Who we are
Miiwa Ltd, a company registered in Cyprus (company registration number HE 492913; registered office: Tagmatarchi D. Pouliou and K. Pantelidi, Melina Court, Floor 2, 8011 Paphos, Cyprus), is the data controller for the processing of personal data in connection with the Miiwa platform, our website and our commercial relationships.
If you have questions about this privacy policy or how we process personal data, you can contact us at info@miiwa.ai.
What this policy covers
This policy applies to the Miiwa platform, our public website and the public surfaces we host on behalf of customers, such as careers sites, partner portals and the demo-booking form.
What information we process
We process the information needed to deliver, secure and operate the Platform.
- account information, such as name, email address, organisation and login-related details
- agreement and billing information when you enter into a commercial relationship with us
- technical and security information, such as log data, device and session details, and integration metadata
- content you choose to store in features such as Miiwa Vault or through connected systems
Data by product area
Some product areas process personal data beyond ordinary account information. Depending on how the Platform is used, this can include:
- Recruitment: candidate details such as name, contact information, CV, applications and interview notes, including data submitted through public careers sites and the candidate portal
- Tourism: partner and destination contacts, portal access, and analytics sourced from connected tourism data services
- Annual planning (Year Wheel): activities, plans and calendar data, including optional Google Calendar synchronisation
- Decisions: the decision records and rationale you capture
- Assistants and agents: the messages, prompts and content you exchange with an assistant or agent during a session
- Demo bookings: name, email, organisation and scheduling details submitted through the public booking form
- Support and triggers: emails and content sent to support mailboxes, or to an agent's email, webhook, browser-extension or MCP trigger
Zero-Trace™ and session data
Miiwa is designed around a Zero-Trace™ principle for ordinary agent sessions.
As a general rule we do not keep the input and output of standard runs as a persistent history, and we do not use customer data to train models for other customers.
If you actively use features where storage is part of the product, such as Miiwa Vault or integrations, the data you choose to store or sync is processed as part of that feature.
Purpose of the processing
We process personal data in order to:
- create and administer user access
- deliver the Platform's features, onboarding and support
- protect the Platform against misuse, errors and security incidents
- deliver the integrations you choose to connect
- meet accounting, contractual and legal requirements
Legal basis
We process personal data on one or more relevant legal bases, including performance of a contract, our legitimate interest in operating and securing the Platform, your consent where it applies, and compliance with legal obligations.
Sub-processors
We use a set of trusted sub-processors to run the Platform:
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Application data and encrypted secrets | EU |
| Vercel | Application hosting and edge network | Request metadata and runtime logs | Global edge |
| Stripe | Subscription billing | Billing contact and subscription state (card data held by Stripe) | EU / US |
| Resend | Transactional and inbound agent email | Email addresses and message content | EU / US |
| Sentry | Error and performance monitoring | Error events with personal data removed | EU / US |
| Google Analytics | Website analytics | Anonymous usage data | |
| Vercel Speed Insights | Performance monitoring | Anonymous performance metrics | Vercel |
| AI providers (Anthropic, OpenAI, Google, Perplexity) | AI model inference | Prompt and response content for the run | Provider regions |
| Firecrawl | Managed web scraping | Target URLs and fetched content | Provider region |
| Depositphotos | Stock media search and licensing | Search queries and licence records | EU / US |
| VistaCreate | Embedded design editor | Design content you create | EU / US |
| VisitData | Tourism analytics | Tourism metrics | Provider region |
| Google Workspace and Gmail | Email delivery and calendar sync | Email addresses and message or event data |
AI providers do not train on your content through Miiwa, and bring-your-own-key setups keep provider usage on your own account. Services you connect yourself, such as CRM, advertising or productivity tools, are not Miiwa sub-processors: you control those credentials, and Miiwa passes data through only to deliver the integration you enabled.
Integrations you connect
When you connect a third-party service to Miiwa, this happens on your initiative and with your approval through OAuth or a similar authorisation flow.
We use only the tokens and data needed to deliver the integration you chose, into your own account or workspace.
Integrations are isolated per user or workspace and are not shared across customers.
International transfers
Some of the sub-processors above may process data outside the EU or EEA.
Where that happens, we rely on appropriate safeguards, such as EU Standard Contractual Clauses or an adequacy decision, to protect your data.
Storage and deletion
We keep personal data for as long as it is needed for the purposes it was collected for, or for as long as required by law or the agreement in place.
Account, agreement and security information may be kept longer than ordinary session content where this is necessary for operations, documentation or legal obligations. Workspace administrators can also configure how long run data is retained.
Your rights
Subject to applicable law, you have:
- the right to access the personal data we hold about you
- the right to have inaccurate information corrected
- the right to erasure where the conditions are met
- the right to restrict processing
- the right to object to certain processing
- the right to data portability
You can also lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus, or with the supervisory authority in your own EU or EEA country.
Security
We apply technical and organisational security measures matched to the risk, including access control, encryption, isolation of integration data, multi-tenant separation between workspaces and ongoing security monitoring. Enterprise controls such as single sign-on, automated user provisioning and audit logging are available.
We operate an information security program aligned with SOC 2 and ISO 27001 practices. This is a program of controls and evidence, not a substitute for a completed certification. No solution is entirely free of risk, so you should always avoid sharing unnecessary personal data in systems and documents.
Changes to this policy
We may update this privacy policy as the Platform and our legal requirements evolve. We will update the date at the top of this page when we do, and we will surface material changes where appropriate.
Contact
If you want to exercise your rights or have questions about how we process personal data, you can contact us at info@miiwa.ai.