MIA Privacy Policy
Effective from: 20 October 2026.
This policy explains how MIA – a web application for small businesses available at app.miaworkspace.com.pl (together with the website www.miaworkspace.com.pl) – processes personal data. We write in plain language; if you have questions, write to us.
1. Data controller
Roksana Park, NIP (tax ID) 6653060157, ul. Weteranów 5, 62-510 Konin, Poland, e-mail: info@miaworkspace.com.pl (“MIA”, “we”). We have not appointed a data protection officer – for all data matters write to the e-mail address above.
2. What data we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account: first name and surname, e-mail address, Google account ID (when you sign in with Google), language | Creating the account and signing in, contact about the service | Art. 6(1)(b) (contract) |
| Business data: name, NIP, address, phone, website address, industry, city | Business diagnosis, reports, issuing invoices | Art. 6(1)(b) and (c) (contract, tax obligation) |
| Public business information: website content, Google Maps listing and reviews, PageSpeed results | Diagnosis, task list, comparison with competitors, draft replies to reviews | Art. 6(1)(b) |
| Payments: payment history, last digits and type of card (full card data is seen only by Stripe) | Billing, VAT invoices | Art. 6(1)(b) and (c) |
| Data from accounts you connect yourself (Google Search Console, Google Ads, Meta) – see section 3 | Visibility and ad spend reports | Art. 6(1)(a) and (b) (your consent on the Google/Meta screen and the contract) |
| Messages: website chat, requests in the app, e-mail provided for launch notifications | Answering questions, help, notification about the launch of the service | Art. 6(1)(a), (b) and (f) |
| Referral program: referral code, information on who referred you, commissions and their payouts; the referrer sees the name of your business, plan, and the dates of registration and plan start | Running the referral program and paying out commissions | Art. 6(1)(b) and (f) |
| Commission payout data: first name and surname or business name, NIP or PESEL, address, bank account number (for businesses checked in the public VAT taxpayers register of the Ministry of Finance) | Paying out commissions, accounting, PIT-11 statement | Art. 6(1)(b) and (c) (contract, tax obligation) |
| Technical data: IP address, browser type, cookies necessary for sign-in, anonymised visit counters | Security, protection against abuse, visit statistics | Art. 6(1)(f) (legitimate interest) |
We do not use advertising or tracking cookies. We do not sell personal data.
3. Connected Google and Meta accounts
On the paid MIA plan you can connect your own accounts to MIA: Google Search Console, Google Ads and Meta ad accounts (Facebook, Instagram). A connection is made only after you click a button in the app and grant consent on the Google or Meta screen.
| Service | Permission | What we read |
|---|---|---|
| Google Search Console | webmasters.readonly (read-only) | The list of your properties in Search Console; for the selected site: number of impressions and clicks in Google results, average position, the 10 most frequent search queries (last 30 days and the previous 30 days) |
| Google Ads | adwords | The list of ad accounts you have access to, their names and currency; for the selected account: cost, clicks, impressions and conversions from the last 30 days, and the search terms that cost money but gave no conversions |
| Meta (Facebook, Instagram) | ads_read (read-only) | The list of ad accounts; for the selected account: ad and campaign names, spend, clicks, impressions and results (e.g. enquiries, messages, purchases) from the last 30 days |
- Changes only with your consent. Search Console and Meta – read-only. In Google Ads MIA never changes anything on its own: it proposes fixes (negative keywords, excluding locations without results) and applies them only when you tick them in the app and approve. We log every such change and you can undo it with one click. MIA never raises budgets or bids. The “adwords” permission is the only scope Google offers for this API.
- Purpose: solely to show you (the MIA account owner) reports in the app and in the weekly e-mail – e.g. how many times your website appeared in Google or how much of the ad budget was spent without effect.
- What we do not do: we do not sell this data; we do not pass it to other companies other than the providers named in section 5, who process it on our behalf; we do not use it for advertising, profiling or credit scoring; we do not use it to train artificial intelligence models. An MIA employee may see this data only with your consent (e.g. in a help request), when necessary for security reasons or when required by law.
- Security: we store access keys (OAuth tokens) encrypted (AES-256-GCM); all connections use HTTPS.
- Disconnecting: at any time with the “Disconnect” button in the app. MIA then revokes the permission at Google or Meta and immediately deletes the tokens and all data fetched through that connection. You can also revoke the permission yourself: Google – myaccount.google.com/permissions; Facebook – Settings → Apps and Websites.
