Privacy Policy.

This Privacy Policy explains how Mikla AI Inc. ("Mikla", "we", "us") handles personal information across three groups of people:

When a customer uses Mikla to handle inbound inquiries, the customer is the data controller for those conversations. Mikla acts as a data processor on their behalf, bound by our Data Processing Addendum.

• Website visitors. Anyone browsing mikla.ai, reading our blog, or filling out a contact form.
• Customers. Hospitality businesses who sign up for, evaluate, or use the Mikla platform.
• End users. Couples, planners, corporate buyers, and guests who contact a Mikla customer and, in doing so, interact with Mikla on that customer's behalf.

We collect only what's necessary to operate, secure, and improve Mikla.

We do not knowingly collect government-issued IDs, biometric data, or health/financial information unless a customer explicitly configures Mikla to capture it for their own compliance purposes (e.g. collecting dietary or allergen info for catering).

• Account data. Name, work email, phone, company, role. Collected at signup or demo request.
• Configuration data. Your brand voice samples, pricing sheets, floor plans, FAQs, vendor partners, calendar and inbox credentials (via OAuth).
• Conversation data. Inbound inquiries Mikla replies to (email, SMS, phone transcripts, Facebook Messenger, Instagram and WhatsApp messages, Instagram comments, lead ad submissions, form submissions) and the replies Mikla sends.
• Connected-account data. Details and permissions for accounts a customer connects, such as Google, Facebook, Instagram, WhatsApp and Meta ad accounts. See sections 7 and 8.
• Usage data. Pages visited, buttons clicked, features used, errors encountered. Used to improve the product and triage bugs. Collected by our servers and through the analytics and advertising tools in section 6.
• Device and network. IP address, browser, operating system. Collected via standard web request logs and through the analytics and advertising tools in section 6.
• Billing. Company name, billing address, last 4 digits of card. Full card data is held by Stripe; Mikla never stores it.

We use personal information for the following purposes:

• Provide the service (contract). Run the AI, route replies, sync calendars, invoice customers.
• Improve the service (legitimate interest). Debug errors, monitor performance, measure feature adoption.
• Communicate (legitimate interest / consent). Send product updates, respond to support, deliver marketing opt-ins.
• Advertise and measure our own ads (consent where the law requires it). Show our ads to people who visited our site and to similar people, and count visits, demo requests and sign-ups that come from our ads. See section 6.
• Security and fraud prevention (legitimate interest). Detect account takeover, rate-limit abuse, investigate incidents.
• Legal compliance (legal obligation). Respond to court orders, tax filings, regulator requests.

This is the question we get most, so we'll be direct about it.

We use third-party model providers (including Anthropic and OpenAI) under zero-data-retention agreements. These providers do not retain or train on Mikla traffic.

If you connect your own AI assistant to Mikla, such as ChatGPT or Claude, see section 9: that assistant is covered by your agreement with its provider.

• Customer conversations are not used to train shared AI models. Full stop. Your inquiries, replies, and uploaded brand materials are isolated to your tenant and never feed into training data for any other customer, Mikla's foundation models, or third-party LLM providers.
• Per-tenant fine-tuning is optional and explicit. If you enable it, Mikla will use only your own past replies to personalize voice for only your venue. You can turn this off in settings and delete the resulting model snapshots.
• Anonymized, aggregated metrics, things like "avg. response time across all venues" or "share of inquiries that convert", may be used in benchmarks and research. These never contain identifiable customer or end-user data.

We do not sell personal information for money. We share it with service providers under contract to run Mikla, and, on mikla.ai, with Meta and Google for advertising, when advertising is on for you (see section 6). Key categories:

We may also disclose information to comply with a valid legal request, protect the rights or safety of Mikla, our customers, or the public, or to complete a corporate transaction (e.g. a merger), in which case this policy continues to apply to personal information transferred.

