Privacy Policy

Last updated: 07/01/2026

This Privacy Policy explains how PrivateMia collects and processes your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

1. Data Controller

BNT Enterprise, 6 rue d'Armaillé, 75017 Paris, FRANCE. To contact us, please use our contact page.

2. Data We Collect

• Account: email address, display name, age confirmation (timestamp), time zone and language.
• Conversations: messages exchanged with Mia and any personal information you choose to share. A 'memory' (key/value pairs such as relatives' names, pets or work) is automatically extracted to personalize responses.
• Media: images and voice messages (generated by Mia or uploaded by you), stored in a private space associated with your account.
• Subscription: Stripe customer and subscription identifiers, plan and status. PrivateMia never stores your payment card information; it is processed directly by Stripe.
• Notifications: push notification tokens (FCM) and platform type.
• Usage counters: number of messages, voice notes and photos per period (quota management and abuse prevention).

3. Purposes and Legal Bases

• Providing the service and personalizing conversations, performance of a contract (Article 6(1)(b) GDPR).
• Billing and subscription management, performance of a contract and legal obligations (Articles 6(1)(b) and 6(1)(c)).
• Age verification, legal obligation and legitimate interest (Articles 6(1)(c) and 6(1)(f)).
• Push notifications and proactive messages from Mia, consent (Article 6(1)(a)), which can be withdrawn at any time in your browser or device settings.
• Security, fraud prevention and abuse prevention, legitimate interest (Article 6(1)(f)).

4. Artificial Intelligence Processing

Your messages are sent to AI model providers to generate Mia's replies and, where applicable, voice notes and images. Automatic information extraction ('memory') personalizes your conversations. This processing does not produce legal effects or similarly significant automated decisions within the meaning of Article 22 GDPR. Your conversations are not used to train AI models.

5. Processors

• Supabase, database, authentication and media storage.
• OpenRouter, language model processing.
• Fal.ai, voice and image generation.
• Stripe, payment and subscription management.
• Google Firebase Cloud Messaging, push notifications.
• Vercel, application hosting.

These providers act on our behalf under data processing agreements compliant with Article 28 GDPR.

6. International Data Transfers

Some processors are located outside the European Union (including the United States). These transfers are safeguarded using appropriate mechanisms such as the European Commission Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

7. Data Retention

• Account, conversations, memory and media: retained for the lifetime of your account, then deleted when the account is closed.
• Billing records: retained for the legally required accounting period (up to 10 years).
• Push notification tokens: until revoked or invalidated.

8. Your Rights

You have the rights of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw your consent at any time. You may exercise these rights through our contact page. If necessary, you may also lodge a complaint with your local data protection authority.

9. Security

Data access is isolated per account (Row Level Security), sensitive operations are server-side only, media files are delivered through signed URLs with limited validity, and all data is encrypted in transit.

10. Minors

The service is intended for adults only. We do not knowingly collect personal data from minors. Any account identified as belonging to a minor will be deleted.

11. Cookies and Local Storage

PrivateMia only uses cookies and local storage strictly necessary for the operation of the service: authentication session (Supabase), language preference and application installation status. No advertising or third-party analytics cookies are used.

12. Changes

This Privacy Policy may be updated. The latest revision date is shown at the top of this page. If significant changes are made, you will be informed through appropriate means.