MIAB Technology Private Limited (“Company”, “MiAB”, “We”, “Us”, or “Our”) respects Your privacy and is committed to processing personal data transparently, securely, and in strict compliance with applicable data privacy legislation. This Privacy Policy (“Privacy Policy”) describes how We collect, use, store, process, disclose, transfer, and safeguard personal data obtained through miab.cc, Our SaaS marketing automation platform, administrative dashboards, API integrations, and related applications (collectively, the “Platform”).
To ensure precise compliance under the Indian Digital Personal Data Protection Act, 2023 (“DPDPA”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”):
- MiAB acts as a Data Fiduciary regarding the personal data of Customer administrative users, account holders, billing contacts, and platform visitors.
- Where Customer submits domain URLs, brand assets, product catalogs, customer reviews, or third-party marketing lists containing personal data to the Platform for processing, crawling, or content generation, Customer acts as the Data Fiduciary and MiAB acts strictly as a Data Processor. Customer’s data processing obligations are further governed by Our Data Processing Agreement (“DPA”).
The Platform is presently offered only to business Customers in India. MiAB does not target or offer the Platform to data principals in the European Union, the United Kingdom, or California. This Privacy Policy will be supplemented before it does so. This Privacy Policy forms an integral part of the Platform Terms of Service and operates in alignment with the End-User Licence Agreement (“EULA”).
1 Categories of Personal Data Collected
We collect and process the following categories of personal data across Our platform lifecycle:
1. Account Identity & Business Contact Data
Full name, business email address, professional phone number, company name, job title, corporate address, account login credentials (hashed passwords), and tax identification numbers (e.g., GSTIN, VAT ID) directly provided during Account creation or Workspace configuration.
2. Billing & Transactional Information
Payment card details (processed via PCI-DSS compliant third-party payment gateways), bank transfer details, billing addresses, invoice history, payment confirmation receipts, and credit usage logs directly provided during subscription checkout or renewal.
3. Submitted URLs & Crawled Content Assets
Domain URLs, publicly accessible web text, brand logos, product listings, image assets, social media handles, persona data, and personal information (team bio names, public contact details, testimonials) published on websites submitted by Customer. Includes third-party authored content submitted for voice-matching, persona-learning, or style-transfer features.
4. Telemetry, Diagnostics & Device Data
Internet Protocol (IP) address, browser type and version, device identifiers, operating system, access timestamps, feature usage metrics, clickstream data, prompt interaction logs, video generation requests, API calls, and error diagnostics automatically collected via cookies, server logs, and telemetry tools.
2 Purposes and Lawful Bases for Processing
We process personal data strictly in accordance with statutory lawful bases under the DPDPA and other applicable laws:
| Processing Purpose | Categories of Data | Lawful Basis under DPDPA |
|---|---|---|
| Account Setup, Workspace Management, & Service Delivery | Account Identity, Business Contact Data. | Performance of Contract (DPDPA Sec. 6). |
| Web Crawling, Brand Extraction, & AI Content Generation | Submitted URLs, Crawled Assets, Brand Asset Data. | Performance of Contract & Explicit Consent (DPDPA Sec. 6). |
| Billing Processing & Tax Invoice Generation | Financial & Transactional Data, Tax IDs. | Contractual Necessity & Legal Obligation (Tax Laws) (DPDPA Sec. 7). |
| Platform Security, Fraud Prevention, & Audit Logging | Telemetry Data, IP Logs, System Access Metadata. | Certain Legitimate Uses & Legal Compliance (DPDPA Sec. 7). |
| System Telemetry & Platform Analytics | Aggregated & Anonymized Telemetry Data. | Consent at Account creation (DPDPA Sec. 6), or processed in irreversibly anonymized form falling outside DPDPA. |
| Marketing Communications & Product Updates | Business Email Address. | Consent (DPDPA Sec. 6). |
| Voice & Persona Modelling | Third-party authored content submitted by Customer, persona attributes derived from it. | Performance of Contract, on Customer’s documented instruction & representation that it holds consent (DPDPA Sec. 6). |
3 Sub-Processors, Third-Party AI Providers & Data Disclosures
1. Third-Party Service Providers & Sub-Processors: To deliver generative AI capabilities, cloud infrastructure, and publishing workflows, We share data with trusted third-party service providers and sub-processors under strict contractual obligations of confidentiality and security. This includes Cloud Hosting & Compute; Generative AI Models & LLM Inference; Payment Gateways; and Social Media Publishing Interfaces (when enabled).
