Privacy Policy

Version 2026-08-14 · Meritxell Media, trading as “Mia Automation”

1. Who is responsible

Meritxell Media (trading as Mia Automation), Van den Berghstraat 16, 5271 HS Sint-Michielsgestel, The Netherlands — Chamber of Commerce 80564186, VAT NL003457110B94 — is the controller for data collected via https://mia-automation.com and our services. Contact: info@mia-automation.com.

Important distinction: for data yóu have Mia process (such as the content of your email, calendar or customer data in your apps), you are the controller and we are the processor. The data processing agreement applies to that.

We are not required to appoint a data protection officer and have not appointed one. Your permanent point of contact for anything privacy-related is info@mia-automation.com.

2. What data we process

• Account — name, email address, password (stored encrypted), language preference.
• Orders — order data, invoice data and payment status. Payments run through Stripe; we never see your card or bank details.
• Use of your environment — credit usage, task log and technical logs, needed for billing, support and security.
• Conversations with Mia — the content of your chats, so Mia keeps context. These stay within your environment.
• Connected services — only if you connect them (such as email or calendar) and only to carry out your instructions.
• Website measurement (our own, cookieless) — which pages are visited, for how long, where you came from and which buttons work. We measure this ourselves on our own server, without cookies, using a random visitor identifier instead of your name and without storing your full IP address. If “Do Not Track” is enabled in your browser, we measure nothing.
• Google Analytics 4 — only after your consent via the cookie banner. Without consent, GA4 runs in cookieless mode (Consent Mode) and no cookies are set.
• Session recordings — only after your separate consent. It is an anonymised rendering of mouse movement and clicks on our own server; what you type into fields is never recorded.
• A/B tests — we sometimes show two versions of a page to see which is clearer. Which version you see is remembered locally in your browser and is not linked to you personally.
• Leads — if you fill in a form: the data you provide yourself.

For an account and an order, your name, email address and billing details are required: without them we cannot enter into an agreement with you or deliver the service. Everything else you provide voluntarily.

3. Purposes and legal bases

4. Cookies and measurement on the website

Necessary cookies are always set (login, language, security). For Google Analytics and session recordings we ask for consent first; you choose per category and can adjust your choice at any time via the cookie settings at the bottom of the site.

Our own website measurement works without cookies and without profiles: no cross-site recognition, no advertising purposes, no resale. We respect your browser's “Do Not Track” setting. If you would rather not be included in that measurement either, email info@mia-automation.com and we will switch it off for you.

5. Who we share data with

We never sell data. We only share with parties needed to deliver the service:

• Anthropic (US) — AI models processing Mia's tasks; no training on your data.
• Stripe — payments and invoices.
• Google — only for services you connect (Workspace) and analytics after consent.
• Hosting — our own servers in Dutch data centres; no public cloud for your environment.

Beyond that we only share where the law obliges us to, for example at the demand of a competent authority. We conclude a data processing agreement with every party that processes personal data on our behalf.

6. Transfers outside the EU

Your environment and our backups are located in the Netherlands. Two components touch the United States: Anthropic's AI models and — if you consent — Google Analytics.

For those transfers we rely on the EU-US Data Privacy Framework, supplemented by the European Commission's Standard Contractual Clauses as a fallback. We limit what leaves the EU to what is needed to carry out your instruction, and traffic is always encrypted in transit. If you want to know exactly which parts of your process touch the EU border, ask us at info@mia-automation.com and we will send you an overview.

7. Retention

• Account and environment: while you are a customer, plus a 30-day export window after cancellation.
• Invoices and order data: 7 years (tax retention obligation).
• Technical logs: up to 12 months.
• Website measurement (our own analytics events): 90 days, then deleted automatically.
• Session recordings: 30 days, then deleted automatically.
• Lead data: up to 2 years after last contact.

8. Security

Every customer runs in an isolated environment with firewall isolation, encrypted off-site backups and daily automated security audits. More on our security page. In case of a data breach posing a risk to your rights, we report it to the Dutch Data Protection Authority within 72 hours and inform you as soon as that is required.

9. Automated decision-making

We do not take decisions with legal or similarly significant effect based solely on automated processing, and we do not profile for advertising. Mia prepares work and makes suggestions; a human — you — stays in control. We only use automated checks to flag abuse and fraud, and we always review any resulting restriction ourselves before it becomes final.

10. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection. Where we process on the basis of your consent, you may withdraw it at any time; that does not affect the lawfulness of processing before withdrawal. Email info@mia-automation.com; we respond within 30 days and only ask for additional identification if we genuinely doubt who you are. Requests are free of charge.

If we cannot resolve it together, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, PO Box 93374, 2509 AJ The Hague).

11. Changes

We will inform you of material changes to this policy by email or via your environment. The applicable version date is always shown at the top; earlier versions are available on request.

Company details