GDPR position
No recruited panel. No tracker by default. Submitted personal data is still personal data.
What Mimiq does not collect by default — and what you may still submit
The architectural claim
Mimiq uses simulated personas instead of recruiting a participant panel. A standard test does not install a tracker on your product or observe real end users. Mimiq still processes your account details and the URLs, prompts, uploads, and optional customer rows you choose to submit.
Less data is a useful architectural choice, not a compliance exemption. Under EU guidance, information about an identifiable person — including data that is merely pseudonymised — remains personal data. Do not submit personal data unless you are authorised to process it and it is necessary for the test. European Commission guidance
What data we handle
An honest inventory of every byte that touches our system
Your account info
Personal data (yours)
Email, name, billing details, credit balance
Processed to provide the service. Deleted with your account.
URLs you test
Confidential; may contain personal data
Publicly reachable website or prototype URLs, screenshots, and other content you submit for testing
Processed to run the test and produce a report. Avoid private URLs or embedded personal data unless you are authorised to submit them.
Prompts you submit
Confidential; may contain personal data
Your test questions, goals, audience descriptions
Used to run the test. Prompts may be sent to model providers through AWS Bedrock. Do not include unnecessary personal or sensitive data.
Optional customer imports
May be personal data
Rows you upload from analytics, CRM, billing, or research tools
You control whether to use this feature and must have a lawful basis. Minimise or remove direct identifiers before upload whenever possible.
Synthetic persona profiles
Designed to be fictional
Demographically generated participants (name, age, occupation, traits)
Generated from aggregate priors and model output, not recruited from a participant panel. Do not treat a persona as a real individual.
Simulation results
Model output; may reflect submitted content
What synthetic personas 'said' about your test content
Not a real participant voice. Because output can quote or transform your input, handle the report at the same sensitivity as the source material.
Your end users
Not observed by default
The real people who visit your website or use your product
Mimiq does not install an end-user tracker for a standard test. If you upload customer data or expose it in a tested page, that data enters the processing scope.
Launch architecture
The AWS production path; final deployment canary still required
┌──────────────────────┐ HTTPS/TLS ┌──────────────────────┐
│ You (browser) │──────────────▶│ CloudFront │
└──────────────────────┘ │ S3 + same-origin API │
└──────────┬───────────┘
│ HTTP origin hop
│ CloudFront prefix list
│ + secret origin header
▼
┌──────────────────────┐
│ ALB → ECS API │
│ + SQS worker │
└──────────┬───────────┘
│
┌───────────────────┼───────────────────┐
▼ ▼ ▼
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ AWS Bedrock │ │ DynamoDB │ │ Stripe + Clerk │
│ model inference │ │ retained records │ │ billing + auth │
└──────────────────┘ └──────────────────┘ └──────────────────┘
Plainly: one CloudFront distribution fronts separate S3 and API origins. TLS terminates at CloudFront. The documented CloudFront-to-ALB origin connection uses HTTP, while ALB ingress is restricted to the AWS-managed CloudFront prefix list and requests must carry a secret origin header. ECS runs the API and browser worker, DynamoDB stores records, and AWS Bedrock US inference profiles run model calls. Stripe handles card entry and Clerk handles identity. This diagram is the deployment contract, not proof of a completed audit: the final public Page, Ask, Flow, share, and failure-path canaries must pass before production traffic is invited.
GDPR specifics
Article-by-article position
Art. 4 — Personal data
Scoped
Persona profiles are designed as fictional statistical constructs, not recruited records. Account data and identifiable information in customer submissions remain personal data.
Art. 6 — Lawful basis
Shared responsibility
Mimiq relies on the appropriate basis for its own account and service operations. Customers remain responsible for a lawful basis covering any personal data they choose to submit.
Art. 17 — Right to erasure
Manual today
Deletion requests are handled at victor@mimiqai.com. Automated account-wide deletion and a documented retention schedule are launch-hardening items.
Art. 20 — Data portability
Available by request
Report exports are available in product where shown; a broader account export is available by request. A share link is not presented as a substitute for a portability export.
Art. 28 — Data processors
Review before PII
The current sub-processor list and transfer terms are available on request. Customers submitting personal data should execute the applicable DPA before doing so.
Art. 33 — Breach notification
Runbook pending
Incidents will be assessed and notified as required by applicable law and processor terms. A formal, exercised incident-response runbook remains a launch-hardening gate.
Art. 35 — DPIA
Customer assessment
Whether a DPIA is required depends on the customer's purpose, data, and deployment. Mimiq cannot make that legal determination for every use case.
International transfers
US processing disclosed
The launch architecture uses AWS US regions and US model inference profiles. Account data and submitted content may therefore be processed in the US; review the current transfer mechanism and DPA before submitting personal data.
What the synthetic-participant model changes
No participant recruitment records
A standard Mimiq test does not collect participant names, contact details, consent records, screen recordings, or panel payments because no real panel is recruited.
Customer content still matters
URLs, prompts, uploads, and optional customer imports may be confidential or personal data. They still require minimisation, access controls, retention rules, and an appropriate lawful basis.
Directional evidence, not human research
The smaller participant-data footprint comes with a clear boundary: simulated reactions diagnose likely confusion and disagreement; they do not become human-subject evidence.
Get the docs
For procurement teams, security reviewers, DPOs
Data Processing Agreement (DPA)
Request current processor terms and DPA status before submitting personal data
Request →
Sub-processor list
Request the current provider list, processing locations, and applicable terms
Request →
Architecture overview
Data flows, storage, encryption, and inference paths
Request →
Compliance roadmap
SOC 2, pentest, and MFA plans with current status
Request →
Questions?
security@mimiqai.com · victor@mimiqai.com · We aim to reply within two business days