers, content, and creative assets generated by the system.
- Run History: Necessary operational data linked to the use and execution of the digital specialists.
- Third-Party Data: Data from external systems, if an integration is specifically established as part of the agreed solution.
We do not process more personal data than necessary for the relevant purpose.
Customer data in Miiwa
Miiwa is built for companies to make their own relevant knowledge and context available to specialized AI agents. Depending on the customer's solution, this may include internal documents and guides, workflows and processes, brand, communication, and quality rules, analyses and reports, product and company information, historical material and examples, as well as customer, partner, or supplier information.
Data is kept separate between customers and relevant workspaces through Miiwa's access and isolation model. A customer's data is not used in other customers' solutions.
Miiwa does not use customer data to train general AI models.
AI processing and saved outputs
When a user utilizes a digital specialist, the user's input is processed together with the relevant company context and the instructions defined for that specific specialist. The parts of the information necessary to perform the task may be processed by an external AI model.
Prompts, generated outputs, assets, and relevant data about runs may be stored in the customer's workspace, allowing the customer's authorized users to return to previous work and results. Saved customer content is protected by encryption and access control.
Stored work content is encrypted at the application level before storage. Miiwa's systems may decrypt it automatically for authorised processing and display. Personnel have no ordinary access through administration or support functions; support uses only material the customer shares. Approved service providers may process necessary information. This encryption covers stored work content in Supabase and R2 and Suite storage. MiiwaCrawl’s separate working database containing crawl jobs and document cache is not covered by this application encryption.
Miiwa may process necessary technical metadata, operational data, and security data for the purpose of operating, protecting, and troubleshooting the Platform. Customer data is not used by Miiwa for the training of general AI models.
Integrations for selected customers
Integrations with external systems are not a standard feature that customers are expected to configure themselves as part of the regular Miiwa solution. For selected customers, an integration may be established as part of the specifically agreed solution.
If a solution includes an integration, Miiwa may process the data necessary for the relevant digital specialist to use or exchange information with the system in question. The scope of the processing depends on the specific integration, the customer's instructions, and the agreed solution.
Any additional sub-processors that become necessary as a regular consequence of such an integration are handled in accordance with Miiwa's DPA and sub-processor list.
Purpose of the processing
We process personal data and other relevant data to create and manage customers and users, deliver the Miiwa platform, configure and operate digital specialists, process work tasks on the customer's behalf, store outputs and run history for the customer's authorized users, and provide onboarding, implementation, support, and technical assistance.
We also process necessary information for the administration of agreements and invoicing, monitoring of the Platform's operation and security, troubleshooting, prevention of abuse, and fulfillment of legal and contractual obligations. Where an integration is separately agreed, we also process the information necessary to deliver this integration.
Legal basis
When Miiwa acts as the Data Controller, we process personal data based on one or more relevant legal bases under applicable data protection legislation. This may be processing necessary to fulfill a contract, our legitimate interest in operating and securing Miiwa, consent where applicable, or processing necessary to comply with a legal obligation.
When Miiwa acts as a Data Processor, the legal basis is determined by the customer as the Data Controller. In these cases, Miiwa processes the information according to the customer's documented instructions and in accordance with the applicable Data Processing Addendum.
Sub-processors
Miiwa utilizes external vendors to deliver and operate parts of the Platform. Not all vendors are used for every run or for every customer. Which vendors process data depends, among other things, on the digital specialist, the chosen AI model, and the features included in the customer's solution.