• Infrastructure. Amazon Web Services (US), Cloudflare (global edge).
• Model providers. Anthropic, OpenAI (zero-retention endpoints).
• Telephony. Twilio (US) for SMS and voice.
• Observability. Datadog, Sentry for error and performance monitoring.
• Payments. Stripe for subscription billing.
• Customer support. Intercom for in-app chat.
• Advertising. Meta Platforms (Facebook and Instagram ads); Google (the advertising features of Google Analytics).
• Analytics. Google (Google Analytics), PostHog, Microsoft Clarity.
• Scheduling. Calendly, for booking a demo call.
• Sign-in. WorkOS, for connecting AI assistants such as ChatGPT and Claude.

This section is about our own website, mikla.ai. It explains how we measure visits and our own ads. It does not cover the data that customers process with Mikla.

Analytics. We use Google Tag Manager to load Google Analytics 4, PostHog and Microsoft Clarity. They tell us which pages people visit, what they click, and where the site breaks. Microsoft Clarity also records how the page is used (mouse movement, scrolling and clicks) so we can replay sessions and see heatmaps. Microsoft Clarity also sets an ID on bing.com, which Microsoft may use under its own privacy statement. These tools set cookies; our Cookie Policy lists them.

Advertising. We use the Meta Pixel on mikla.ai for our own ads on Facebook and Instagram. When advertising is allowed, the Pixel sends Meta: page views, clicks on "Start free", pricing plan clicks, form submissions, demo bookings, and email verification in our free tools and website checkup. If you type contact details into a form on our site, the Pixel can also send your email address, name and phone number to Meta in hashed (scrambled) form, so Meta can match the visit to a Meta account. Meta also receives your IP address and browser details. The Pixel also sends the same events to Meta through a server connection that Meta provides (the Meta Conversions API Gateway).

When you send our demo request, contact or Try Mikla form and you allowed advertising, our server also sends the event to Meta through the Meta Conversions API. It sends: the event name (such as Lead or Contact), the time, the page address, your IP address and browser user agent, the Meta click and browser IDs (the fbclid from an ad link, and the _fbc and _fbp cookies), and a hashed email address, plus a hashed phone number and hashed first and last name when you give them. We do not send this when advertising is off or when your browser sends a Global Privacy Control signal. We still save and answer your request either way.

Google Analytics has advertising features (Google signals). When advertising is allowed, Google can use your visit for these features, for example ad reporting and audiences. We tell Google your Advertising choice through Google Consent Mode. If advertising is off, Google Analytics does not use your visit for its advertising features.

Why. Meta and Google may use this information to show our ads to people who visited our site, to find people similar to them, and to target and measure our ads. You can also manage this in your Facebook ad settings and your Google account.

Our vendor portal at vendors.mikla.ai also uses the Meta Pixel, including to tell Meta when someone completes a sign-up, so we can measure our ads. Choices you make on mikla.ai do not yet apply to the portal. To object to this, email contact@mikla.ai or block cookies in your browser.

What you see depends on where you are. We work out your region only from your browser time zone and language. We do not use a location cookie.

• European Economic Area, United Kingdom, Switzerland, Quebec, Brazil and Turkey (and visitors whose region we cannot tell). We ask first. Nothing for analytics or advertising runs until you click "Accept all" or turn it on in your settings.
• United States. We do not show a banner. Analytics and advertising run unless you opt out with the "Your Privacy Choices" link.
• Canada outside Quebec, and other countries. We show a short notice. Analytics and advertising start when the page loads. If you continue to use the site, you accept them. You can change this at any time.
• Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we turn off our advertising tools in every region: the Meta Pixel, the Meta server events and Google's advertising features. Analytics follows the rule for your region.
• Changing your choices. Use the "Your Privacy Choices" link at the bottom of every page. Turning off Advertising stops the Meta Pixel, the Meta server events and Google's advertising features. Turning off Analytics stops Google Analytics, PostHog and Microsoft Clarity. When you turn something off, we reload the page so those tools stop at once. We save your choice in a cookie called mikla_consent for about 13 months. Our server sets this cookie, so it also lasts this long in Safari. It holds only your choices, how you made them, and the date, not your name or email.

When you connect a Google account, Mikla accesses certain Google user data with your consent, solely to provide features to you: your Google Analytics and Google Search Console data to report your website traffic and search performance in your Mikla dashboard, and (for the assistant product) your Google Calendar and Gmail to book appointments and reply to inquiries on your behalf.

