1. Controller and Privacy Contact
The controller responsible for data processing on this website is:
Victor Gulchenko
Mimiq AI
Email: victor@mimiqai.com
2. General Information on Data Processing
2.1 Scope of Personal Data Processing
We process personal data only to the extent needed to operate, secure, support, and improve the service, using the legal basis that applies to each purpose. Cookies and session replay for analytics need your consent; anonymous visit counting, product usage analytics for accounts, service delivery, security, billing, and legal compliance rely on the other bases described below.
2.2 Legal Basis for Personal Data Processing
We process personal data based on the following legal bases:
- Art. 6(1)(a) GDPR - User consent
- Art. 6(1)(b) GDPR - Contract performance and pre-contractual measures
- Art. 6(1)(c) GDPR - Legal obligation
- Art. 6(1)(f) GDPR - Legitimate interests
2.3 Data Deletion and Storage Duration
Personal data is deleted or blocked as soon as the purpose of storage no longer applies. Storage may continue if required by EU or national law.
3. Website Usage and Log Files
3.1 Description and Scope
When you visit our website, our delivery and application infrastructure may collect the following data:
- Browser type and version
- Operating system
- Referrer URL (previously visited page)
- Hostname of accessing computer
- Time of server request
- IP address
3.2 Legal Basis and Purpose
The legal basis for temporary storage is Art. 6(1)(f) GDPR. The data is necessary to deliver website content to users and ensure website functionality, security, and system stability.
3.3 Storage Duration
Infrastructure logs are retained according to the active AWS and application logging configuration and may be kept longer when required for security, fraud prevention, or legal obligations. Ask us for the current retention schedule before submitting regulated data; a single enforced retention policy is still being formalized.
4. User Accounts and Registration
4.1 Data Collected
When you create an account, we collect:
- Email address (required)
- Name (optional)
- Profile information (optional)
- Account creation date
- Last login date
4.2 Legal Basis
Required account processing is based primarily on Art. 6(1)(b) GDPR for contract performance or pre-contractual steps. Separate consent applies only where it is specifically requested, such as optional analytics.
4.3 Storage Duration
Account data is kept while the account is active and as needed for billing, security, and legal obligations. Account-wide deletion is currently handled by request at victor@mimiqai.com; we respond and act within the periods required by applicable law.
5. Simulation Data
5.1 Data Collected
When you use our AI simulation service, we collect and process:
- Product ideas and descriptions you submit
- Publicly reachable URLs, screenshots, and other content you choose to test
- Selected audience parameters
- Optional customer or analytics rows you choose to import
- Generated simulation results
- Interaction data with personas
- Usage timestamps
5.2 Purpose
This data is processed to recruit a simulated audience, run the requested page, flow, or question test, produce a decision brief, preserve the report, prevent abuse, and provide support. Submitted prompts and content may be sent to model providers through AWS Bedrock and, in flows, to a contracted model provider. Mimiq does not recruit real study participants for a standard simulation.
5.3 Storage Duration
Simulation and report data is retained until it is deleted through an available product control or an account-level deletion request, subject to security, backup, billing, and legal requirements. Do not submit personal or sensitive data unless you are authorised to process it and it is necessary for the test.
6. Connected AI Assistants (ChatGPT)
6.1 Connecting
You can connect your Mimiq account to ChatGPT or another assistant that supports the Model Context Protocol (MCP). You sign in to Mimiq and approve access on our consent screen. Connecting does not run a test or spend credits. You can disconnect at any time in Settings under Connected apps, and access ends immediately.
6.2 Data We Receive
When you ask the assistant to use Mimiq, we receive only what that request needs: the content you want tested (URLs, copy, questions and answer options), the audience you describe, the number of simulated people, and the IDs of saved reports you ask to see. We also receive technical data such as IP address and request times for security and rate limits. We do not receive the rest of your conversation with the assistant.
6.3 Data We Return
Results are returned to the assistant so it can show them to you: counts, the simulated people's reactions and objections, and a link to the full report in your Mimiq account. The assistant's provider, for ChatGPT OpenAI, processes this under its own terms and privacy policy.
6.4 Access Credentials and Retention
The assistant receives access limited to Mimiq's testing and reporting actions for your account. We store these credentials only as one-way hashes. Access tokens expire within one hour. A connection lapses after 30 days without use and ends 180 days after you connect at the latest. Expired credential records are deleted within seven days. Tests and reports created through an assistant are stored in your account like any other test (see 5.3).
7. Third-Party Services and Data Processors
We use the following third-party services that process data on our behalf:
7.1 Amazon Cognito (Accounts)
Accounts are managed with Amazon Cognito, part of Amazon Web Services, in the US East (N. Virginia) region.
- Data processed: Email address, a hashed password held by Cognito (Mimiq never stores your password), and sign-in tokens
- Earlier accounts: Accounts created before September 2026 were managed by Clerk, Inc. We query Clerk only to match those accounts to their new sign-in by verified email, until the move is complete
- Privacy notice: https://aws.amazon.com/privacy/
7.2 Stripe (Payment Processing)
For payment processing, we use Stripe, Inc.
