Privacy policy

This Privacy Policy explains how Mippo ("Mippo", "we", "us", or "our") collects, uses, shares, and protects information about you when you:

• visit our website at mippo.ai (the "Site");
• create or use a Mippo account through our mobile application (the "App");
• run NearPass on your device while the App is installed; or
• contact us at [email protected].

Together, the Site and the App are the "Service". This is a single, comprehensive document covering both. Where a practice applies only to the Site or only to the App, we say so.

Capitalised terms used here have the meanings given in this Privacy Policy or, where applicable, in our Terms of Service or in the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR").

Mippo is the "controller" of your personal data within the meaning of GDPR Article 4(7) and the equivalent terms under United Kingdom and other applicable privacy laws.

Mippo will be operated by Mippo, Inc., a Delaware corporation, upon its incorporation. On that date, Mippo, Inc. will assume the role of controller under this Privacy Policy without further action by you, and references to "Mippo", "we", "us", or "our" in this Privacy Policy will be read as references to Mippo, Inc.

The single point of contact for any question about this Privacy Policy, or to exercise any of the rights described in Sections 9 to 12, is [email protected].

EU Article 27 representative

Because we will offer the Service to data subjects in the European Economic Area, GDPR Article 27 requires us to appoint a representative established in the EEA (unless an exemption applies). We will appoint our EU representative, and publish their name and contact details in this section, before the European public beta opens to users in the EEA. Until then, you can reach us about any GDPR matter at [email protected].

United Kingdom representative

Where UK GDPR Article 27 requires it, we will appoint and publish the details of a United Kingdom representative in this section before the United Kingdom launch.

We collect only the data we need to operate the Service, to keep it safe, and to comply with our legal obligations. The categories below are exhaustive. If a category of data is not described here, we do not collect it.

When you visit mippo.ai

When you load a page on our website, our hosting provider records standard server log data: your IP address, the date and time of the request, the URL you requested, the HTTP response status, the response size, and the user-agent string your browser sends. We use this data to operate the Site, protect it from abuse, and diagnose technical problems. We retain it for no longer than thirty (30) days.

If you submit your email address to our waitlist form, we store that email address solely to notify you when Mippo opens to new users. You can unsubscribe at any time using the link in any email we send, or by writing to [email protected].

To tell people from automated sign-ups, the waitlist form uses Cloudflare Turnstile. Its script loads from Cloudflare only when you start typing an email address into the form, and it processes technical information about your browser under Cloudflare's privacy terms. The Site does not set tracking cookies, embed third-party analytics, run advertising pixels, or share any data with advertising networks. See Section 15 for details.

When you create a Mippo account

To create an account, you provide:

• a phone number, which we verify with a code sent by text message, or the Google or Apple account you sign in with, from which we receive an email address (Apple may give us a private relay address instead);
• a display name (which you choose; it does not have to be your real name);
• a username, the handle people can use to add you as a friend;
• your date of birth, to confirm you meet our minimum age (see Section 14). The App never shows its year to anyone, and shows the day and month to your friends only if you turn that on;
• your gender (female, male, or other, with an optional detail if you choose other);
• your Avatar (see below) and your interests (see "When you describe yourself to Mip" below); and
• optionally, a short bio, a wallpaper photo for your profile, and a verified university badge (see below).

Avatars

Your Avatar is a 3D character you build inside the App from a library of parts (face, hair, clothes, and colours). We store the parts you chose, and still pictures of your Avatar that the App draws on your phone and uploads so that other people can see it. We do not take, analyse, or store any photograph of you in order to make or suggest your Avatar.

Photos and videos you share

You can, optionally, share photos and videos in posts and Moments, and use a photo as your profile wallpaper. They are stored on our servers and shown only to the audience you choose for each post or Moment: your friends, your close friends, only you, or the members of one circle. Photos, voice notes, and videos you send in a chat go to the people in that chat. Sharing beyond the audience you chose is always your decision.

