Saltar al contenido principal

Privacy Policy

Last updated: September 19, 2026

1. Data controller

The controller of the personal data collected through the MIAU platform and its website, including its forms, is:

  • USHUAIA CONSULTING SL
  • CIF: B20771739
  • C/ Mar de Alborán 70 F2BA
  • 29649 Mijas Costa, Málaga, Spain

You may exercise your rights or make inquiries about data protection through the Contact section of the Platform, or by writing to [email protected].

2. Data we collect

We collect the following types of personal data:

2.1 Registration data

  • Full name — for identification on the platform and within project teams.
  • Email address — for authentication, notifications, and communications.
  • Password — stored in encrypted hash format (never in plain text).

2.2 Project data

  • Project titles and descriptions.
  • Uploaded documents (text files, PDF, images).
  • Completed strategic and commercial forms.
  • Calendar events, meetings, and milestones.
  • Subprojects and checklists.

2.3 AI conversation data

  • Messages sent and received in the AI chat.
  • AI provider used and tokens consumed.
  • Knowledge extracted from conversations.

2.4 Billing data

  • Legal/tax name, NIF/CIF, and billing address.
  • History of invoices issued.

2.5 Technical data

  • IP address and browser User-Agent.
  • Device information for logging access sessions.
  • Audit logs of relevant actions on the platform.

3. Purpose of processing

Personal data is processed for the following purposes:

  • Service provision: management of the account, projects, teams, and platform features.
  • AI processing: sending project data and conversations to AI providers to generate responses.
  • Communications: service notifications, email verification, and password recovery.
  • Billing: issuing invoices and managing payments.
  • Security: fraud prevention, access auditing, and service protection.
  • Service improvement: aggregated and anonymized analysis of platform usage.

4. Legal basis for processing

  • Performance of the contract (Art. 6(1)(b) GDPR): processing is necessary to provide the contracted service.
  • Consent (Art. 6(1)(a) GDPR): for commercial communications and AI data processing.
  • Legitimate interest (Art. 6(1)(f) GDPR): for security, fraud prevention, and service improvement.
  • Legal obligation (Art. 6(1)(c) GDPR): to comply with tax and billing obligations.

5. AI providers and third-party transfers

For the AI assistant to function, conversation data and project context are sent to the following external providers:

  • TensorX Ltd. (Ireland) — Inference provider. It processes requests on its own infrastructure, physically located in data centers in Dublin (Ireland) and Helsinki (Finland).

The content of your conversations —the messages you send to the assistant and the responses generated— is processed entirely within the European Union, in ephemeral memory and without being written to disk. For that part of the processing, no international transfer of data takes place, and no Standard Contractual Clauses or adequacy decision are required. TensorX acts as a processor on behalf of MIAU, with a data processing agreement incorporated into its terms of service, requiring no separate signature.

For ancillary services related to its own operations —customer support, business management, and transactional email— TensorX states that it relies on sub-processors located outside the European Economic Area, covered by Standard Contractual Clauses in accordance with its public sub-processor policy. These sub-processors do not access the content of the conversations of MIAU users.

The models running on this infrastructure are open-weight and come from different developers (including DeepSeek, MiniMax, and Moonshot AI). It is worth distinguishing between two things that are often confused: the origin of the model does not determine where the data is processed. Execution takes place in the European Union, and the developers of those models do not receive the conversations or have access to them.

Under TensorX’s terms, the content of the requests is processed without being written to disk, without logging, and without being used to train models: it is not retained beyond the time necessary to fulfill the request. What is retained, however, is content-free usage data —token counts and technical call logs— for a maximum of twelve months, for billing and security purposes.

Additional protection of personal data. You are responsible for the data you enter in the chat, including third-party data, as set out in section 5 of the Terms of Service. As an additional measure, in case any data is included by mistake, before sending your message to the AI provider MIAU automatically detects certain identifiers and replaces them with placeholders: email addresses, phone numbers, Spanish DNI, NIE and CIF numbers, IBANs, card numbers and IP addresses that do not belong to a web server. The mapping between each placeholder and the real value exists only on our servers while your request is processed, and we use it to show you the real values in the response.

This measure reduces the personal data that reaches the provider, but does not remove it entirely: people's names and the rest of the content are sent as you write them, and automatic detection may miss some data. It is not anonymisation and does not replace your responsibility for what you share. We recommend not including personal data that is not necessary, especially health data or other special categories.