- Data processed: Payment information, billing address, transaction data
- Location/transfer terms: See Stripe's current privacy terms and request Mimiq's current sub-processor list
- Privacy policy: https://stripe.com/privacy
7.3 AWS and AWS Bedrock
We use Amazon Web Services for application delivery, compute, queues, data storage, logs, and model inference through AWS Bedrock.
- Data processed: Account identifiers, submitted test content, generated personas and results, application data, and logs
- Location: The launch stack and configured model inference profiles use United States regions
- Purpose: Hosting, persistence, browser-worker execution, and model inference
- Privacy policy: https://aws.amazon.com/privacy/
7.4 PostHog (Product Analytics)
We use PostHog to understand how people use Mimiq, so we can find what confuses them, what breaks, and what to build next. It works at three levels.
- Every visitor, without cookies: Page views, the referring site and campaign tags, the kind of device, and clicks on page elements (never their text), counted with a privacy-preserving hash that PostHog computes on its servers and rotates daily. Nothing is stored in your browser, and you are not identified. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding and improving the service)
- Accounts: What your account does in Mimiq, sent from our servers under your internal account id: signing up (with your email address, name, and sign-in method), tests created, completed, or failed (their kind, size, duration, failure class, and the host name of a tested page, never its content), purchases, reruns, and questions asked of a report (counts only). Legal basis: Art. 6(1)(f) GDPR; you can object at any time by emailing us, and we will stop
- If you allow analytics in the banner: PostHog also uses cookies and local storage, links this browser to your account, and records sessions (session replay) so we can see where the interface gets in the way. Every input field is masked in recordings, so what you type, including the addresses and copy you test, is never recorded. Legal basis: Art. 6(1)(a) GDPR (consent), which you can withdraw below
- Never sent to PostHog: The content of your tests (pages, copy, images, questions), the simulated people's answers, URLs with queries, or raw error messages
- Privacy policy: https://posthog.com/privacy
7.5 Model Inference in Flows
In a flow, the choice of each next step a simulated person takes (where to click, what to type) may be made by a model provider we contract directly. Reports are written through AWS Bedrock as above. If that provider is unavailable, the step runs through AWS Bedrock instead.
- Data processed: Screenshots and on-screen text of the page being tested, the task, the simulated person's profile, and the steps taken so far
- Location/transfer terms: Processing may take place in the United States; request Mimiq's current sub-processor list for the provider and the applicable transfer terms
- Purpose: Running the simulated people's steps in a flow
7.6 Resend (Emails About Your Tests)
When a flow test finishes, we email you a link to its report. A few days later we send one reminder to re-test, unless you already ran a new test. We send these through Resend, Inc. Every email has a one-click unsubscribe link, and unsubscribing stops them for good.
- Data processed: Your email address, the host name of the tested page, and a link to your report (never its content)
- Location/transfer terms: Processing takes place in the United States; request Mimiq's current sub-processor list for the applicable transfer terms
- Legal basis: Art. 6(1)(b) and (f) GDPR: telling you about a test you ran
- Privacy policy: https://resend.com/legal/privacy-policy
9. Your Rights Under GDPR
You have the following rights regarding your personal data:
9.1 Right to Information (Art. 15 GDPR)
You can request confirmation about whether and which personal data we process.
9.2 Right to Rectification (Art. 16 GDPR)
You can request correction of incorrect personal data.
9.3 Right to Erasure (Art. 17 GDPR)
You can request deletion of your personal data if legal requirements are met.
9.4 Right to Restriction (Art. 18 GDPR)
You can request restriction of data processing under certain conditions.
9.5 Right to Data Portability (Art. 20 GDPR)
You can request to receive your data in a structured, commonly used format.
9.6 Right to Object (Art. 21 GDPR)
You can object to processing based on legitimate interests (Art. 6(1)(f) GDPR).
9.7 Right to Withdraw Consent (Art. 7(3) GDPR)
You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
9.8 Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority if you believe your data is being processed unlawfully.
To exercise these rights, please contact: victor@mimiqai.com
10. Data Security
We use appropriate technical and organizational measures to protect your data from unauthorized access, loss, or alteration:
- TLS from your browser to CloudFront and for provider API calls; the restricted CloudFront-to-ALB origin hop uses HTTP with an AWS-managed CloudFront network allowlist and secret origin header
- AWS-managed encryption for DynamoDB storage
- Owner and verified-organization access checks, including read-only sanitized public-share payloads
- Secrets Manager and scoped task roles in the AWS launch stack
- Automated cross-tenant, share, and regression tests as release gates
Mimiq has not completed a SOC 2 audit or third-party penetration test. Those controls are described as roadmap work, not current certifications.
11. International Data Transfers
The launch architecture uses United States AWS regions and some providers may process data outside the EEA. Before submitting personal data, request the current sub-processor list and DPA so you can assess the applicable transfer mechanism, such as Standard Contractual Clauses or an adequacy framework where available.
12. Children's Privacy
Our service is not directed to persons under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us.
13. Changes to This Privacy Policy
We may update this privacy policy from time to time. We will notify you of material changes by email or through our service.
Last updated: October 16, 2026
14. Contact
If you have questions about this privacy policy or data processing, please contact:
Victor Gulchenko
Mimiq AI
Email: victor@mimiqai.com