We do not analyse the contents of your photos for advertising, profiling, AI model training, or any purpose other than displaying them according to the visibility you have set. We do not run face recognition or any other biometric processing on your photos. You can delete any photo at any time; deletion is reflected within thirty (30) days from our live systems and within ninety (90) days from encrypted backups.

Verified university badge

If you verify an email address at a university to join its circle, we send a code to that address through our email provider. We keep the badge and the university's domain (for example, the part after the @). We never store the address itself.

When you use NearPass (proximity)

NearPass is the Bluetooth protocol that powers Mippo. It runs only after you turn it on in the App, and you can turn it off at any time.

When NearPass is on, it:

• broadcasts and listens for short, rotating, anonymous identifiers over your device's Bluetooth;
• sends the identifiers your phone heard to our servers, which work out which Mippo accounts were near each other; and
• creates a Ping when two people nearby share enough interests for both of their settings (see "Your NearPass settings" below).

The identifiers exchanged by NearPass rotate frequently and do not include your account ID, your name, your phone number or email, or your device's persistent hardware identifier; only our servers can tell which account an identifier belongs to. We delete the reports of which identifiers your phone heard within about a minute, once we have worked out who was near whom, and we do not keep where or when exchanges happened. For your account we keep only running counts of how often you crossed paths with someone and how often a crossing did not become a Ping, and a statistical summary that estimates how many different people that was, from which nobody can be identified. NearPass itself does not use GPS, Wi-Fi positioning, IP geolocation, cell-tower triangulation, or any other location-resolution technique. The Bluetooth exchanges NearPass performs cannot tell us where you are. Mippo offers a separate, opt-in location feature that you can turn on yourself (see "Ping location" under "Optional features" below).

When a Ping is created, we record the two accounts, when it happened, the interests the two of you share (shown to both of you as the reason for the Ping), and whether each of you has accepted it. If you have turned on Ping location, we also record your location at that moment, at the precision you chose. We do not record Bluetooth signal strength. A Ping stays anonymous until both of you accept it: before then, neither of you sees the other's name or Avatar. Accepting a Ping makes you friends.

When you message someone

Messages between Mippo users, in one-to-one and group chats, are encrypted in transit (TLS 1.2 or higher) and encrypted at rest: the text of each message is stored as ciphertext (AES-256), and the key that decrypts it is kept outside the database, in a managed secret store. We hold that key, so we are technically able to read the contents of your messages. We do not scan messages, and no Mippo feature shows a message to anyone outside the conversation: notifications carry no message text, and search within a chat runs on your phone, not on our servers.

There is one exception. If someone in a conversation reports a message, their own phone sends us a copy of the messages they cite, so that a moderator can act on the report. Those copies are stored encrypted, are read by the moderator handling the report, and are included in the reporter's own data export.

Photos, voice notes, and videos you send in a chat are stored as files. They are protected by access controls and by our storage provider's encryption of its disks, and they are not covered by the message-text encryption described above.

For each message we also keep who sent it, the conversation it belongs to, and when it was sent, delivered, and read. We use these to deliver messages, to show delivery and read ticks, and to keep the Service safe. If you turn off read receipts in the App, we stop recording when messages reach you and when you read them. We keep messages until they are deleted (see Section 7).

When you describe yourself to Mip

Mip is the character in the App who helps you set up your interests. When you join, you can type or dictate a short description of yourself and ask Mip to analyse it. We use it to find interests that fit you. You can also pick your interests from Mippo's interest list yourself, when you join or at any time later, without describing yourself to Mip. Mip does not hold conversations with you.

Your description is sent to our AI provider, OpenAI, at the moment you ask Mip to analyse it. It is sent once to find your interests and once to check what was found (the automated check described below), and again if a call fails. It is sent from our servers, without your name or your account identifier. OpenAI does not use it to train its models. OpenAI keeps it for up to thirty (30) days to monitor for abuse and then deletes it, unless the law requires OpenAI to keep it longer, or keeping it longer is reasonably necessary to protect OpenAI's services or anyone else from harm. We do not keep your description, or the transcript of what you dictated, anywhere.