Mikla's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and we do not transfer it to others except to provide or improve these user-facing features, to comply with applicable law, or as part of a merger or acquisition in which case this policy continues to apply.

You can disconnect your Google account at any time from your Mikla settings or at myaccount.google.com/permissions, after which we delete the associated tokens.

Customers can connect their Facebook Pages, Instagram professional accounts, WhatsApp Business accounts and Meta ad accounts to Mikla using Facebook Login for Business. A customer chooses which Pages, accounts and permissions to grant, and can remove access at any time.

What we do not do. We do not sell Meta platform data. We do not use it for advertising for anyone other than the customer who connected the account, and we do not use it to train shared AI models. We share it only with the processors listed in section 5, and only to provide the service.

Disconnecting and deletion. A customer can disconnect Meta accounts at any time in Mikla settings, or remove Mikla in Facebook under Settings & privacy > Settings > Business integrations. When a customer disconnects in Mikla settings, we revoke and delete the access tokens immediately. When a customer removes Mikla in Facebook, Meta revokes our access immediately. In both cases, we delete the related Meta platform data within 30 days, unless the law requires us to keep it.

Deletion requests. People who messaged or commented on a Mikla customer's account can ask for their data to be deleted by following the steps at mikla.ai/data-deletion or by emailing contact@mikla.ai. When Meta sends us a data deletion request, we reply with a confirmation code and a link to check the status of the request, and we delete the data within 30 days.

Our use of Meta platform data follows the Meta Platform Terms and Developer Policies.

Depending on the permissions a customer grants, Mikla accesses the following Meta platform data, only to provide the service:

• Account and Page details (Page name and ID, Instagram username, profile photo and account ID), so the customer can see which accounts are connected and so Mikla routes messages to the right account.
• Messages sent to the customer's Facebook Page, Instagram account or WhatsApp number, so Mikla's AI agent can reply to inquiries on the customer's behalf and hand the conversation to the customer's team when needed.
• Comments on the customer's Instagram posts and ads, so Mikla can reply to prospective customers and continue the conversation in a private message where Meta allows it.
• Lead form submissions from the customer's Facebook and Instagram lead ads, so Mikla can follow up with the lead.
• Ad account data (campaigns, ad sets, ads, budgets and performance insights), so Mikla's ads agent can create, run and report on ads that the customer approves.

Customers can connect their own AI assistant, such as ChatGPT or Claude, to their Mikla account through the Mikla connector. The customer signs in, sees what the assistant will be able to do, and approves it on a Mikla consent page. Only the customer can connect their account.

Changes. The assistant can suggest changes to the customer's Mikla settings, but nothing changes until the customer approves it. Every approved change is recorded and can be undone. The assistant can never make a payment or change the customer's plan.

Where the data goes. What the assistant reads from Mikla is sent to the company that runs that assistant (for example OpenAI for ChatGPT and Anthropic for Claude) and is handled under the customer's own agreement with that company and its privacy policy, including how long it keeps the data and whether it uses it for training. Our zero-data-retention agreements in section 4 cover Mikla's own use of AI models, not an assistant the customer connects. Mikla only sees the requests the assistant sends to Mikla, not the customer's conversation with the assistant.

We keep a record of each request (which assistant, what it asked for, and when) to protect the account and so the customer can see what changed.

Disconnecting. A customer can disconnect at any time by removing Mikla from the assistant's connector or app settings, or by pressing Disconnect AI assistants on the Connections page in the Mikla portal, after which the assistant can no longer reach the account.

Questions about connecting an AI assistant to Mikla can be sent to support@mikla.ai.

What it can read. Once connected, the assistant can read the following, only so it can answer the customer's questions about their business and help them set up Mikla:

• Business details and agent settings.
• Knowledge base documents.
• Leads and their conversations: names, event dates, budgets and messages. Lead email addresses and phone numbers are hidden unless the customer chooses to share them on the consent page.
• Plan and credit balance (read only).

We keep data only as long as needed for the purposes above.

