Privacy Policy
Last updated 12 August 2026
1. Data controller
The controller of your personal data is:
Pactio Media Adrian Idzikowski
Chroboty 5, 96-300 Żyrardów, Poland
NIP (tax ID): 8381867868, REGON: 381692818
Contact for data protection matters: kontakt@pactio.pl
2. What data we process
We only collect what Mivo needs to work:
- Account data — your email address, password (stored only as a hash, never in plain text), and optionally a name or display name.
- Google / Facebook / Apple sign-in data — if you choose to log in through one of these providers, we receive your identifier, email and name from them, within the scope you approve on their side.
- Board material — the links, video/audio files, thumbnails, notes and tags you add yourself.
- Payment data — handled entirely by Stripe or Paddle.com; we only keep your plan, the date, and a transaction identifier, never your card number.
- Technical data — IP address (to limit login abuse), device and browser type, login timestamps.
- Board presence — who is currently viewing a given board, held only in server memory and cleared when the session ends.
Administrator access to content. We do not continuously monitor boards and we have no obligation to. However, authorised staff may open the content of a specific board where necessary to handle a report, keep the service safe, or meet a legal obligation (for example removing unlawful material). Every such access is written to an internal access log.
3. Why we process it
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, logging in | Art. 6(1)(b) — performance of a contract |
| Storing and playing back your material | Art. 6(1)(b) — performance of a contract |
| Handling payments and Premium/Lifetime plans | Art. 6(1)(b) and (c) — contract and accounting obligations |
| Protecting against login abuse (rate limiting) | Art. 6(1)(f) — legitimate interest |
| Handling content reports | Art. 6(1)(c) and (f) — legal obligation and legitimate interest |
| Replying when you contact us | Art. 6(1)(f) — legitimate interest |
4. Who we share data with
We only pass data to the parties the service actually needs:
- Stripe and Paddle.com — payment processing (Paddle acts as merchant of record and is an independent controller for billing and VAT purposes);
- Google, Facebook, Apple — only when you choose to sign in with that provider;
- our server provider (Hetzner Online GmbH, Germany/EU) — infrastructure hosting.
We do not sell your data or material, and we do not use it to target you with advertising on other services.
5. How long we keep data
We keep account data and material for as long as your account exists. When you delete your account, we delete your data and material without undue delay, except for records we are required to keep longer for tax and accounting purposes (up to 5 years from the end of the relevant tax year, under Polish accounting law).
6. Your rights
Under GDPR you have the right to:
- access your data and get a copy of it — an export is available from your account settings in the app;
- have inaccurate data corrected;
- have your data deleted — by deleting your account in the app, or by writing to us;
- restrict processing, and object to processing based on legitimate interest;
- have your data transferred to another controller;
- lodge a complaint with your national data protection authority — in Poland, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.
To exercise any of these rights, write to kontakt@pactio.pl.
7. Cookies
We use only strictly necessary cookies: your login session (HttpOnly, not accessible to scripts) and your remembered pricing currency. We do not use advertising or third-party analytics cookies. The one exception is the Paddle.js script, loaded only on the checkout screen, which is required to process a payment.
8. Transfers outside the EU
Our server runs in Germany (EU). Our payment providers (Stripe, Paddle) may process some billing data outside the EU, under standard contractual clauses approved by the European Commission.
9. Changes to this policy
We may update this policy as Mivo evolves. We will notify you of material changes at least 14 days before they take effect.
Questions about data protection: kontakt@pactio.pl. See also: Terms of Service.