Privacy Policy for miros Mobile App

1. Introduction

This Privacy Policy describes how Miros Technology SA ("we," "our," or "us") collects, uses, and protects your personal information when you use the miros mobile application ("App") in accordance with Swiss data protection laws, including the Federal Act on Data Protection (FADP) and the revised FADP (revFADP).

By using our App, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Personal Information

• Account Information: Email address, first name, last name
• Profile Information: Profile pictures/avatars (for identity verification at space locations)
• Payment Information: Stripe payment data (processed securely through Stripe's platform)
• Contact Information: Email address for account management and communications

2.2 Location Information

• Current Location: GPS coordinates to show nearby spaces on the map
• Location Permissions: We request location access to help you find and book spaces near you
• Map Data: Address information and coordinates for space locations

2.3 Usage Information

• Booking Data: Space reservations, booking history, payment records
• App Usage: Features used, search queries, preferences
• Device Information: Device type, operating system, app version

2.4 Communication Data

• Push Notifications: Booking reminders, updates, and promotional messages
• In-App Messages: System notifications and alerts

2.5 Camera and Media Access

• Profile Pictures: Camera access to take profile photos for identity verification
• Photo Library: Access to select existing photos for profile pictures
• Image Storage: Secure storage of profile images for verification purposes

3. Legal Basis for Processing (Art. 6 revFADP)

We process your personal data based on the following legal grounds:

3.1 Contract Performance (Art. 6(1)(b) revFADP)

• Account Management: Creating and managing your user account
• Space Booking: Processing reservations and payments
• Service Delivery: Providing the core booking functionality
• Identity Verification: Using profile pictures to ensure the right person arrives at the booked location

3.2 Legitimate Interest (Art. 6(1)(f) revFADP)

• Location Services: Showing nearby spaces and directions
• App Improvement: Understanding usage patterns to enhance functionality
• Security: Protecting against fraud and ensuring app security
• Customer Support: Responding to inquiries and providing assistance
• Identity Verification: Preventing unauthorized access to booked spaces

3.3 Consent (Art. 6(1)(a) revFADP)

• Marketing Communications: Promotional offers and newsletters
• Push Notifications: Booking reminders and updates
• Camera Access: Taking and uploading profile pictures
• Photo Library Access: Selecting existing photos for profile pictures

3.4 Legal Obligation (Art. 6(1)(c) revFADP)

• Tax Compliance: Maintaining records for Swiss tax authorities
• Financial Regulations: Compliance with Swiss financial laws
• Data Retention: Legal requirements for data preservation

4. How We Use Your Information

4.1 Core App Functionality

• Account Management: Creating and managing your user account
• Space Booking: Processing reservations and payments
• Location Services: Showing nearby spaces and directions
• Notifications: Sending booking reminders and updates
• Identity Verification: Using profile pictures to verify user identity at space locations

4.2 Service Improvement

• Analytics: Understanding app usage patterns to improve functionality
• Customer Support: Responding to inquiries and providing assistance
• Security: Protecting against fraud and ensuring app security

4.3 Communication

• Booking Confirmations: Sending reservation details and confirmations
• Service Updates: Important app updates and maintenance notifications
• Marketing: Promotional offers (with your explicit consent)

5. Camera and Media Permissions

5.1 Camera Access

• Purpose: Taking profile pictures for identity verification
• Usage: Photos are used solely for verifying your identity when accessing booked spaces
• Storage: Images are securely stored and encrypted
• Sharing: Profile pictures are only shared with space providers for verification purposes

5.2 Photo Library Access

• Purpose: Selecting existing photos for profile pictures
• Usage: Only for profile picture selection
• Access: Limited to photos you specifically select
• No Scanning: We do not scan or access your entire photo library

5.3 Image Processing

• Optimization: Images may be compressed or resized for optimal app performance
• Security: All images are processed and stored securely
• Retention: Profile pictures are retained as long as your account is active

6. Information Sharing

6.1 Third-Party Services

• Stripe: Payment processing and billing information (Swiss-compliant)
• Google Maps: Location services and mapping functionality
• Supabase: Data storage and backend services (EU/Swiss-compliant)
• Expo: Push notification services

6.2 Space Providers

• Identity Verification: Profile pictures may be shared with space providers to verify your identity when accessing booked spaces
• Booking Information: Necessary booking details for space access

6.3 Legal Requirements

We may disclose your information if required by Swiss law or to protect our rights and safety.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the business transaction, subject to Swiss data protection requirements.