| Vendor | Purpose | Data / Processing | Country or Processing Region |
|---|---|---|---|
| Supabase, Inc. | Database, authentication and file metadata | Application data, customer content, and necessary system data | Ireland (EU), AWS eu-west-1, for the primary database and storage. Support and other processing may involve locations outside the EEA under the provider’s DPA. |
| Cloudflare, Inc. (R2) | Storage of uploads and generated files | Application-encrypted private files, object metadata and material the Customer chooses to publish | EU for objects in Miiwa's R2 bucket with EU jurisdiction. Account, support and other administrative processing may occur outside the EEA under the provider's DPA. |
| Vercel, Inc. | Hosting and overall operation of Miiwa | Request metadata, runtime data, and technical logs | United States and other global locations used by Vercel and its approved sub-processors. |
| Functional Software, Inc. (Sentry) | Error and performance monitoring | Technical error and performance information with PII scrubbing | Frankfurt, Germany (EU), for Miiwa’s configured Sentry data storage. Certain support and administrative processing may take place outside the EEA. |
| Plus Five Five, Inc. (Resend) | Transactional emails and email features | Email addresses, delivery data, and potentially relevant message content | United States. |
| OpenAI Ireland Ltd. | AI model processing | The prompts, instructions, and context parts necessary for the specific AI run | United States and other locations documented by OpenAI for its services and sub-processors. Miiwa uses the standard API endpoint; processing is not restricted to Ireland or the EEA. |
| Anthropic, PBC | AI model processing | The prompts, instructions, and context parts necessary for the specific AI run | Data storage in the United States; processing may also take place in Europe, Asia and Australia under Anthropic’s documented infrastructure arrangements. |
| Google Ireland Limited | Gemini model processing | The prompts, instructions, and context parts necessary for the specific AI run | Global, including the United States and other countries where Google or its agents maintain facilities. Miiwa uses the Gemini API without a configured regional Vertex AI endpoint; processing is not restricted to the EEA. |
| Crello Limited / VistaCreate | Design and asset features through Creative Studio | Design content and necessary information/uploads for the specific feature | Global, including the United States and other locations described in Vista’s Privacy Notice. Crello Limited is established in Cyprus; this does not restrict processing to Cyprus or the EEA. |
| DepositPhotos Inc. | Searching for and licensing stock media for Creative Studio | Search queries and necessary licensing information | United States and other countries used by Depositphotos and its service providers. |
When a vendor processes data outside the EU/EEA, a relevant lawful transfer mechanism is applied in accordance with applicable data protection legislation. The currently applicable and complete overview of sub-processors, as well as in-depth data flows, can be found on Miiwa's official Sub-processor List.
International transfers
Some of Miiwa's vendors may process personal data outside the EU or EEA. Where personal data is transferred to a country outside the EU/EEA, Miiwa ensures that a relevant transfer mechanism is in place under applicable data protection legislation.
Depending on the individual vendor, this is based on an adequacy decision from the European Commission, including the EU-U.S. Data Privacy Framework for certified US companies, or the European Commission's Standard Contractual Clauses (SCC). Further information about individual vendors' specific mechanisms can be found on the sub-processor list.
Storage and deletion
Miiwa retains personal data and customer data for as long as necessary to deliver the agreed service or fulfill the purpose for which the information was collected. Prompts, outputs, assets, and run history are stored in the customer's workspace so that the customer's authorized users can access previous work.
When Miiwa processes information as a Data Processor, storage and deletion take place in accordance with the customer's instructions, the applicable main agreement, and the Data Processing Addendum. Upon termination of the customer relationship, customer data is deleted or returned in accordance with the terms of the agreement, unless applicable law exceptionally requires continued storage.
Account, agreement, invoicing, security, and documentation information may be retained longer when necessary for Miiwa's own lawful purposes, accounting requirements, or legal obligations.
Your rights
If Miiwa is the Data Controller for the processing of your personal data, you have, subject to applicable law, the right to access, rectification, erasure, restriction of processing, objection, and data portability, as well as the right to withdraw your consent.
If your information is processed in Miiwa on behalf of your employer or another Miiwa customer, that specific organization is the Data Controller. In such cases, requests to exercise rights must be directed straight to the relevant Data Controller company. Miiwa assists our customers in handling such requests in accordance with our contractual obligations.
You have the right to lodge a complaint with the supervisory authorities. You can complain directly to the Danish Data Protection Agency (Datatilsynet) (Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk) or to the Office of the Commissioner for Personal Data Protection in Cyprus, where Miiwa Ltd is established.
Security
We apply technical and organizational security measures adapted to the nature of the data Miiwa processes and the risks associated with the processing. This includes encryption of data in transit and at rest, access control and role-based permissions, separation between customers and workspaces (multi-tenant separation), security and performance monitoring, as well as logging and relevant administrative controls.
Saved customer content is protected so that access to the content is restricted to the customer's authorized users in accordance with the Platform's access model. This protection is not end-to-end encryption. People with sufficient control over production code, secrets or identity systems can technically bypass the access policy. Older backups, PITR, logs and caches follow separate deletion periods; historical content is described as fully migrated only after remaining copies have been deleted or expired.
No technical solution can completely eliminate every risk. Customers and users should therefore only make personal data and confidential information available in Miiwa when it is relevant to the solution of the specific task.
Changes to this policy
We may update this privacy policy when Miiwa, our vendors, features, or legal obligations change. The date at the top of the page shows when the policy was last updated. If a change has a material impact on the way we process personal data, we will inform you of the change in accordance with our standard communication procedures.
Contact
If you have questions about this privacy policy, our processing of personal data, or wish to exercise your rights, you can contact:
Miiwa Ltd
Tagmatarchi D. Pouliou and K. Pantelidi Melina Court, 2nd floor 8011 Paphos Cyprus
Email: info@miiwa.ai