MIMO is a service of Golden Poppy, operated by Ana Francisco, an individual based in Lisbon, Portugal ("MIMO", "we", "us"). We are the data controller for personal data processed through MIMO. This notice explains what we collect, why, how long we keep it, who we share it with, and the rights you have under the EU GDPR, the UK GDPR, the UAE PDPL and US state privacy laws including the CCPA/CPRA. Our lead supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD), Portugal.

1. Data we process

Account data: email, name, password hash, OAuth identity from Google.
Meeting content: audio you record or upload, transcripts, AI-generated summaries, decisions, tasks, follow-up email drafts.
Usage data: meetings count, minutes processed, device/browser, IP address (truncated after 30 days).
Integration data: OAuth tokens for Notion, Slack, Google Calendar — stored encrypted at rest.
Consent records: timestamped log of cookie and recording consent.

2. Lawful basis (GDPR Art. 6)

Contract — to provide the MIMO service you signed up for.
Consent — for non-essential cookies, optional model-training contributions, and recording where required by local law.
Legitimate interest — security, fraud prevention, service improvement, balanced against your rights.
Legal obligation — tax, accounting, lawful requests from authorities.

3. Sub-processors and international transfers

We use a small set of carefully selected processors (hosting, AI inference, email delivery, payments). See the full list at /sub-processors. Transfers outside the EEA/UK rely on EU Standard Contractual Clauses (SCCs) and, where applicable, the UK IDTA.

4. Retention

Meeting recordings, transcripts and AI artifacts are kept for the retention window you choose in Settings → Privacy (default 12 months). Account data is kept while your account is active. Deletion is performed within 30 days of a verified request; backups are purged on the next backup-rotation cycle (max 90 days).

5. Your rights

Access, rectification, erasure, restriction, portability, objection, withdrawal of consent.
Right to lodge a complaint with your supervisory authority (e.g., your national DPA in the EEA, the ICO in the UK).
For California residents: right to know, delete, correct, opt-out of sale/sharing (we do not sell personal information), and non-discrimination.

Exercise any right from Settings → Privacy & Data or email privacy@mimo.app. We respond within 30 days.

6. Security

TLS in transit, AES-256 at rest, encrypted storage of recordings, scoped per-user database access (RLS), short-lived OAuth tokens, audit logs. See /security.

7. AI processing and model training

Your content is processed by AI to produce summaries, tasks, and follow-ups. We do not use your content to train models by default. If you opt in (Settings → Privacy → Help improve MIMO), we may use anonymized excerpts for model evaluation. You can revoke at any time.

8. Children

MIMO is not directed to children under 16. We do not knowingly process their data.

9. Contact

Golden Poppy (Ana Francisco), Lisbon, Portugal. Email: privacy@mimo.app

Privacy Policy