7. Data Security (Art. 8 revFADP)

We implement appropriate technical and organizational security measures to protect your personal information:

• Encryption: Data is encrypted in transit and at rest
• Secure Storage: Information is stored on secure servers in Switzerland or EU
• Access Controls: Limited access to personal data on a need-to-know basis
• Regular Updates: Security measures are regularly reviewed and updated
• Data Protection Impact Assessments: Conducted for high-risk processing activities
• Image Security: Profile pictures are stored with additional security measures

8. Your Rights Under Swiss Law (Art. 25-32 revFADP)

8.1 Right to Information (Art. 25 revFADP)

• Transparency: Right to be informed about data processing
• Access: Right to request access to your personal information
• Processing Details: Information about the purpose, legal basis, and recipients

8.2 Right to Rectification and Erasure (Art. 28-29 revFADP)

• Update Information: Modify your profile and account settings
• Data Correction: Request correction of inaccurate data
• Delete Account: Request deletion of your account and associated data
• Right to be Forgotten: Request erasure under specific circumstances
• Profile Picture Removal: Request deletion of your profile picture

8.3 Right to Data Portability (Art. 30 revFADP)

• Data Export: Request a copy of your data in a portable format
• Transfer: Right to transfer data to another service provider

8.4 Right to Object and Restriction (Art. 31-32 revFADP)

• Objection: Right to object to processing based on legitimate interest
• Restriction: Right to restrict processing under certain conditions
• Withdrawal of Consent: Right to withdraw consent at any time

8.5 Communication Preferences

• Push Notifications: Control notification settings in your device settings
• Marketing Communications: Opt out of promotional messages
• Email Preferences: Manage email communication settings

8.6 Location Services

• Location Permissions: Control location access through device settings
• Location Data: Request deletion of stored location information

8.7 Camera and Media Permissions

• Camera Access: Control camera access through device settings
• Photo Library Access: Control photo library access through device settings
• Profile Picture: Update or remove your profile picture at any time

9. Data Retention (Art. 7 revFADP)

We retain your information only for as long as necessary to:

• Contract Performance: Provide our services
• Legal Obligations: Comply with Swiss legal requirements
• Legitimate Interests: Resolve disputes and enforce agreements
• Consent Period: Duration of your consent for marketing communications

Retention Periods:

• Account Data: 7 years after account deletion (Swiss tax law requirement)
• Booking Records: 10 years (Swiss commercial law requirement)
• Payment Data: 7 years (Swiss financial regulations)
• Marketing Data: Until consent withdrawal or 2 years after last interaction
• Profile Pictures: Retained while account is active, deleted upon account deletion

10. Children's Privacy (Art. 6(1)(a) revFADP)

Our App is not intended for children under 16 years of age without parental consent. We do not knowingly collect personal information from children under 16 without proper authorization. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

11. International Data Transfers (Art. 16 revFADP)

Your information may be transferred to and processed in countries outside Switzerland. We ensure appropriate safeguards are in place:

11.1 Adequacy Decisions

• EU Countries: Transfers to EU countries are permitted under adequacy decisions
• Other Countries: We use standard contractual clauses or other approved safeguards

11.2 Third-Party Processors

• Stripe: Certified under EU-US Privacy Shield and Swiss-US Privacy Shield
• Google: Compliant with EU and Swiss data protection requirements
• Supabase: EU-based with Swiss compliance measures

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:

• In-App Notification: Posting the new policy in the App
• Email Notification: Sending you a notification
• Version Update: Updating the "Last Updated" date

13. Contact Information

If you have questions about this Privacy Policy or wish to exercise your rights under Swiss data protection law, please contact us:

14. Supervisory Authority

You have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC):

15. Specific Swiss Requirements

15.1 Sensitive Data (Art. 5 revFADP)

We do not process sensitive personal data (health, political opinions, etc.) without explicit consent or legal authorization.

15.2 Automated Decision-Making (Art. 21 revFADP)

We do not use automated decision-making that significantly affects you without human intervention.

15.3 Profiling (Art. 22 revFADP)

Any profiling activities are conducted with your consent and in accordance with Swiss law.

15.4 Identity Verification

Profile pictures are used solely for identity verification purposes to ensure the right person accesses the booked space. This processing is based on our legitimate interest in preventing unauthorized access and fraud.