Who is responsible
For our customers' account data, Miko is the controller. For the visitors and contacts our customers talk to through Miko, the customer is the controller and Miko is its processor under GDPR art. 28; the Data Processing Agreement sets out those terms and applies to every customer automatically.
Contact for data protection questions: [email protected]. We have not appointed an EU representative under art. 27 yet; requests in any EU language are answered.
Legal bases
- Running the service for our customers: performance of a contract (art. 6(1)(b)).
- Security, abuse prevention and audit logs: legitimate interests (art. 6(1)(f)).
- Invoicing and tax records: legal obligation (art. 6(1)(c)).
- For visitors on a customer's site, the customer chooses and states its own legal basis; Miko only follows its instructions.
Where the data is
The application and database run on servers in Türkiye. Türkiye has no EU adequacy decision, so transfers from the EU rely on the Standard Contractual Clauses in our Data Processing Agreement. Subprocessors outside the EU, listed on the Subprocessors page, are bound by their own data processing agreements with the same safeguards.
Data subject rights
Every right under articles 15 to 22 can be exercised, and the product carries the tools for them:
- Access and portability: a contact's full data downloads as JSON from their profile; a workspace owner can download everything.
- Erasure: deleting a contact erases their conversations, messages, files and what Miko AI remembered about them; deleting a workspace erases all of it.
- Rectification: contact details and Miko AI's notes can be corrected by the team at any time.
- Objection and restriction: Miko AI's memory of customers is off unless the workspace turns it on, and can be cleared per person.
- Requests that reach us about a customer's visitors are passed to that customer within 72 hours. Requests about your own account: [email protected], answered within one month.
Automated decisions and AI
Miko AI answers questions and may hand a conversation to a person; it makes no decisions with legal or similarly significant effects on anyone (art. 22). Visitors can always ask for a person instead. Model providers do not train on the data we send them.
Security and breaches
Encryption in transit, database-level isolation between workspaces, two-factor sign-in for teams, IP allowlists, audit logs, and backups kept for at most 21 days. A personal data breach is reported to the affected customers within 48 hours of our becoming aware of it, so they can meet their own 72-hour duty to the authority.