As of the date of this Privacy Policy, Our active sub-processors include:
Amazon Web Services (AWS)
Cloud infrastructure, data storage, and content delivery.
Location: India (ap-south-1 region).
Google LLC
Gemini LLM inference via AWS Bedrock; Firebase authentication.
Location: United States.
fal.ai & OpenRouter
Video and image generation models; model routing inference.
Location: United States.
Cashfree Payments India Pvt Ltd
Payment gateway and transaction processing.
Location: India.
A current list of sub-processors is maintained at miab.cc/sub-processors. We give Account administrators not less than thirty (30) days’ notice by electronic mail before engaging any new sub-processor, during which period a Customer may object on reasonable data protection grounds.
2. Legal & Regulatory Disclosures: We may disclose personal data to judicial or regulatory authorities if required to: (i) comply with a court order, subpoena, or statutory directive under applicable laws; (ii) enforce Our Terms of Service, EULA, or billing policies; (iii) protect the security, rights, or safety of MiAB, its users, or the public; or (iv) complete a merger, acquisition, corporate restructuring, or asset sale involving MIAB Technology Private Limited.
4 International Data Transfers
1. Location of Processing: MiAB is headquartered in India. Our primary cloud processing nodes are located in India and the United States. Personal data collected from users may be transferred to, stored, and processed in India or third countries where Our sub-processors operate.
2. International Transfer Safeguards: When transferring personal data outside India, We ensure appropriate safeguards are implemented, including:
- Contractual data protection obligations binding on each sub-processor equivalent to those set out in this Privacy Policy;
- Data transfer impact assessments and technical security safeguards (TLS encryption in transit, AES-256 storage at rest);
- Strict compliance with Section 16 of the DPDPA and any restrictions notified by the Central Government of India thereunder in respect of specified countries or territories.
5 Data Retention, Anonymization & Purging Protocols
We retain personal data only for as long as necessary to fulfill the purposes set out in this Privacy Policy, satisfy contractual requirements, and comply with applicable statutory tax, legal, or accounting obligations:
- Active Account Data: Retained for the duration of Your active Subscription and Workspace access.
- Billing & Tax Records: Retained for seven (7) years post-transaction in compliance with Indian corporate tax laws.
- Workspace Assets & Ingested Crawl Data: Retained for the duration of the Workspace life cycle. Upon Account cancellation or termination, Workspace assets and crawl logs are preserved in read-only status for thirty (30) days. On the 31st day post-termination, Workspace assets and generation logs are permanently purged from active databases.
- Beta Programme Data: Retained for twelve (12) months from the commencement of the beta programme, after which it is permanently purged or irreversibly anonymized.
As authorized under Section 10.5 of the EULA, MiAB reserves the right to compile, process, and retain anonymized, non-identifiable, aggregated system telemetry, performance logs, and error metrics permanently for product analytics, infrastructure optimization, and security monitoring.
6 Data Security Measures
We implement robust administrative, technical, and physical security measures designed to protect personal data against unauthorized access, destruction, loss, alteration, or disclosure.
Encryption Standards
TLS encryption for data in transit across public networks; AES-256 bit encryption for data at rest across cloud databases and asset stores.
Access Control & Governance
Role-Based Access Control (RBAC), multi-factor authentication (MFA) for administrative infrastructure access, and least-privilege network isolation.