• Conversation data: retained for the life of the account or as configured by the customer; deleted within 30 days of an export or deletion request.
• Meta platform data: access tokens are deleted when a customer disconnects the account in Mikla settings, and Meta-sourced data is deleted within 30 days of disconnection or of a deletion request.
• Account and billing records: retained for up to 7 years to meet tax and audit obligations.
• Website analytics: the analytics tools in section 6 keep visit data under their own retention settings; raw IP logs rotated every 14 days. Our Cookie Policy lists how long each cookie lasts.
• Backups: encrypted backups rotated every 30 days; deletions propagate to backups within one rotation.

We follow industry-standard security practices. Controls include:

• Data encrypted in transit (HTTPS).
• Tenant isolation at the database layer.
• Least-privilege access for Mikla staff.
• Incident response with customer notification within 72 hours of any confirmed breach of personal data.

Depending on where you live, you have some or all of the following rights with respect to your personal information:

To exercise any of these rights, email our privacy contact at contact@mikla.ai. We respond within 30 days (45 days for requests under US state privacy laws, see section 13). Customers of Mikla can also export and delete conversation data directly from account settings at any time.

End users who have interacted with a Mikla customer should direct requests to that customer in the first instance. They are the controller of the underlying conversation.

If you contacted a business through Facebook, Instagram or WhatsApp, you can also follow the steps at mikla.ai/data-deletion.

• Access a copy of what we hold about you.
• Correct inaccurate information.
• Delete your data ("right to be forgotten").
• Port your data to another provider in a machine-readable format.
• Restrict or object to certain processing, including direct marketing.
• Withdraw consent at any time where we rely on consent as the lawful basis.
• Turn off analytics or advertising on mikla.ai at any time with the "Your Privacy Choices" link at the bottom of every page.

This section applies to residents of California and other US states with consumer privacy laws.

In the last 12 months we collected these categories of personal information: identifiers (such as name, email address, phone number, IP address and cookie IDs); internet activity (such as pages viewed and clicks on mikla.ai); and commercial information (such as your plan and billing records). We collect them from you, from your browser, and from the tools listed in section 6. We use them for the purposes in section 3. We do not make inferences about you to build a profile of your characteristics.

We do not sell personal information for money. On mikla.ai we use the Meta Pixel, the Meta Conversions API and the advertising features of Google Analytics for our ads (section 6). Under California law, this may count as "sharing" personal information for cross-context behavioral advertising, and other state laws may call it targeted advertising. We do not knowingly sell or share the personal information of people under 16.

We do not use or disclose sensitive personal information to infer characteristics about you.

You have these rights:

• Opt out of sharing for cross-context behavioral advertising and targeted advertising. Use the "Your Privacy Choices" link at the bottom of every page and turn off Advertising, or turn on Global Privacy Control in your browser. We treat a GPC signal as a valid opt-out. This turns off the Meta Pixel, the Meta server events and Google's advertising features on mikla.ai.
• Know. Ask what personal information we collected about you, where it came from, why we use it, and who we disclosed it to.
• Delete. Ask us to delete personal information we collected from you.
• Correct. Ask us to correct personal information that is not accurate.
• How to ask. Email our privacy contact at contact@mikla.ai. We may ask for information to confirm who you are. An authorized agent can make a request for you; we may ask for proof that you gave them permission.
• Response time. We respond within 45 days. If we need more time, we tell you why.
• Appeal. If we decline your request, you can appeal by replying to our answer. We will answer the appeal within the time the law requires.
• No discrimination. We do not treat you differently, or charge you a different price, because you used these rights.

Mikla is headquartered in Toronto, Canada, and our cloud infrastructure runs in the United States. If you're in the EEA, UK, or Switzerland, your data may be transferred to Canada or the U.S. When it is, we rely on Standard Contractual Clauses. Transfer impact assessments are maintained and available to customers under NDA.

Mikla is a B2B product and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have, email contact@mikla.ai and we will delete it promptly.

We'll update this policy as our product and regulations evolve. Material changes trigger an email to account admins at least 30 days before they take effect, along with a version bump at the bottom of this page. Minor clarifications or fixes are noted in our changelog.

Questions, concerns, or data requests, reach us at:

• Privacy contact: contact@mikla.ai
• Mail: Mikla AI Inc. · 140 Yonge Street, Suite 200 · Toronto, ON M5C 1X6 · Canada