We keep the interests Mip finds, which come in two kinds:

• Interests from Mippo's interest list. You see these in the App, and you can remove any of them, or all of them at once, at any time. Interests you pick from the list yourself are kept in the same way. We use them to find people who share your interests.
• Related names that are not on the list, such as the title of a game or a niche hobby. We keep at most two hundred (200) of them for your account. Each one is at most forty (40) characters and four words long, none contains more than three consecutive words from what you wrote (a phrase you typed as a single word counts as one word), and each is stored with the interest from the list that it came with. They are not shown in the App and are not yet used to find people for you. We keep them so that we can improve how Mippo finds people who share your interests. They are deleted when you remove the interest they belong to, when you clear your interests, or when you delete your account, and they are included when you export your data. You can object to our keeping them (see Section 4).
• Removing an interest. An interest you remove stops counting towards new connections at once. A connection you already have keeps the line that says which interests you shared when it was made, as the App tells you when you remove an interest, and the other person can still see that line. Deleting your account deletes it.

Mip is instructed to keep nothing about the people in your life (your friends, family, partner or colleagues), no politician or religious figure, and nothing about your health, your sex life or sexual orientation, your gender identity, your religion or beliefs, your political opinions, trade-union membership, your ethnic origin, genetic or biometric data, or any criminal record. The names of artists, authors, bands and other public figures you are into can be kept as related names. What Mip finds is then checked automatically before it is saved, and anything the check flags is not saved. The check can make mistakes. If you see an interest you do not want us to keep, remove it in the App, which also deletes the related names stored with it. To object to our keeping the related names, write to [email protected], the address that handles these requests. Your data export shows everything we keep, the related names included.

If you dictate instead of typing, your phone's own speech recognition turns your voice into text: Apple's on an iPhone, and on Android the recognition service your phone uses, which is usually Google's. Where the App can ask your phone to recognise your language on the phone itself, it does. Otherwise your phone sends your voice to that provider's speech service, under the provider's own terms. We never receive the audio, and we receive the text only when you ask Mip to analyse it. Section 13 explains how Mip's analysis relates to automated decision-making.

Your NearPass settings

We store the settings that decide who can ping you: how many interests you need to share with someone before a Ping, and any limits you set on the gender and age of the people who can ping you. They are on our servers because Pings are created there. Your friends' apps can read these settings. You can change them at any time, and you can turn NearPass off entirely.

Your app language

We store the language the App is set to: the one you chose in the App's settings, or your phone's language when the App follows it. Today that is English or Dutch, and a phone set to another language gets English. The App sends it to our servers when you sign in, when it starts, and when you change the language. We use it only to write our push notifications and emails to you in that language. It is deleted with your account.

Optional features

Some features process additional data only when you turn them on. We will ask for your explicit consent the first time you enable each one, and you can disable any of them at any time in the App.

