Privacy Policy

This Privacy Policy explains how Mimo Baby DPK ("mīmo", "we", "us", or "our") collects, uses, and shares your personal information when you visit our website at https://mimo.baby (the "Website") and when you join our early-access waitlist.

Mimo Baby DPK is the controller of your personal information within the meaning of the General Data Protection Regulation. If you have any questions, you can reach us at hello@mimo.baby or at the contact details set out at the end of this Policy.

1. What information we collect

Information you provide to us

When you join our early-access waitlist through the signup form on the Website, we collect:

• your email address (required);
• your name, if you choose to give it (optional);
• whether you ticked the optional box to receive news and updates by email (your marketing choice).

Together with this, we record:

• the language of the page you signed up on (Bulgarian or English), so that we write to you in that language;
• the campaign source – if you arrived through a campaign link, the campaign tags in that link (for example "instagram/cpc/launch"); otherwise simply "website";
• the date and time of your signup.

If you agree to receive news and updates, our systems also record the identifier of your entry in our mailing list and the date it was added. If you later unsubscribe, we record that you did so and when.

You do not create an account with us, and we do not ask you to set a password. We do not collect any sensitive personal information (such as health data, racial or ethnic origin, political opinions, or biometric data) through this Website.

Information collected automatically

When you visit the Website, some technical information is processed automatically. It does not directly reveal your identity but may include:

• Log and usage data – technical information that our hosting provider processes automatically to deliver the Website to you, such as your IP address, browser type, the pages you request, and the date and time of your visit.
• Device data – information about the device you use to access the Website, such as device and browser characteristics and operating system.

We do not use GPS or similar technologies to collect precise geolocation data. Our analytics provider derives only an approximate country from your IP address and does not store the IP address itself.

Google services

The Website uses services from Google: Firebase (to host the Website, store waitlist signups, and run the functions that manage our mailing list) and Google reCAPTCHA through Firebase App Check (to protect the signup form from abuse). Information collected through these services is handled as described in this Policy and in Google's own privacy terms.

We do not collect personal information about you from any other source. All personal information comes directly from you.

2. How we use your information

We use the personal information we collect for the following purposes:

• To keep your place on the waitlist and tell you when mīmo is ready – when you submit the signup form, we add you to our early-access waitlist and use your email address to let you know when mīmo is ready or early access opens.
• To send you news and updates, only if you agree – if you tick the optional box on the form, we add you to our mailing list, send you a welcome email, and occasionally write to you with news about mīmo and early access. Every such email contains an unsubscribe link, and you can unsubscribe at any time (see Section 9). Unsubscribing does not remove you from the waitlist.
• To operate and protect the Website – including keeping the signup form secure, preventing automated abuse, and understanding, in aggregate, how the Website is used.
• To keep a record of your choices – we keep a record of whether and when you agreed to receive news and updates, and whether and when you unsubscribed, so that we can show that we have your consent and make sure we do not send you marketing emails after you opt out.

We do not use your information to provide a paid service or to fulfil a contract, because we do not sell anything through this Website and you enter no contract with us by joining the waitlist.

3. Legal bases for processing

Under the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") and equivalent laws in the UK, Switzerland, Iceland, Liechtenstein, and Norway, we must have a valid legal basis to process your personal information. We rely on the following:

• Consent to join the waitlist (Article 6(1)(a) GDPR) – by submitting the signup form, you consent to us processing your email address, your name if you give it, and the related details listed in Section 1, for the specific purpose of keeping your place on the waitlist and telling you when mīmo is ready or early access opens. You can withdraw this consent at any time by emailing us at hello@mimo.baby, and we will remove you from the waitlist.
• Separate consent to news and updates (Article 6(1)(a) GDPR) – we send you a welcome email and marketing emails only if you give your separate, explicit consent by ticking the optional box on the form. The box is never pre-ticked, and joining the waitlist does not depend on it. You can withdraw this consent at any time by using the unsubscribe link in any of our emails or by emailing us.
• Legitimate interests (Article 6(1)(f) GDPR) – we process log, usage, and device data, run bot protection and cookieless analytics, and keep the record of your choices described in Section 2, on the basis of our legitimate interest in keeping the Website secure, understanding how it is used, and being able to show that we respect your choices. We balance these interests against your rights and freedoms.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

4. When and with whom we share information

We share your personal information only with the service providers (processors) that help us operate the Website and communicate with you, and only to the extent they need it. We have data processing agreements in place with each of them. These providers are:

We do not offer AI-based services, we do not accept online payments, we do not allow users to upload or post content, and we do not display third-party advertising. We do not share your information with business affiliates or partners, and we do not sell your personal information.

5. Cookies and tracking technologies

We do not use cookies, web beacons, or similar technologies to track you, and we do not use Google Analytics or any advertising technology. Our analytics are provided by Plausible, which is cookieless, does not use persistent identifiers, and does not identify individual visitors.

Our emails do not use open or click tracking: they contain no tracking pixels, and the links in them are not redirected to record clicks.

Browsing the Website does not set any cookies. Only when you submit the signup form does the Website load Firebase and Google reCAPTCHA, which may then store a small amount of strictly necessary technical data on your device: Firebase keeps a security token and technical records in your browser's local storage, and reCAPTCHA may set its own cookie or local-storage entry (such as _GRECAPTCHA) to tell people and bots apart. This data is used only to protect the form from abuse, never for tracking or advertising.

Because we use no tracking cookies and the storage described above is strictly necessary for the security of the form, we do not show a cookie-consent banner.

