Saltar al contenido principal

Privacy Policy

Last updated: August 19, 2026

1. Data controller

The data controller for the personal data collected through the MIAU platform is:

  • USHUAIA CONSULTING SL
  • CIF: B20771739
  • C/ Mar de Alborán 70 F2BA
  • 29649 Mijas Costa, Málaga, Spain

You may exercise your rights or make inquiries about data protection through the Contact section of the Platform, or by writing to [email protected].

2. Data we collect

We collect the following types of personal data:

2.1 Registration data

  • Full name — for identification on the platform and within project teams.
  • Email address — for authentication, notifications, and communications.
  • Password — stored in encrypted hash format (never in plain text).

2.2 Project data

  • Project titles and descriptions.
  • Uploaded documents (text files, PDF, images).
  • Completed strategic and commercial forms.
  • Calendar events, meetings, and milestones.
  • Subprojects and checklists.

2.3 AI conversation data

  • Messages sent and received in the AI chat.
  • AI provider used and tokens consumed.
  • Knowledge extracted from conversations.

2.4 Billing data

  • Legal/tax name, NIF/CIF, and billing address.
  • History of invoices issued.

2.5 Technical data

  • IP address and browser User-Agent.
  • Device information for logging access sessions.
  • Audit logs of relevant actions on the platform.

3. Purpose of processing

Personal data is processed for the following purposes:

  • Service provision: management of the account, projects, teams, and platform features.
  • AI processing: sending project data and conversations to AI providers to generate responses.
  • Communications: service notifications, email verification, and password recovery.
  • Billing: issuing invoices and managing payments.
  • Security: fraud prevention, access auditing, and service protection.
  • Service improvement: aggregated and anonymized analysis of platform usage.

4. Legal basis for processing

  • Performance of the contract (Art. 6(1)(b) GDPR): processing is necessary to provide the contracted service.
  • Consent (Art. 6(1)(a) GDPR): for commercial communications and AI data processing.
  • Legitimate interest (Art. 6(1)(f) GDPR): for security, fraud prevention, and service improvement.
  • Legal obligation (Art. 6(1)(c) GDPR): to comply with tax and billing obligations.

5. AI providers and third-party transfers

For the AI assistant to function, conversation data and project context are sent to the following external providers:

  • TensorX Ltd. (Ireland) — Inference provider. It processes requests on its own infrastructure, physically located in data centers in Dublin (Ireland) and Helsinki (Finland).

The content of your conversations —the messages you send to the assistant and the responses generated— is processed entirely within the European Union, in ephemeral memory and without being written to disk. For that part of the processing, no international transfer of data takes place, and no Standard Contractual Clauses or adequacy decision are required. TensorX acts as a processor on behalf of MIAU, with a data processing agreement incorporated into its terms of service, requiring no separate signature.

For ancillary services related to its own operations —customer support, business management, and transactional email— TensorX states that it relies on sub-processors located outside the European Economic Area, covered by Standard Contractual Clauses in accordance with its public sub-processor policy. These sub-processors do not access the content of the conversations of MIAU users.

The models running on this infrastructure are open-weight and come from different developers (including DeepSeek, MiniMax, and Moonshot AI). It is worth distinguishing between two things that are often confused: the origin of the model does not determine where the data is processed. Execution takes place in the European Union, and the developers of those models do not receive the conversations or have access to them.

Under TensorX’s terms, the content of the requests is processed without being written to disk, without logging, and without being used to train models: it is not retained beyond the time necessary to fulfill the request. What is retained, however, is content-free usage data —token counts and technical call logs— for a maximum of twelve months, for billing and security purposes.

6. Data retention

  • Account data: for as long as the account is active and for 30 days after cancellation.
  • Project data: for as long as the project exists on the platform.
  • AI conversations: for as long as the project exists. The user may delete individual sessions.
  • Billing data: for the period legally required (a minimum of 4 years under Spanish tax law).
  • Audit logs: for 2 years from their creation.

7. User rights

Under the GDPR, you have the right to:

  • Access: obtain confirmation of whether your data is being processed and access it.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure: request the deletion of your data (“right to be forgotten”).
  • Restriction: request the restriction of processing in certain circumstances.
  • Portability: receive your data in a structured, commonly used format.
  • Objection: object to processing based on legitimate interest.
  • Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise these rights, contact us through the Contact. We will respond within a maximum of 30 days.

You also have the right to file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) if you believe your rights have not been properly addressed.

8. Security measures

We apply the following technical and organizational measures to protect data:

  • Passwords stored using secure cryptographic hashing (bcrypt/argon2).
  • Authentication via JWT tokens with expiration.
  • Encrypted communications via HTTPS/TLS.
  • Role-based access control (owner, administrator, member, viewer).
  • Rate limiting to prevent abuse of the service.
  • Audit logs for sensitive actions.
  • Periodic database backups.

9. Cookies

For detailed information about the use of cookies, see our Cookie Policy.

10. Minors

The Platform is not directed at minors under the age of 16. We do not knowingly collect data from minors under that age. If you become aware that a minor has provided personal data, please contact us so that we can proceed with its deletion.

11. Changes

We reserve the right to update this Privacy Policy. Substantial changes will be notified to registered users by email. The date of the last update is indicated at the beginning of this document.