6. Connected third-party services

MIAU lets you connect your account to third-party services. None of them is activated unless you connect it. There are two types:

  • Integrations: third-party tools (for example, Notion, Metricool, or ClickUp) that the AI assistant can query on your behalf. The catalog of available integrations may grow over time.
  • Google services: Google Drive and Google Calendar, which MIAU accesses with your authorization to read the files and events that you or the assistant request.

When you use a connected service, MIAU sends it the information needed to handle your request: for example, search terms, instructions, or excerpts from the conversation. What the service returns (files, events, or results) is added to the conversation or project and treated like the rest of your content, including its processing by the AI provider described in section 5 and the retention periods in section 7.

Each third-party service is governed by its own terms and privacy policy. MIAU does not control and is not responsible for the data processing practices of those services. Before connecting one, we recommend that you review its privacy policy and make sure you are authorized to grant access to that account, especially if it belongs to a company or organization.

The access credentials you authorize are stored encrypted and used only to handle your requests. You can disconnect a service at any time from your account settings, under Integrations or Storage; when the connection is removed, MIAU deletes the stored credentials. You can also revoke access from the security settings of the service itself.

Google data. MIAU's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. MIAU does not use Google data for advertising, does not sell it, and does not use it to train artificial intelligence models.

7. Data retention

  • Account data: for as long as the account is active and for 30 days after cancellation.
  • Project data: for as long as the project exists on the platform.
  • AI conversations: for as long as the project exists. The user may delete individual sessions.
  • Billing data: for the period legally required (a minimum of 4 years under Spanish tax law).
  • Audit logs: for 2 years from their creation.

8. User rights

Under the GDPR, you have the right to:

  • Access: obtain confirmation of whether your data is being processed and access it.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure: request the deletion of your data (“right to be forgotten”).
  • Restriction: request the restriction of processing in certain circumstances.
  • Portability: receive your data in a structured, commonly used format.
  • Objection: object to processing based on legitimate interest.
  • Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise these rights, contact us through the Contact. We will respond within a maximum of 30 days.

You also have the right to file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) if you believe your rights have not been properly addressed.

9. Security measures

We apply the following technical and organizational measures to protect data:

  • Passwords stored using secure cryptographic hashing (bcrypt/argon2).
  • Authentication via JWT tokens with expiration.
  • Encrypted communications via HTTPS/TLS.
  • Role-based access control (owner, administrator, member, viewer).
  • Rate limiting to prevent abuse of the service.
  • Audit logs for sensitive actions.
  • Periodic database backups.

10. Cookies

For detailed information about the use of cookies, see our Cookie Policy.

11. Minors

The Platform is not directed at minors under the age of 16. We do not knowingly collect data from minors under that age. If you become aware that a minor has provided personal data, please contact us so that we can proceed with its deletion.

12. Website forms

This section applies to anyone who writes to us through the contact form or the “Order diagnosis” on the website, whether or not they have a MIAU account.

  • Data: for the contact form, name, email address, subject and message. For the diagnosis, name, email address, phone number and your answers to the questionnaire about how your agency works. In both cases, the date you accepted this policy and the IP address from which you sent the form, to evidence acceptance and prevent abuse.
  • Purpose: to answer your enquiry and, for the diagnosis, to show you the result, prepare it and contact you by email or phone to offer the demo you request. The result is calculated automatically from your answers; it is indicative only and has no legal or similarly significant effect on you.
  • Legal basis: taking pre-contractual steps at your request (Art. 6(1)(b) GDPR) and your consent (Art. 6(1)(a) GDPR), which you give by ticking the box before sending and can withdraw at any time.
  • Recipients: your data is not shared with third parties or sent to artificial intelligence providers. It is stored on our servers and only the MIAU team can access it. The only exception is the calendar used to book the demo, which is provided by Google (Google Ireland Limited): it only loads if you ask to see the available slots, and whatever you enter there to book is received by Google as the provider of that calendar.
  • Retention: 12 months from the last contact if no commercial relationship begins, or until you request erasure if earlier. If you become a client, the account data retention periods in section 7 apply.
  • Commercial communications: we will not send you newsletters or promotions using this data unless you give us separate, express consent.
  • Rights: those in section 8, which you can exercise by writing to [email protected].

13. Changes

We reserve the right to update this Privacy Policy. Substantial changes will be notified to registered users by email. The date of the last update is indicated at the beginning of this document.