Privacy Notice

1. Who we are and when this notice applies

Mimova is a business operations platform operated by Khyal Studio. This notice applies to mimova.ai, Mimova applications, customer and client portals, support, sales, events and other services that link to it. It does not replace a customer's own privacy notice.

Operator

Khyal Studio

Country

Kingdom of Saudi Arabia

Privacy contact

privacy@mimova.ai

2. Our role: controller and processor

We act as a controller for account administration, billing, security, service improvement, direct relationships and this public website. A subscribing organization normally controls the business, employee, customer, communication and integration data it places in Mimova; for that data, we generally act as its processor or service provider and follow its documented instructions. Requests about organization-controlled data may be referred to that organization.

3. Personal data we may handle

• Identity and account data: names, contact details, language, authentication identifiers, roles, organization and account status.
• Business records: CRM, projects, proposals, contracts, finance, HR, payroll, leave, files, approvals, support and audit records supplied by customers.
• Communications: email, chat, WhatsApp, social messages, call and meeting metadata, comments, attachments and delivery events when a customer enables those channels.
• Connected-service data: authorized account identifiers, content, campaigns, analytics, transactions and synchronization metadata from providers selected by a customer.
• Usage and device data: IP address, browser, device, timestamps, session and security events, feature usage, logs, diagnostics and performance information.
• Commercial data: plan, invoice, payment state, usage allowances and customer-support history. Payment-card data is normally handled by the selected payment provider, not stored by Mimova.
• Preferences and consent: notification, language, cookie, marketing and communication choices, including evidence of consent or withdrawal.
• AI inputs and outputs: prompts, selected source records, tool calls, approvals, generated drafts and evaluation evidence when an authorized organization enables AI features.

Customers must avoid placing unnecessary sensitive data in Mimova and must configure access, retention and integrations for their lawful purposes. Government identifiers, health information, biometrics, financial credentials and employee documents receive heightened controls where the applicable feature supports them.

4. Why we process personal data

• Provide, secure, operate, support and administer the services and customer workspaces.
• Authenticate users, enforce permissions, prevent abuse, investigate incidents and maintain audit evidence.
• Run customer-selected workflows, communications, integrations, exports, backups and governed AI operations.
• Manage contracts, subscriptions, billing, support, service notices and customer relationships.
• Measure reliability and improve usability, accessibility, performance and product quality.
• Comply with law, lawful authority requests, tax, accounting, sanctions and dispute obligations.
• Send requested launch or product communications, with an unsubscribe choice where required.

Depending on the context and applicable law, processing is based on consent, performance of a contract, steps requested before a contract, compliance with legal duties, protection of vital interests, or legitimate interests that are assessed against individual rights. A customer determines the lawful basis for data it controls in Mimova.

5. Cookies and similar technologies

Mimova may use strictly necessary cookies and local storage for authentication, security, language, theme and saved user choices. Optional analytics or marketing technologies will be used only where enabled and with any consent required by law. Browser controls can remove cookies, but blocking necessary storage may stop sign-in or saved preferences from working. We honor legally required opt-out signals where applicable to the deployed service.

6. Integrations, providers and disclosures

Data is disclosed only as needed to operate the service, follow a customer's instruction, complete a transaction, protect the platform, or meet law. Recipients may include hosting, database, security, monitoring, communications, payment, file-storage, support and professional-service providers; a customer's connected providers; authorized users and client-portal participants; and public authorities where disclosure is legally required.

Google, Microsoft, Meta, WhatsApp, LinkedIn, TikTok, X, Canva, payment, commerce, social, advertising and analytics connections are activated by the customer and remain subject to those providers' terms and privacy practices. Mimova stores scoped credentials using protected secret controls and requests only the permissions needed for enabled capabilities. We do not sell customer content or personal data for money. We do not use customer content for third-party advertising.

7. International transfers and location

Services and connected providers may process data in more than one country. Where Saudi personal data is transferred outside the Kingdom, the controller must meet the Saudi PDPL and transfer regulations, including adequacy, necessity, safeguards and risk assessment where required. For EEA, UK and other regulated transfers, Mimova uses an applicable lawful transfer mechanism such as adequacy decisions, approved contractual clauses or another recognized safeguard. Data residency settings do not override a connected provider's documented processing locations.

8. Retention and deletion

We keep personal data only for the service, contractual, security, evidentiary and legal periods that apply. Customer administrators can configure supported retention rules. After account termination, data is available for the agreed export period and is then deleted or irreversibly anonymized from active systems, subject to legal holds, financial-record duties and time-limited encrypted backups. Security and processing records may be retained longer where law requires it; Saudi processing-activity records may need to remain for five years after processing ends.

9. Security and incidents

Mimova uses risk-based technical and organizational safeguards, including tenant isolation, access controls, encryption where appropriate, secret protection, audit trails, backups, monitoring, vulnerability management and tested recovery procedures. No system is completely secure. Customers must protect credentials, configure least privilege and report suspected misuse promptly. We assess personal-data incidents and notify affected controllers, authorities or individuals within the time and circumstances required by applicable law, including Saudi breach-notification rules where they apply.

10. AI and automated decisions

AI features may summarize, classify, draft, recommend or execute specifically authorized actions. Mimova records relevant sources, permissions, budgets, approvals and outcomes where the feature supports them. Customers remain responsible for lawful instructions, review and deployment. Mimova is not intended to make solely automated decisions producing legal or similarly significant effects unless the customer has established a lawful basis, notices, human review and required safeguards. Customer content is not used to train a shared model unless the customer expressly agrees under separate terms.

11. Your privacy rights

Depending on location and context, a person may have rights to be informed, access or obtain a copy, correct, delete or destroy, restrict or object, withdraw consent, receive portable data, opt out of sale or sharing, limit certain sensitive-data use, and not be discriminated against for exercising a right. Saudi residents also have the rights provided by the Saudi PDPL, subject to lawful exceptions.

Contact privacy@mimova.ai. We may verify identity and authority, and will respond within the period required by applicable law. Authorized agents may submit requests where permitted. A person may complain to SDAIA's competent authority or another applicable supervisory authority. If an employer or other Mimova customer controls the data, contact that organization first; we will assist it as required.

12. Children

Mimova is a business service and is not directed to children. Public accounts must not be created by anyone who cannot legally enter the applicable agreement. Organizations using Mimova for schools or youth services must enable an appropriate industry pack, provide required notices, obtain parental or guardian authorization where necessary and apply heightened access and retention controls. We do not knowingly collect children's personal data through the public launch page.

13. Changes and contact

We may update this notice when services, providers or laws change. We will post the updated date and provide additional notice where a change is material or consent is required. Questions and privacy requests can be sent to privacy@mimova.ai.