• Ping location. Off until you turn it on in the App's settings. When it is on, your phone takes its location when NearPass finds someone new, or when you add a friend by scanning their QR code, and never continuously. With a Ping we store it at the precision you choose: exact, or a rough area about five hundred (500) metres across, or not at all. You and the other person see it on the Ping and on each other's profile as where you crossed paths. The country and region it falls in light up your passport, which only you see (after a QR scan we keep only the country and region, never the location). To show a place name, our servers send the coordinates, with no account information, to OpenStreetMap's Nominatim service. Turning the setting off stops new captures; locations already stored with a Ping stay until that Ping or friendship is deleted. You can remove any place from your passport, and revoke the device permission in your operating-system settings.
• Wider-reach discovery (not yet available). If we add it, it will let Mippo suggest people beyond those you pass nearby, based on shared interests, at city or country scale. It will be off by default.
• Product analytics. The App asks you once whether it may count how you use it. If you agree, it sends usage events (for example, that you opened a Ping or started a chat) to our product-analytics provider, PostHog, in the European Union, linked to your account, with your device model and app version. They never include your messages, your location, or your interests. We keep them for eighteen (18) months. You can switch this off, or delete your analytics data, in the App's settings at any time.
• Marketing emails. If you opt in, we will send you occasional product updates and event invitations. You can withdraw your consent at any time via the unsubscribe link in any email.
• Push notifications. If you allow notifications, we send them through Google Firebase Cloud Messaging, which on an iPhone passes them on to Apple's Push Notification service. A notification never contains the text of a message and never names another person. It may name a circle, a group chat, or an event, and a Ping notification may name the area you are in if you share your location. It also carries the identifiers the App needs to open the right screen (for example, the message, the conversation, and your own account), and a notification for a one-to-one message carries a time-limited code that lets your phone confirm to us that the message was delivered. Google and Apple can see these identifiers; none of them contains message content.

Maps

Maps in the App are drawn by Google Maps. To draw one, your phone loads map images for the area on screen from Google, under Google's terms.

Crash reports

When the App crashes, it sends a crash report (the part of the code that failed, the device model, and the operating-system version) to our error-tracking provider, Sentry. Crash reports carry no name or account identifier, the App does not attach your IP address to them, and we use them only to fix the App.

Special-category data

Some of the data above (particularly the contents of your messages, or anything about your beliefs, health, or sexuality that you include when you describe yourself to Mip) may qualify as "special categories of personal data" under GDPR Article 9, as "sensitive personal information" under the California Privacy Rights Act, or as comparable categories under other privacy laws.

Mip does not ask for this kind of information, and it is built not to keep it: your description is discarded after it is analysed, and the interests we keep are checked automatically to leave it out, as described in "When you describe yourself to Mip" above.

We process special-category data only:

• with your explicit consent (GDPR Article 9(2)(a)); or
• where you have manifestly made the data public on the Service (GDPR Article 9(2)(e)).

You may withdraw your consent at any time, with effect for the future.

For users in the European Union, the European Economic Area, the United Kingdom, and Switzerland, we rely on the following legal bases under GDPR Article 6:

• Contract performance (Art. 6(1)(b)): to create and operate your account; to deliver Pings, messages, and push notifications; to analyse the description you give Mip; to keep your interests from Mippo's interest list, whether Mip found them or you picked them, which Mippo uses to find people who share your interests; to provide circles, group chats, and events; to route data within the Service. Without these activities we cannot provide the Service to you.
• Consent (Art. 6(1)(a)): for marketing emails; for product analytics; for sharing your location with a Ping; for wider-reach discovery, when it is available; for any processing of special-category data under Art. 9(2)(a). You can withdraw your consent at any time, with effect for the future.
• Legitimate interests (Art. 6(1)(f)): to maintain the security and integrity of the Service; to detect and prevent abuse, fraud, and spam; to keep basic operational logs; to receive crash reports that carry no account identifier; to keep reports, and the record of a suspension or ban, after an account is deleted (see "What we keep after you delete your account" in Section 7); to keep the related names Mip finds that are not on Mippo's interest list (see Section 3), so that we can improve how Mippo finds people who share your interests. Our interest in providing a safe and reliable Service, and in improving it, is balanced against your right to privacy, and you can object to processing on this basis at any time (see Section 9). The related names are short, contain no more than three consecutive words from what you wrote (a phrase you typed as a single word counts as one word), are checked to leave out sensitive information, are not shown in the App, and are deleted with the interest they belong to. If you object to our keeping them, by writing to [email protected], we delete them and stop keeping new ones for you.
• Legal obligation (Art. 6(1)(c)): to respond to lawful requests from competent authorities; to comply with tax, accounting, and retention requirements; to comply with any other applicable law.

