Privacy Policy

Mimvello is operated by Rijfrisjes, a sole proprietorship (eenmanszaak) established in the Netherlands. Rijfrisjes is the data controller for the personal data described in this policy: it decides why and how your data is processed. "Mimvello" is the name of the product and platform; "we", "us" and "our" in this policy mean Rijfrisjes.

Registered business address: Tokyostraat 19 S, 1175 RB Lijnden, the Netherlands. Privacy contact email: Gouymimoun@gmail.com.

• Account data. Your email address, and your name and profile picture if you sign in with Google. Accounts are created with email and password, a one-time magic sign-in link, or Google sign-in. Email addresses are confirmed before an account becomes active.
• Workspace and brand profile. What you enter to describe your brand — name, industry, audience, countries, languages, tone of voice and content objectives — so the AI can write in your voice.
• Uploaded content. The videos and photos you upload, plus the structured analysis the AI produces for them (subject, orientation, quality, suggested platforms, and similar).
• Generated content. The post drafts the AI creates for you (hooks, captions, titles, hashtags) and your edits, approvals, rejections and schedules.
• Connected social accounts. For each account you connect: the platform, account name, username, avatar, which permissions were granted, connection status, and the access tokens the platform issued. We never ask for or store your social media passwords.
• Publishing records. Scheduled times, timezones, the text and media of posts you publish, the post ID the platform returns, and any error messages the platform sends back.
• Technical data. Your chosen timezone and theme preference, and in-app notifications about your content.

We do not collect performance analytics from anywhere other than the platform APIs of accounts you have connected, and we do not add simulated or invented numbers to your data.

• To create and secure your account and workspace.
• To analyse your uploaded content and generate post drafts tailored to each platform, using your brand profile and instructions.
• To connect your social media accounts and, only when you approve or schedule a post, to publish it through the platform's official API.
• To show your calendar, publishing history and notifications, and to retry or flag failed publications.
• To send transactional emails needed for authentication (email confirmation and magic sign-in links). We do not send marketing email.
• To manage your subscription and billing through our payment provider, Stripe.

Content analysis and post generation are performed by AI models that we access through the Lovable AI Gateway. To produce an analysis or a draft, the relevant content (or a description of it), your brand profile, and related context such as your recent posts are sent to the AI model. AI output is always presented to you as a draft for review — nothing is published by the AI without your approval or a schedule you have set.

Social accounts are connected exclusively through official OAuth sign-in (Facebook and Instagram via Meta, YouTube via Google, TikTok via TikTok for Developers). During sign-in the platform asks you which permissions to grant; you can see and change them in your platform account settings.

• Access tokens are stored only on our servers, encrypted, and are used solely to connect your accounts, verify their health, publish content you approved or scheduled, and read data (such as analytics) that the granted permissions allow.
• Tokens are never displayed in the app, never sent to your browser, and never shared with anyone other than the platform that issued them.
• You can disconnect an account at any time on the Social Accounts page, which removes our ability to act on that account. You can also revoke Mimvello from the platform's own settings.

When you approve and schedule a post, our server-side publishing system contacts the platform's official API at the scheduled time using your stored access token. A post is only marked "Published" after the platform confirms it and returns a post ID. If a publication fails, we store the platform's error message so we can show it to you.

The Service relies on the following providers to operate. Each processes your data for the purposes described above:

• Lovable Cloud — application hosting, database, file storage, authentication and transactional email delivery.
• AI model providers — accessed through the Lovable AI Gateway for content analysis and post generation.
• Meta Platforms (Facebook, Instagram), Google (YouTube) and TikTok — only for the accounts you connect, via their official APIs.
• Stripe — payment processing, subscriptions, tax calculation, receipts and invoices. Card details are entered directly with Stripe and never reach our servers; we store only your Stripe customer and subscription IDs, plan and subscription status. Stripe may process data outside the EEA under its own safeguards.

These providers have their own privacy policies that apply to their processing. We are not affiliated with, and not endorsed by, Meta, Google, TikTok or any other platform.

Your data is stored in the Service's backend database and private file storage. Uploaded media is kept in private storage that is not publicly reachable, and access is restricted by per-user access rules so that one account cannot read another account's content. Access tokens are encrypted at rest and only our servers can use them. Connections to the Service use HTTPS.

No method of storage or transmission is completely secure, and we cannot guarantee absolute security. If a data breach affects you, we will notify you as required by applicable law.

We use browser local storage to keep you signed in (your session token) and to remember your theme preference. We do not use advertising or third-party tracking cookies.

• You can delete uploaded content and posts in the app. Deleted posts are kept in a restorable "Deleted" state until you remove them permanently, so nothing disappears by accident.
• Disconnecting a social account removes our stored access for that account and stops all publishing to it.
• To delete your account and its remaining data, contact us at Gouymimoun@gmail.com. We will delete your account data, except where we are required to keep certain records by law.
• Account, content and workspace data are kept while your account is active and deleted after you request account deletion, except records we must keep by law.
• Billing and transaction records are kept for 7 years, as required by Dutch tax law (fiscale bewaarplicht).
• Encrypted social access tokens are deleted when they are no longer needed for a connected account.

Depending on where you live, you may have rights to access, correct, export or delete your personal data, to object to or restrict certain processing, and to lodge a complaint with your local data protection authority. You can exercise many of these directly in the app (edit your brand profile, delete content, disconnect accounts). For anything else, contact us at Gouymimoun@gmail.com.

Our providers may process data in countries other than yours. Where personal data is transferred internationally, the providers involved apply safeguards required by applicable law.

The Service is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has created an account, contact us so we can remove it.

We may update this Privacy Policy as the Service changes. Material changes will be announced in the app. The "Last updated" date above shows which version applies.

Questions or requests: Gouymimoun@gmail.com