Mielu Privacy Policy

1. Who is responsible

The data controller is Tomer Hirschmann, sole trader. Contact for any privacy matter: tomer.hirschmann2@gmail.com.

2. What data we process

• Account and profile: your name or nickname, your partner's name, and, if you choose to create one, your email address or Sign in with Apple.
• Couple data: the "together since" date, the relationship stage and other shared settings of the couple space.
• Content you write: answers to the daily questions, comments, reactions, game results and other in-app activity.
• Onboarding answers: what you answer when you start, used to personalise your plan.
• Couple photo (optional): only if you upload one.
• Push notification token, if you enable notifications.
• Device and usage data: basic technical information and usage events (which screen or step is reached, never the text of your answers).
• Purchase status: whether you have an active subscription, which plan and until when. We do not receive your card details; Apple handles payment.

3. Purposes and legal bases

• Providing the service (account, daily questions, revealing answers once you have both answered, notifications, subscription management): performance of a contract (Art. 6(1)(b) GDPR).
• AI features: only with your explicit consent (Art. 6(1)(a)), see section 5.
• Intimate content (Picante): only if both of you expressly turn it on; basis: consent.
• Improving the product with our own aggregate metrics, security and fraud prevention: legitimate interest (Art. 6(1)(f)). Optional third-party analytics (PostHog) rely on your consent (section 6).
• Legal obligations (accounting, responding to lawful requests): Art. 6(1)(c).

4. Data about your intimate life

Your answers may reveal aspects of your emotional or intimate life. We process them only to provide the service, do not use them for advertising or commercial profiling, and do not sell them. Picante mode is strictly optional and is only enabled if both partners accept it. Your partner sees your answers only once you have both answered.

5. Artificial intelligence

Some features (for example a line shown when answers are revealed, a weekly letter or a personalised weekly plan) may use AI from Anthropic. Rules:

• Only with each person's explicit consent, through a switch that is off by default. Features that use both people's texts run only if both partners have turned it on.
• What is sent: the question text and, depending on the feature, the couple's answers and the names needed to write the message. The weekly plan uses activity data, not the text of answers.
• What is never sent: your email address, your photo, your notification token or payment data.
• Who decides: you, separately from your partner. You can withdraw consent at any time on the "How Mielu uses AI" screen; from then on no more data is sent and the app keeps working without AI.
• We make no automated decisions with legal effects on you.

6. Processors and recipients

• Supabase (database, authentication, storage and functions), hosted in the European Union.
• RevenueCat (subscription management and purchase status).
• Apple (Sign in with Apple, in-app purchases and push notifications).
• Anthropic (AI features only, with your consent).
• PostHog (usage analytics): only if you turn on optional analytics; it is opt-in and off by default.
• Meta (only if we run Meta ads and only on iOS): purchase and sign-up milestones, without names or texts, and only if you accept Apple's tracking prompt and you have turned on optional analytics. Otherwise nothing is sent to Meta.

We do not sell your data. Inside the app, your partner sees only what you share with them under the product rules.

7. International transfers

Some providers (for example Anthropic or RevenueCat) may process data outside the European Economic Area. In those cases we rely on appropriate safeguards, in particular the European Commission's Standard Contractual Clauses and, where applicable, adequacy decisions.

8. Retention

We keep your data while your account exists. If you delete your account in the app, your personal data and associated content are erased; if the shared couple space is left with no members, it is deleted too, together with its photo. Backups are kept for a short period and then overwritten. We may keep, blocked, records needed to meet legal obligations (for example accounting and tax) for the legal periods.

9. Your rights

You may exercise your rights of access, rectification, erasure, restriction, portability and objection, and withdraw consent at any time (without affecting prior processing), by writing to tomer.hirschmann2@gmail.com. You can delete your account from the app settings. If you believe we have mishandled your data, you can complain to the Spanish Data Protection Agency (AEPD), www.aepd.es, or to your local authority.

10. Age

Mielu is for people aged 17 or over. It is not directed at children and we do not knowingly collect their data. If we find a minor's account, we will delete it.

11. Security

We apply reasonable technical and organisational measures: encryption in transit, row-level access control in the database so each person reaches only their own data and what is shared with their partner, and third-party service keys kept on the server only. No system is infallible; if a breach affecting you occurs, we will inform you as the law requires.

12. Changes to this policy

We may update this policy. We will show the date of the last update and, for significant changes, notify you in the app.

13. Contact

Tomer Hirschmann · tomer.hirschmann2@gmail.com