For users in other jurisdictions, we rely on the analogous legal grounds available under the privacy laws of your country (for example, "necessary to provide the service" under California's CCPA, or "consent" and "performance of a contract" under Brazil's LGPD).

With other Mippo users

What other people see depends on how you know them:

• Your friends see your whole profile, including your age and your gender (and their apps can read your NearPass settings); the broad areas of your interests, and in full the interests you share; your posts and Moments addressed to them; and where you crossed paths, if you share Ping location. Your birthday is shown to them only if you turn that on.
• Members of a circle or group chat you are in see your display name, your Avatar, and your bio, and what you post, send, or say you are going to there.
• Someone you pass on NearPass sees nothing that identifies you until you both accept the Ping. Before then, the Ping shows neither your name nor your Avatar, only the interests you share.
• Anyone who types your exact username sees your display name and your Avatar, so that they can send you a friend request.
• Anyone who can see your profile sees your NearScore, the number of Pings you have exchanged.

Other users also see the interests you share with them: as the reason shown on a Ping, on the Plaza, and on a friend's profile. The App never shows other users your phone number, your email address, or the year you were born, and your messages reach only the people in the conversation, unless you yourself choose to send them further.

With sub-processors

We use a small number of vetted third-party service providers to operate the Service. These "sub-processors" act under written data-processing agreements that require them to process your data only on our documented instructions, to keep it confidential, and to apply security measures consistent with this Privacy Policy.

Our current sub-processor categories are:

• Cloud infrastructure: Supabase (our database, sign-in, and file storage), Fly.io (our application servers), Upstash (short-lived data such as NearPass reports), and Cloudflare (the mippo.ai website);
• Sign-in and verification: Twilio (the text-message codes that verify your phone number), and Google or Apple if you sign in with them;
• Email delivery (the codes that verify a university email address, waitlist notifications, and any marketing emails you opt in to);
• Push notifications: Google Firebase Cloud Messaging, and Apple Push Notification Service on an iPhone, for users who allow notifications;
• Maps and place names: Google Maps, which draws the maps in the App, and OpenStreetMap's Nominatim service, which turns a shared location into a place name (see Section 3);
• AI processing (OpenAI, which analyses the description you give Mip; see Section 3);
• Product analytics (PostHog, in the European Union, only if you agree; see Section 3);
• Error and crash reporting (Sentry; see Section 3).

A current, named list of sub-processors is available on request from [email protected]. We will update that list before adding any new sub-processor that processes personal data, and where the change is material we will notify you in advance.

In response to lawful requests

We may disclose personal data when we are legally compelled to do so, for example by a valid subpoena, court order, or production order from a competent authority. We review every request for legal validity and scope, and we push back on requests we consider overbroad, unlawful, or improperly served. We will notify you of a request affecting your data unless we are legally prohibited from doing so. We hold the key that decrypts message contents (see Section 3), so a valid and properly scoped order can reach them. We produce only the data that a request actually covers, and nothing beyond it.

In the context of a business transfer

If Mippo is involved in a merger, acquisition, reorganisation, or sale of all or part of its assets, your personal data may be transferred to the acquirer as part of the transaction. Any acquirer would be bound by terms at least as protective as this Privacy Policy, and we would notify you in advance.

What we do not do

We do not sell personal data. We do not share personal data for cross-context behavioural advertising. We do not place tracking pixels, embed third-party advertising SDKs, or run any form of cross-site or cross-app tracking. We do not provide bulk data access to data brokers, advertisers, or any party other than the sub-processors described above. We do not use the contents of your messages, the photos you have uploaded, or the description you give Mip to train AI models, and we do not allow any of our sub-processors to do so.

