Privacy Policy

1. Who we are

Mia is a service provided by Craftworks Labs S.R.L., a company registered in Romania, tax ID (CUI) 48293568, Trade Register no. J2023003740230. You will find our registered office address in the company details at the end of this page.

This policy covers the mia.store website, the Mia app, creators' pages (at mia.store/creator-name or on the creator's own domain) and the emails sent through Mia.

For any question about your personal data, write to us at privacy@mia.store.

We have not appointed a Data Protection Officer (DPO) because the law does not require one: we do not systematically monitor people on a large scale, and we do not process sensitive data, such as health data, on a large scale. privacy@mia.store is our contact point for data protection.

2. Mia's two roles

GDPR draws an important line between whoever decides why and how data is used (the controller) and whoever only processes it on someone else's behalf, following their instructions (the processor). Mia plays both roles, in different situations.

When we work for a creator, we use the data only to provide our service to them and only on their instructions, under Article 28 GDPR.

Even in creators' stores, Mia decides on its own, as an independent controller, for a few narrow purposes:

• preventing fraud and abuse and keeping the service secure (for example, the Cloudflare Turnstile anti-bot check, limits on the number of requests, IP addresses stored as hashes);
• payment security records;
• our legal obligations: notices about illegal content (DSA), DAC7 reporting, tax obligations and responses to requests from authorities;
• aggregated statistics about the platform, which do not identify anyone.

3. Bought from a creator or left them your email?

The store you bought from belongs to the creator, not to Mia. The creator is the seller and decides what data to ask you for, why they use it and how long they keep it. Mia provides the tool they sell with and processes the data for them.

For questions or requests about your data (for example, to have it deleted), read the creator's privacy notice and contact the creator first. Their contact details are on their page and in your order confirmation email.

If you can't reach the creator, write to us at privacy@mia.store. We will pass your request on and help them answer you.

Your payment is processed by Stripe, on the creator's Stripe account. Your card details never reach Mia.

For the purposes where Mia is an independent controller (security, fraud prevention, payment security records and legal obligations), you can write to us directly.

4. What data we process

If you have a creator account

• Account data: your name, email address, username and chosen language.
• Store content: texts, images, products, prices, courses and everything else you publish through Mia.
• Billing data for the Mia subscription: your plan, payment history and invoice details (for example, the name of your company or sole-trader business, its tax ID and address). Stripe keeps your card details.
• Information about your Stripe account: Stripe verifies your identity directly, and we receive status information from Stripe (for example, whether you can receive payments).
• DAC7 data, only if you sell services that must be reported (details below).
• Integration data: if you connect your Oblio or Instagram account, we store the access credentials for those accounts, encrypted.
• The texts you send to the AI assistant, if you use it.
• Technical and usage data: application logs, IP address, information your browser sends automatically and a log of important actions involving money and permissions.
• The messages you send us.

If you bought from a creator or left them your details (here we work for the creator)

• Your name and email address.
• Order details: the product, price, date, payment status and any refunds.
• Bookings, course access and your progress in courses.
• Your answers in the creator's forms and your sign-ups for their free resources.
• If you receive emails from the creator: whether you open them and which links you click.
• Your login details for your purchases library.

If you visit mia.store or a creator's store

• Technical data about the request, such as your IP address and information your browser sends automatically, used for security and abuse prevention.
• If you accept analytics cookies, we count visits to the store: the page viewed, where the visit came from (referrer and UTM tags) and a random ID that lasts while the tab is open. We do not store your IP address for these statistics.
• If you reach a store through a Mia short link, we save one record per click, with no cookie: the date, a hash of your IP address that changes every day (not the address), the site you came from without its parameters, your country and device type. We use it to count clicks and show the creator which posts bring visitors.
• Your cookie choice, saved in your browser.

If you join the waitlist: your email address and anything else you fill in on the form.

If you write to us or report content: your name, email address, message and, for reports, the exact link and your explanation.

If you message a creator on Instagram and they have connected their account to Mia: for the creator, we process your username and the comment or message containing the keywords they chose, so we can send you the automatic reply.

5. Why we use data and on what legal basis

The table below covers the situations where Mia is the controller. For data in creators' stores, the creator determines the legal basis.

Where we rely on legitimate interest, our interest is keeping the service safe and working for everyone and being able to defend our rights. We have weighed this interest against your rights, and we use only the data we need. You can object at any time (see the section on your rights).

Where we rely on consent, you can withdraw it at any time, as easily as you gave it. Withdrawing does not affect what happened before.

6. Payments

The Mia subscription. You pay for the subscription through Stripe. You enter your card details in a Stripe form, and they never reach Mia. From Stripe we receive only what we need to manage your subscription, such as payment status, amount and period. We issue the subscription invoices through Oblio.

Creators' sales. When you buy from a creator, the payment goes directly to the creator's Stripe account. Stripe processes the payment for the creator, as the creator's provider, and applies its own privacy policy. Mia does not receive or hold buyers' money and does not see card details.

Creators' invoices. If a creator connects their Oblio account, Mia sends the order details to that account so the creator can issue the invoice through their own account.

7. Emails

Service emails (login links, receipts, order confirmations, important account notifications) do not track opens or clicks.

Campaigns creators send to their contacts through Mia contain a pixel that shows whether the email was opened and links that show what was clicked. The creator sees these statistics to know how the campaign went. For these emails, the creator is the controller. If you no longer want to receive them, write to the creator.