MIA’s use of information received from Google APIs and its transfer to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
3a. Social accounts connected for publishing
On the paid MIA plan you can connect your social media accounts (YouTube, Instagram, Facebook, TikTok, LinkedIn) so that MIA publishes posts, carousels and short videos on your behalf. A connection is made only after you click a button in the app and grant consent on the given platform’s screen. You can set publishing as manual (you approve each item) or automatic.
- What we do: we publish on your account the content prepared in MIA and approved by you (or – in automatic mode – according to your setting) and we read the results of those publications (views, likes, comments, shares) in order to show you a report and improve subsequent content for your business.
- What data we store: the name and ID of the account or page, access keys (tokens), the content and schedule of publications, and statistics of your own publications. We do not read your private messages or friends list.
- Publishing provider: publishing takes place through Post for Me (postforme.dev), an external provider of a social media publishing service, which acts on our behalf as a processor. The name “Post for Me” may be visible on the platform’s sign-in screen (Google, Meta, TikTok, LinkedIn). We do not pass on or see your passwords; you give consent on the platform’s screen.
- What we do not do: we do not sell this data, we do not use it for advertising or profiling, we do not use it to train artificial intelligence models, and we do not publish anything without your consent expressed in the settings (manual or automatic).
- Disconnecting: at any time with the “Disconnect” button in the app or in the settings of the given platform. After disconnecting we stop publishing and delete the tokens and fetched statistics. Posts already published remain on your account – you can delete them on the platform.
3b. Content created with the help of artificial intelligence
We create texts, carousels and videos using artificial intelligence services (Anthropic, PBC – texts; HeyGen Technology Inc. – virtual presenter in videos). We pass to them only the data needed to prepare the content: a description of the business, information from the website and the content of the task. The providers act on our behalf and do not use this data to train their own models. The presenter in the videos is a virtual character and does not depict any real person. Content created by AI is labelled in accordance with the platforms’ requirements.
4. How long we keep data
- Account and business data – until the account is deleted.
- Data from connected Google, Meta and other platform accounts (tokens, statistics) – until the account is disconnected or the MIA account is deleted (deleted immediately).
- Image and video files – deleted 7 days after publication, or after 30 days if they were not published (we keep previews until the account is deleted).
- Invoices and billing data – 5 years from the end of the tax year (a requirement of tax law).
- Website chat conversations – 12 months.
- Technical logs – up to 30 days.
5. To whom we pass data
We use providers who process data on our behalf:
- Railway Corp. – servers and database (EU region);
- Stripe Payments Europe Ltd. – card payments;
- Resend, Inc. – sending e-mails;
- Google LLC / Google Ireland Ltd. – Google sign-in, Maps and business search, PageSpeed, connected Google accounts and YouTube;
- Anthropic, PBC – text generation; HeyGen Technology Inc. – generation of videos with a virtual presenter;
- Post for Me (postforme.dev), provider of a social media publishing service (publishing on connected accounts);
- Meta Platforms Ireland Ltd. – connected Meta ad accounts.
Some providers may process data outside the European Economic Area (e.g. in the USA). This takes place on the basis of a European Commission decision (EU-U.S. Data Privacy Framework) or standard contractual clauses.
6. Your rights
You have the right to: access your data, rectify it, erase it, restrict processing, data portability, object to processing based on legitimate interest, and withdraw consent at any time (without affecting the lawfulness of earlier processing). You may also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).
7. How to delete data
- Connected accounts (Google, Meta, YouTube, Instagram, Facebook, TikTok, LinkedIn): the “Disconnect” button next to the given account in the app (tokens and fetched data are deleted immediately). You can also revoke access in the settings of the given platform.
- The whole account: write to info@miaworkspace.com.pl from the e-mail address assigned to the account – we will delete the account and all data within 30 days, except invoices, which we must keep by law.
- If you signed in through Facebook or connected a Meta account, you can also request deletion of data in Facebook settings (Apps and Websites → MIA Workspace → Remove).
8. Security
We use connection encryption (HTTPS), encryption of access keys, access control to systems and regular backups.
9. Children
MIA is a service for businesses and is not intended for people under 18.
10. Changes to the policy
We will inform you of material changes by e-mail or in the app at least 14 days before they take effect.