6. How long we keep your information

We keep your waitlist details (listed in Section 1) until we have sent you our invitation to early access or our launch notice, and in any case for no longer than 24 months from the date you signed up. After that, we delete them. We delete them sooner if you ask us to or withdraw your consent.

If you agreed to receive news and updates, we keep your email address, your name if you gave it, and your language for as long as you stay subscribed, even after the waitlist period has ended. When you unsubscribe, we stop sending you marketing emails straight away.

After you unsubscribe, we keep a minimal record that you did so (your email address, your opt-out, and its date) in our database and in our mailing list, where you are marked as unsubscribed. We keep this record only for as long as it is needed to make sure we never send you marketing emails again. Unsubscribing does not remove you from the waitlist; if you also want your waitlist details deleted, email us at hello@mimo.baby and we will delete them together with this record.

Our server functions write technical logs to Google Cloud Logging, which may include your email address (for example, a note that a welcome email was sent to you). These logs are used only to run and troubleshoot the service and are deleted automatically after 30 days. We keep other automatically collected technical data only for as long as necessary for the purposes described above.

7. How we keep your information safe

We have implemented appropriate technical and organisational security measures designed to protect your personal information, including:

• Firestore security rules that only allow the form to create new signups – nobody can read, change, or delete them from the browser;
• Firebase App Check together with reCAPTCHA v3;
• encryption of data in transit and at rest across Google's infrastructure;
• no secrets stored in client-side code – the key for our email service is kept in Google Secret Manager;
• signed unsubscribe links, so that each link can only unsubscribe its own address;
• a hidden honeypot field on the form to deter bots;
• collecting only the minimal data we need.

No method of transmission or storage is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required, and affected individuals where the law requires it.

8. Information from minors

Our Website is directed at parents and other adults. We do not knowingly collect data from children under 18 years of age, and we do not market to them. If you believe we have collected information from a minor, please contact us at hello@mimo.baby and we will delete it.

9. Your privacy rights

Depending on your location and applicable law, you may have the following rights in respect of your personal information: the right to access, correct, update, or request deletion of your data; the right to object to or restrict its processing; the right to data portability; and the right to withdraw consent at any time where we rely on consent. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

You can unsubscribe from news and updates at any time by using the unsubscribe link in any of our emails (or your email app's unsubscribe button), or by emailing us at hello@mimo.baby. To leave the waitlist altogether, email us and we will delete your details.

To exercise any of these rights, email us at hello@mimo.baby. We will respond within one month of receiving your request. Where necessary, for example for complex or numerous requests, this period can be extended by two further months, and we will tell you if that happens. We may ask you for information to confirm your identity before acting on a request. If you are in the EEA, the UK, or Switzerland and believe we have not addressed your concern, you also have the right to lodge a complaint with your local data protection supervisory authority. In Bulgaria this is the Commission for Personal Data Protection (Комисия за защита на личните данни, www.cpdp.bg).

10. International transfers

Your waitlist details are stored, and our server functions run, in Germany (Frankfurt). Plausible Analytics is an Estonian company that processes and stores analytics data only within the European Union.

Two of our providers are established in the United States, so your personal information may be transferred to, and processed in, the United States:

• Google LLC, which provides Firebase and reCAPTCHA. Firebase Hosting delivers the Website through a global network, and the information collected by reCAPTCHA is sent to Google for analysis.
• Resend (Plus Five Five, Inc.), which delivers our emails and stores our mailing list. Resend stores its customer data, including our mailing list and the logs of the emails we send, in the United States. Our mailing list contains only people who agreed to receive news and updates, and Resend processes the email address of everyone we send an email to.

Both providers are certified under the EU–U.S. Data Privacy Framework, and transfers to them are covered by the European Commission's adequacy decision for that framework (Commission Implementing Decision (EU) 2023/1795). In addition, their data processing terms incorporate the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) as a further safeguard. You can ask us for more information about these safeguards at hello@mimo.baby.

We are established in the European Union, so we do not need a representative in the EU. We do not specifically offer our products or services to people in the United Kingdom; if that changes, we will appoint a representative in the UK where the UK GDPR requires one. We have not appointed a Data Protection Officer, because our current activities do not meet the conditions under which the GDPR makes one mandatory (Article 37 GDPR).

11. Bot protection

When you submit our signup form, the Website loads Google reCAPTCHA v3 through Firebase App Check to verify that the submission does not come from an automated bot; reCAPTCHA is not loaded before you submit. reCAPTCHA collects hardware and software information, such as device and application data, and sends it to Google for analysis. Google's Privacy Policy and Terms of Service apply to reCAPTCHA. We use it solely to protect our form from abuse.

12. No tracking cookies

We use no tracking or advertising cookies on this Website. Our analytics provider, Plausible, is cookieless and does not identify individual visitors, and all analytics data is processed and stored within the European Union. The only technical storage we use is the strictly necessary storage that Firebase and Google reCAPTCHA may create when you submit the signup form, described in Section 5 – it is never used for tracking or advertising.

13. Updates to this Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by a revised "Effective date" at the top of this Policy and will take effect as soon as it is published. We encourage you to review this Policy periodically.

14. How to contact us

If you have questions or comments about this Policy, you can contact us:

Mimo Baby DPK (trading as mīmo)
bul. Aleksandar Stamboliyski 205, Sofia 1309, Bulgaria
EIK (company registration number): 208846876
VAT number: BG208846876
Tel: +359 895 531 893
Email: hello@mimo.baby

15. How to review, update, or delete your data

You have the right to request access to the personal information we collect from you, to change that information, or to delete it. To do so, email us at hello@mimo.baby.