We keep your account data in the European Union: our database, including sign-in and file storage, runs in Ireland, and our application servers run in the Netherlands. Mippo will be operated by Mippo, Inc., a United States company, and some of our sub-processors process personal data in other countries, including the United States (for example, for notifications and for Mip's analysis). When you use the Service from the European Union, the European Economic Area, the United Kingdom, or Switzerland, your personal data may therefore be transferred to and processed outside those places.

For transfers from the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) entered into with each sub-processor that processes personal data outside the EEA. Where appropriate, we apply supplementary technical and organisational measures, including encryption in transit (TLS 1.2 or higher) and encryption at rest.

For transfers from the United Kingdom, we rely on the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the United Kingdom Information Commissioner, or the United Kingdom International Data Transfer Agreement, as applicable.

For transfers from Switzerland, we rely on the Standard Contractual Clauses as amended for Swiss law, and we recognise the Swiss Federal Data Protection and Information Commissioner as the relevant supervisory authority for Swiss residents.

OpenAI, which analyses the description you give Mip (see Section 3), may process it outside Europe, including in the United States. For that transfer we rely on the Standard Contractual Clauses in OpenAI's data-processing terms, with the United Kingdom Addendum for data from the United Kingdom. Under those terms, data from the European Economic Area and Switzerland is processed by OpenAI Ireland Limited, which may pass it to other OpenAI companies or to its sub-processors outside the European Economic Area, including in the United States, under the Standard Contractual Clauses.

You may request a copy of the safeguards in place for transfers concerning your personal data by writing to [email protected].

We retain your data only for as long as we need it for the purposes set out above. Our standard retention periods are:

• Account data (your sign-in details, profile, username, date of birth, gender, Avatar, NearPass settings, and app language): while your account is active. Deleted within thirty (30) days of your account-deletion request, except as noted below.
• NearPass reports (which identifiers your phone heard): about one minute, until we have worked out who was near whom.
• Pings and friendships (the two accounts, when, the interests you share, and any location you shared): while the Ping or the friendship exists. Deleted when either of you removes the friendship or deletes your account.
• Passport places: until you remove them or delete your account.
• Messages (their encrypted text, any photo, voice note or video, and who sent them and when): until the sender deletes the message, or until the conversation is deleted. A one-to-one conversation is deleted when either person in it deletes their account; in a group chat, your messages are deleted when you delete your account. Copies of messages sent to us in a report are kept with the report (see "What we keep after you delete your account" below).
• Posts, Moments, and the photos and videos in them, and your profile wallpaper: while your account is active. Deleted within thirty (30) days of your account-deletion request, or of deleting the post or photo, from our live systems, and within ninety (90) days from encrypted backups.
• Your interests, and the related names Mip finds: while your account is active. An interest and the related names stored with it are deleted when you remove that interest, when you clear your interests, or when you delete your account. A connection you already have keeps the line saying which interests you shared when it was made, until you or the other person delete the account or the connection. If you object to our keeping the related names, we delete them.
• The description you give Mip, typed or dictated: not kept by us. OpenAI may keep it for up to thirty (30) days to monitor for abuse (see Section 3).
• Waitlist email: until you unsubscribe, or two years after your last interaction with us, whichever comes first.
• Server logs (mippo.ai): thirty (30) days.
• Crash reports: ninety (90) days.
• Product analytics (if you agreed): eighteen (18) months, and deleted when you delete your analytics data or your account.
• Records required by law (for example, tax records, lawful-request logs): for the period required by the relevant law.
• Encrypted backups: rotated out within ninety (90) days of deletion from the live system.

We may retain de-identified or aggregated data (data from which you can no longer be identified) for longer where doing so does not affect your privacy.

What we keep after you delete your account

Two things survive the deletion of an account. First, reports you filed about other users are kept, with your name and account removed from them, so that a complaint does not disappear when the person who made it leaves; what you wrote in the report stays with it, and these reports have no set end date. Second, if your account is suspended or banned when you delete it, we keep a one-way code made from its phone number and email address, with the reason and the end of the restriction, so that the same phone number or email address cannot be used to return before the restriction ends. For a suspension that is until it ends; for a ban it is indefinitely. Nothing else survives: no name, no account identifier, no content, and no link back to the deleted account. We rely on our legitimate interest in keeping the Service safe (GDPR Article 6(1)(f)), and for reports also on GDPR Article 17(3)(e).