We send emails through Resend, from its EU region.

8. The AI assistant

Mia has an optional AI assistant, built on Claude by Anthropic. You use it only if you want to.

• You decide what text to send to the assistant.
• Before sending, we replace common patterns of personal data with pseudonyms: email addresses, phone numbers, IBANs, CNPs, card numbers, postal addresses, @ handles and common names. We do not catch everything: an unusual name or a free-form detail can pass through unrecognised, so do not paste anything into the assistant that you do not want sent.
• Under the provider's commercial terms, the texts sent are not used to train models.
• The provider, in the US, keeps the texts you send for about 30 days. If its safety systems flag a text, it can keep it for up to 2 years.
• Your conversations with the assistant are saved in your account so you can continue them, and we delete them 12 months after the last activity. You can export or delete them at any time.
• The answers are suggestions. You check them before publishing, and you are responsible for what you publish.

Please do not send the assistant sensitive data about other people, for example about their health.

9. DAC7 reporting

Directive (EU) 2021/514 (DAC7), implemented in Romania by Government Ordinance 16/2023, requires online platforms to report certain sellers' activities to ANAF. These include personal services: work paid by the hour or by the task, online or offline, such as coaching, consultations, lessons and therapy sessions. Selling only digital content is not reported.

If you sell such services through Mia, we ask you for: your name, address, tax identification number (for example, your personal numeric code or CUI), VAT number if you have one, date of birth (for individuals) and bank account (IBAN). By 31 January, we report to ANAF, for the previous year, the amounts received per quarter, the number of activities and any fees retained by the platform, and we send you a copy too.

If you do not give us this data even after several reminders, we may restrict the sale of reportable services.

10. Who we share data with

We work with providers that process data for us, only on our instructions and under confidentiality and security obligations. The current list:

The current list of providers is the one on this page. Before a new provider processes a creator's buyers' data, we notify the creator 30 days in advance.

We also share data with:

• creators, for the data in their stores (orders, leads, bookings and the other data we process for them);
• authorities, such as ANAF or the courts, only when the law requires us to.

11. Transfers outside the EU

Our servers are in the EU. Some providers are US companies or can access data from outside the European Economic Area. In these cases, the transfer relies on the standard contractual clauses approved by the European Commission or on the provider's certification under the EU-US Data Privacy Framework.

If you would like details of the safeguards for a particular provider, write to us at privacy@mia.store.

12. How long we keep data

This is our current retention schedule:

13. How we protect data

• All connections to Mia are encrypted (HTTPS).
• Access credentials for connected accounts (for example, Oblio or Instagram) are encrypted in the database.
• Access to data is limited to the people on our team who need it.
• We remove personal data from error reports.
• In visit statistics and anti-abuse records we store IP addresses as hashes, not in plain form.

No system is perfect. If a personal data breach occurs that may affect you, we follow what GDPR requires: we notify the authority and, where needed, we tell you too. If you find a vulnerability, write to us at security@mia.store.

14. Your rights

Under GDPR, you have the right:

• to find out whether we process data about you and to get a copy (access);
• to have wrong or incomplete data corrected (rectification);
• to have your data deleted (erasure), except for data the law requires us to keep;
• to ask us to limit processing (restriction);
• to receive the data you gave us in a structured format and pass it on to someone else (portability);
• to object to processing based on our legitimate interest (objection);
• to withdraw your consent at any time, without affecting processing done before;
• not to be subject to a decision based solely on automated processing that has legal effects on you or affects you in a similarly significant way.

We do not make such automated decisions. Our anti-abuse tools, such as Turnstile or request limits, may automatically block an attempt that looks suspicious. If one blocks you by mistake, write to us and a person will check it.

15. How to use your rights

Write to us at privacy@mia.store and tell us what you would like. It costs you nothing.

We reply within one month of receiving your request. If the request is complex or we receive many requests, this period can be extended by two more months. If so, we tell you within the first month and explain why.

To protect your data, we may ask you for additional information to confirm that the request comes from you.

If your request concerns data in a creator's store, we pass it on to the creator, who decides on it, and we help them answer you.

16. Complaining to the authority

If you believe we process your data unlawfully, you have the right to lodge a complaint with the Romanian data protection authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral Gheorghe Magheru 28-30, Sector 1, București, www.dataprotection.ro. You can also go to court.

It would help if you wrote to us first so we can try to sort it out together, but you don't have to.

17. Children

Mia accounts are for adults aged 18 and over. Creators' stores are not directed at children under 16.

If you learn that a child has given us personal data, write to us at privacy@mia.store and we will delete it, except for data the law requires us to keep.

18. What data you need to give us

• To create an account, you need an email address. Without it, we cannot create the account.
• To pay for the subscription, you need payment details, which you give directly to Stripe, and invoice details.
• If you sell services reportable under DAC7, the law requires us to ask for your DAC7 data. Without it, we may restrict the sale of those services.
• Optional cookies, the waitlist and the AI assistant are your choice.

19. Cookies

For the cookies and storage technologies we use, and how to change your choice, read the Cookie Policy.

20. Changes to this policy

When we update this policy, we change the date at the top of the page. If the change is significant, we also tell you by email, if you have an account with us.

21. Contact

• Data protection: privacy@mia.store
• General support: support@mia.store
• Reporting illegal content: dsa@mia.store
• Security vulnerabilities: security@mia.store

See also the Terms and Conditions and the Acceptable Use Policy.