Continuous Monitoring
Continuous vulnerability logging, automated intrusion detection systems, periodic code reviews, and dependency audits.
Incident & Breach Notification
We notify affected Data Principals without delay and report to the Data Protection Board of India (DPBI) within seventy-two (72) hours of becoming aware of a breach under DPDP Rules. Cyber security incidents are additionally reported to CERT-In under Section 70B(6) of the IT Act, 2000.
7 Your Statutory Data Privacy Rights
Under the DPDPA and applicable laws, You possess specific legal rights regarding Your personal data:
- Right to Summary: Request a summary of personal data processed by Us and identities of data fiduciaries/processors with whom it has been shared.
- Right to Correction & Erasure: Request correction of inaccurate data or erasure of personal data no longer necessary for processing.
- Right to Grievance Redressal: Readily available grievance redressal mechanisms provided by MiAB.
- Right to Nominate: Nominate an individual who shall exercise rights in the event of death or incapacity.
- Right to Restrict or Object: Request restricted processing of Your data or object to processing for direct marketing.
- Right to Withdraw Consent: Withdraw any consent You have given at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Right to Register a Complaint: Register a complaint with the Data Protection Board of India.
How to Exercise Your Rights: Submit a written request to Our Grievance Officer at privacy@miab.cc. Your request must state Your name and the electronic mail address or Account identifier under which Your personal data was provided, so that We may verify Your identity. We will respond within thirty (30) days or within such shorter period as may be prescribed by law.
Where personal data has been ingested into the Platform from a website submitted by a Customer, or from third-party authored content supplied by a Customer for voice or persona modelling, MiAB acts as a Data Processor and the Customer is the Data Fiduciary. We will refer any request received in respect of such data to the relevant Customer without undue delay and assist that Customer in responding.
8 Cookies and Tracking Technologies
The Platform utilizes cookies, local storage, and telemetry scripts to authenticate administrative sessions, preserve Workspace states, analyze usage trends, and improve user experiences:
- Essential Cookies: Strictly necessary for core account authentication, security, and session persistence.
- Analytics & Performance Cookies: Collect anonymous telemetry regarding feature usage, dashboard navigation, and performance bottlenecks.
- Cookie Management: Non-essential cookies, including analytics cookies, are set only where You have given consent through the cookie banner. You may review or change preferences at any time using the link in the website footer or by adjusting Your browser settings. Disabling essential cookies may impair platform functionality.
9 Third-Party Links and External Websites
The Platform contains links to external websites, social networks, and third-party tools. This Privacy Policy applies strictly to data collected directly by MiAB. We are not responsible for the privacy practices, content, or security of third-party websites. We encourage You to review the privacy policies of any external site You visit.
10 Revisions to this Privacy Policy
MiAB reserves the right to update this Privacy Policy at any time to reflect legal changes, technological advancements, or operational updates. Material updates will be notified by posting the updated policy on miab.cc, updating the "Last Updated" date, or sending an electronic notification to Account administrators. Continued use of the Platform after the effective date of an updated policy constitutes acceptance.
11 Grievance Redressal Officer and Contact Details
In accordance with the Indian Information Technology Act, 2000, IT Rules 2021, the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, the details of Our Grievance Officer and Data Protection Contact are as follows:
Data Protection & Grievance Redressal Desk
For any queries, requests to exercise data principal rights, or complaints regarding personal data processing:
- Attention
- Grievance Officer
- Entity
- MIAB Technology Private Limited
- Corporate Identity (CIN)
- U62012MH2026PTC470102
- GSTIN
- 27AAUCM8037E1Z1
- Registered Address
- 14-L, 6th Floor, Navjivan Commercial Premises, Mumbai Central, Mumbai – 400008, Maharashtra, India
- Privacy Enquiries
- privacy@miab.cc
- Grievance Redressal
- grievance@miab.cc