We apply industry-standard technical and organisational measures to protect your data, including:

• AES-256 encryption of message text at rest, with the decryption key held outside the database in a managed secret store, so that a copy of the database on its own does not carry readable message text;
• encryption in transit (TLS 1.2 or higher) for all communication with our servers;
• encryption at rest of databases and backups containing personal data;
• short-lived, rotating identifiers for NearPass exchanges;
• access to systems holding personal data limited to the people who run the Service, through individual accounts;
• review of every change to the App and our servers before it ships, and automated scanning of the software we depend on for known vulnerabilities;
• a process for handling a security incident, including the notifications below.

No system is perfectly secure. If we ever become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within seventy-two (72) hours, as required by GDPR Article 33, and, where the risk is high, we will notify you directly without undue delay.

Under the GDPR, you have the following rights regarding your personal data, exercisable by writing to [email protected]:

• Access (Article 15): obtain confirmation that we process personal data about you, and a copy of that data.
• Rectification (Article 16): have inaccurate or incomplete personal data corrected.
• Erasure (Article 17), also known as the "right to be forgotten".
• Restriction of processing (Article 18).
• Data portability (Article 20): receive your personal data in a structured, commonly used, machine-readable format, and transmit it to another controller.
• Object to processing based on legitimate interests, or to processing for direct marketing (Article 21). An objection to our keeping the related names Mip finds (Section 3) goes to [email protected], the address that handles it.
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Article 22, see Section 13).
• Withdraw consent at any time, with effect for the future (Article 7(3)).
• Lodge a complaint with a supervisory authority (Article 77). Your primary supervisory authority is usually the data-protection authority of the country in which you live, work, or where the alleged infringement took place. For Mippo's first market, that authority is the Autoriteit Persoonsgegevens in the Netherlands (autoriteitpersoonsgegevens.nl). You may also contact the supervisory authority of any other EEA country where you reside.

We will respond to your request within one month, or within a longer period (up to two further months) for complex or numerous requests, as permitted by GDPR Article 12(3); we will tell you in advance if we need that extension. We do not charge for exercising your rights unless a request is manifestly unfounded or excessive, in which case we will tell you why. To protect your data, we may need to verify your identity before acting on a request, for example by asking you to confirm it from inside the App.

If you are in the United Kingdom, you have the same rights as listed in Section 9 above, exercisable in the same way. The supervisory authority for the United Kingdom is the Information Commissioner's Office (ico.org.uk).

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to know what personal information we collect, the sources we collect it from, the purposes for which we use it, and the categories of third parties with whom we share it.
• Right to access the specific pieces of personal information we have collected about you in the preceding twelve months.
• Right to delete personal information we have collected from you, subject to limited exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing of personal information. Mippo does not sell or share personal information for cross-context behavioural advertising as those terms are defined under California law. There is therefore nothing to opt out of, but the right remains available to you if our practices ever change.
• Right to limit use and disclosure of sensitive personal information. Mippo uses sensitive personal information only as needed to provide the Service and to fulfil purposes permitted by California Civil Code section 1798.121. The right to limit therefore does not apply to our current use, but the right remains available to you.
• Right to non-discrimination for exercising any of the rights above.

In the preceding twelve months, we have not sold or shared the personal information of any consumer, including any consumer under sixteen. To exercise your California rights, write to [email protected]. You may also authorise an agent to act on your behalf, provided the agent supplies us with written authorisation and we are able to verify your identity.

