Miyuwa SAS ("we," "us," or "Miyuwa") is committed to protecting your privacy. As a company established in France that serves users in the United States, we handle your personal information in accordance with both the EU General Data Protection Regulation (GDPR) and applicable US federal and state privacy laws, including the California Consumer Privacy Act (CCPA/CPRA) and the privacy laws of other US states. This Privacy Policy explains what we collect, why, how we share and protect it, and the rights you have.
1. Who We Are (Data Controller)
Miyuwa SAS, a company established in France, is the data controller responsible for your personal information. Its full corporate details will be published on our Legal Notice page once the company's registration is finalized. The Miyuwa platform is an online marketplace connecting makeup artists and clients. For any privacy-related question, or to exercise your rights, contact us at contact@miyuwa.com.
2. Information We Collect
We collect: account information (name, email address, profile photo) when you register; profile data (bio, specialties, pricing, portfolio) for MUA accounts; booking information (date, time, location, service amount); payment information (processed securely by Stripe — we never store your card details); messages exchanged through our in-app messaging; usage data (IP address, device type, browser, pages visited) via cookies and analytics tools.
3. How We Use Your Information
We use your information to: operate and improve the Platform (provide bookings, process payments, send confirmations); prevent fraud and ensure security; send transactional communications (booking confirmations, reminders) — in compliance with the CAN-SPAM Act; analyze usage patterns to improve user experience (only with your consent for analytics cookies); comply with legal obligations.
4. Legal Bases for Processing (GDPR)
Where the GDPR applies, we process your personal information only where we have a legal basis to do so: (a) performance of a contract — to create your account and process your bookings and payments; (b) our legitimate interests — to secure the Platform, prevent fraud, and improve our services, balanced against your rights; (c) your consent — for analytics cookies and any marketing communications, which you can withdraw at any time; and (d) legal obligation — to meet our tax, accounting, and other legal requirements. Withdrawing consent does not affect processing carried out before the withdrawal.
5. Cookies
We use strictly necessary cookies for Platform operation (authentication, language preferences). These do not require consent. With your consent, we use PostHog, a product analytics service, to understand how users interact with the Platform (pages visited, actions taken, device and browser information) and to replay user sessions for troubleshooting and product improvement, with sensitive form fields masked. PostHog processes this data on servers hosted in the European Union. If you decline, no analytics or session replay runs at all. You can manage your cookie preferences at any time using the controls below.
6. Data Retention
Account data is retained while your account is active, and up to 3 years after deletion for legal compliance. Transaction and accounting records are retained for as long as required by applicable tax and accounting laws (up to 10 years). Messages are retained for 2 years after the last interaction. You may request earlier deletion at any time, subject to these legal retention periods.
7. How We Share Your Information
We do not sell your personal information. We may share it with: Stripe (payment processing — subject to Stripe's Privacy Policy); Supabase and Vercel (infrastructure and hosting); PostHog (product analytics, only with your consent — hosted in the European Union and subject to PostHog's Privacy Policy); and law enforcement, courts, or other competent authorities when required by a valid legal process (subpoena, court order, etc.). Our service providers act as data processors under written data processing agreements.
8. International Data Transfers
Miyuwa is operated from France, and we use service providers located in the United States (including Stripe, Supabase, and Vercel) to process and host data, so your information may be transferred to and stored in the United States. For transfers of personal data from the EU/EEA to the United States, we rely on appropriate safeguards — the European Commission's Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework where applicable — together with data processing agreements with these providers.
9. Your Rights Under the GDPR (EU/EEA Users)
If you are in the EU/EEA, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure ('right to be forgotten'); restrict or object to certain processing; receive your data in a portable format; and withdraw consent at any time. To exercise these rights, email contact@miyuwa.com; we respond within one month. You also have the right to lodge a complaint with a data protection authority — in France, the Commission Nationale de l'Informatique et des Libertés (CNIL, www.cnil.fr).
10. California Residents — CCPA/CPRA Rights
If you are a California resident, you have the right to: know what personal information we collect and how it is used; request correction of inaccurate information; request deletion of your personal information; opt out of the 'sale' or 'sharing' of your personal information (we do not sell your data, and we honor Global Privacy Control (GPC) signals); limit the use of sensitive personal information; and receive equal service and pricing whether or not you exercise these rights. To submit a request, email contact@miyuwa.com. We respond within 45 days, and you may appeal a denied request by replying to our decision.
11. Other US State Privacy Rights (incl. Florida)
If you live in another US state with a comprehensive privacy law (such as Florida, Virginia, Colorado, Connecticut, Texas, Oregon, or others), you may have similar rights to access, correct, delete, and obtain a copy of your personal information, and to opt out of targeted advertising or the sale of your data. Florida residents are covered by the Florida Digital Bill of Rights where applicable. To exercise any of these rights, email contact@miyuwa.com; if we deny your request, you may appeal by replying to our response.
12. Your Rights (All Users)
Regardless of where you live, you may: access, correct, or delete your personal information; unsubscribe from marketing emails at any time; request a copy of data we hold about you. Submit requests to contact@miyuwa.com. We respond within 30 days.
13. Security
We implement industry-standard security measures to protect your data: TLS encryption in transit, encrypted storage for sensitive data, restricted internal access, and regular security reviews. In the event of a data breach affecting your personal information, we will notify you and, where the GDPR applies, the relevant supervisory authority within 72 hours, as required by applicable law.
14. Children's Privacy
Miyuwa is intended for users aged 18 and older and is not directed to minors. We do not knowingly collect personal information from anyone under 18, and in particular not from children under 13 (in compliance with COPPA). If we learn we have collected such information, we will promptly delete it. If you believe a minor has provided us their data, contact us at contact@miyuwa.com.
15. Updates to This Policy
We may update this Privacy Policy from time to time. The updated date is shown at the top of this page. For material changes, we will notify you by email at least 30 days before the changes take effect.
Your Cookie Preferences
Privacy questions? Contact us at contact@miyuwa.com