Residents of other jurisdictions with comprehensive privacy laws (including Brazil under the LGPD, Korea under PIPA, and Japan under APPI) have rights similar to those listed above. You can exercise those rights by writing to [email protected]. Where local law requires us to publish a separate privacy notice or to obtain a specific form of consent (for example, PIPA's notice-and-consent requirements at sign-up), we will provide that notice and obtain that consent within the App when we launch in the relevant country.

Mip's analysis is automated processing: an AI model reads the description you give Mip and finds interests in it, and a second automated check looks through what was found for anything that should not be kept (see Section 3).

GDPR Article 22 restricts decisions that are based solely on automated processing and that produce legal or similarly significant effects. Mip is designed so that this restriction does not apply, because:

• Mip's analysis only finds interests. You see every interest from Mippo's interest list that Mip finds, and you can remove any of them, or all of them at once, at any time. You can also pick your interests from the list yourself, without describing yourself to Mip.
• The related names Mip finds that are not on the list are not yet used to find people for you.
• A Ping is created automatically between two people nearby whose shared interests pass both people's settings, but it only introduces you: it stays anonymous until both of you accept it, and nothing follows unless you do.

If you believe Mip has kept something about you that is wrong, or that it should not have kept, remove the interest in the App or write to [email protected] and we will explain and correct.

We use your interests, and the related names Mip finds, only to provide the Service. We do not sell them, and we do not share them with advertisers or data brokers. We do not use the description you give Mip, your interests, or the related names to train AI models, and OpenAI does not use what we send it to train its models.

Mippo is for people aged sixteen (16) and over. The App asks for your date of birth when you join and does not let anyone younger than sixteen create an account, and our servers refuse an age under sixteen. We do not knowingly collect personal data from anyone under sixteen. If we learn that we have collected personal data from someone under sixteen, we will close the account and delete that data without undue delay.

If you believe we may have collected data from someone under sixteen, please contact [email protected].

Sixteen is also the highest age at which any European Union country sets the age of digital consent under GDPR Article 8. If a country where we launch sets a higher minimum age for a service like Mippo, the App will enforce that higher age there.

The mippo.ai website does not set any cookies itself. It does not use Google Analytics, Meta Pixel, or any other behavioural-analytics or advertising technology. The only third-party script it runs is Cloudflare Turnstile, which loads when you start typing into the waitlist form (see Section 3); everything else, fonts included, we serve ourselves.

The App uses only strictly necessary local storage, for example to remember that you are logged in, and to keep a copy of what it last loaded (your profile, your friends, your feed, and pictures of Avatars) so that it opens quickly and without a connection. That copy never includes the text of your messages, belongs to the account that is signed in, and is deleted when you sign out. The App contains no advertising SDK. It contains a product-analytics SDK that stays off unless you agree to it, and a crash-reporting SDK that sends no account identifier (see Section 3).

If our cookie or similar-technology practices ever change, we will update this section and, where the EU ePrivacy Directive as implemented in your country or other applicable law requires consent, we will obtain that consent before deploying the change.

We may update this Privacy Policy from time to time. When we do, we will:

• post the updated Privacy Policy at mippo.ai/privacy with a new "Last updated" date;
• maintain a public log of material changes once we have a stable history (the change log currently lives in our public git history); and
• for material changes, give you reasonable advance notice in-App, and by email where we have your address, before the change takes effect.

Continuing to use the Service after a change takes effect means you have read the updated Privacy Policy. If you do not agree with a change, you may delete your account using the in-App controls or by writing to [email protected].

For any question about this Privacy Policy, or to exercise any of the rights described above, write to [email protected]. We answer.

A postal address for service of formal legal notices will be published here once Mippo, Inc. is incorporated. Until then, [email protected] is the single contact channel.

You always have the right to lodge a complaint with the data-protection authority of your country. For Mippo's first market in the Netherlands, that authority is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). For the United Kingdom, the Information Commissioner's Office (ico.org.uk). Residents of other jurisdictions can find their authority through their national or regional government's data-protection resources.