Privacy Policy
Last updated: September 1, 2026
1. Data Controller
The data controller for personal data is Danmind, a French SAS, SIRET 938 778 974 00015, with registered office at 49 rue Verte, 76000 Rouen, France, represented by Mohamed Alani.
Contact: hello@mimikflow.com
2. Data We Collect
We collect the following categories of data:
- Account data: email address, name (via Google OAuth or sign-up).
- Configuration data: information entered by the user (profile description, target, product, Calendly URL, communication style).
- Prospecting data: public LinkedIn profile information (name, role, summary, company) collected via authorized API.
- Conversation data: messages exchanged with prospects via LinkedIn.
- Billing data: handled by Stripe. We do not store credit card numbers.
- Calendar data: only if you connect a calendar (Google Calendar, Cal.com, Calendly, iClosed). We read your busy periods to offer free slots, and we create the event for the meeting obtained. Full detail in section 11.
- Technical data: connection logs, IP address (limited retention).
3. Purposes of Processing
Data is processed for the following purposes:
- Providing and personalizing the Service
- Generating personalized messages with artificial intelligence
- Subscription management and billing
- Service improvement and technical support
4. Legal Basis (GDPR Article 6)
- Performance of contract: processing necessary to deliver the Service
- Legitimate interest: improving the Service, preventing abuse
- Consent: marketing communications (where applicable)
5. Sub-processors & Data Transfers
We rely on the following sub-processors to operate the Service. Each only accesses the data strictly required for its purpose, under a contract compliant with GDPR Article 28.
| Sub-processor | Purpose | Data | Country |
|---|---|---|---|
| Supabase Inc. | PostgreSQL database and authentication | Account, configuration, leads, conversations | EU (Frankfurt) / USA (SCCs) |
| Stripe, Inc. | Payment and billing | Email, card info (never stored on our side), billing history | USA (SCCs) |
| Unipile SAS | LinkedIn API proxy (sending connections, messages, reading profiles) | Prospect LinkedIn profiles, conversations, invitations | France (EU) |
| OpenRouter, Inc. | Routing to language models (Anthropic Claude, OpenAI GPT, Perplexity) | User config + public LinkedIn profile data (for message generation) | USA (SCCs) |
| Anthropic, PBC | Claude models for cold DMs, follow-ups and AI Setter | Prompts containing user config + prospect profiles | USA (SCCs) |
| OpenAI, L.L.C. | GPT models for follow-ups | Prompts containing user config + prospect profiles | USA (SCCs) |
| Perplexity AI, Inc. | Public information lookup on target companies | Prospect company name and domain | USA (SCCs) |
| Resend, Inc. | Sending transactional emails (digests, lifecycle, recap) | Email address, first name, message content | USA (SCCs) |
| Amazon Web Services, Inc. (S3) | Storage of demo videos uploaded by the user | Video file, metadata | EU (configurable region) |
| PromoteKit, Inc. | Affiliate program attribution tracking. Its script is loaded as soon as you arrive on the site, before any cookie choice, so that a visit coming from a partner link can be attributed (see the note under the cookie table) | Attribution cookie, visitor source, IP address | USA (SCCs) |
| Google LLC (Analytics) | Anonymized site audience measurement (only if you accept analytics cookies AND the tool is enabled in production) | Analytics cookie, anonymized IP, pages visited | USA (SCCs) |
| X Corp. (X Ads) | Conversion measurement for our advertising campaigns on X, and building X's advertising audiences (only if you accept advertising cookies) | X advertising cookies, advertising click identifier (twclid), IP address, user agent, page visited and referrer, plus the bare fact that a conversion event happened (sign-up, trial start, purchase). Those events are sent WITHOUT any parameter: no amount, no currency, no email address, no phone number, no account identifier | USA (SCCs) |
| Google LLC (Google Calendar) | Only if you connect your Google Calendar: reading your busy periods and creating the event for the meeting obtained (see section 11) | Busy periods of your calendar, created event (date, time, title, invitee) | USA (SCC) |
| Langfuse GmbH (optional) | LLM call observability (debugging, quality) | Model prompts and responses, pseudonymized user ID | EU (Germany) |
Data transferred outside the EU is protected by GDPR safeguards: Standard Contractual Clauses (SCCs) of the European Commission, or adequacy decisions. You can contact us to obtain a copy of the SCCs applicable to a given sub-processor.
6. Data Retention
- Account data: kept for the duration of Service usage + 12 months after account deletion
- Prospecting data: kept for the duration of the subscription
- Billing data: kept for 10 years (legal obligation)
- Technical logs: 12 months maximum
7. Your Rights (GDPR / CCPA)
Under the EU General Data Protection Regulation, and equivalent rights under the California Consumer Privacy Act for California residents, you have the following rights:
- Right of access: obtain a copy of your personal data
- Right to rectification: correct inaccurate data
- Right to erasure: request deletion of your data
- Right to portability: receive your data in a structured format (CSV)
- Right to object: object to the processing of your data
- Right to restriction: restrict processing in certain cases
- Right to opt out (CCPA): opt out of any "sale" or "sharing" of personal information. We do not sell personal data.
To exercise your rights, contact us at: hello@mimikflow.com. We will respond within 30 days.
8. Cookies
The Service uses several categories of cookies. Non-strictly-necessary cookies are only set after you grant consent via the banner shown on your first visit. You can change your preferences at any time via the "Manage cookies" link in the footer.
| Category | Cookie / Service | Purpose | Duration | Consent? |
|---|---|---|---|---|
| Strictly necessary | Supabase Auth (sb-*) | Maintain user session | Session + 1 year | Not required |
| Strictly necessary | mimikflow-locale, mimikflow-theme | Remember language (FR/EN) and theme (light/dark) | 1 year | Not required |
| Strictly necessary | mimikflow-cookie-consent | Remember your cookie choices so we don't re-prompt | 13 months | Not required |
| Analytics | Google Analytics (_ga, _ga_*), only if the tool is enabled in production | Anonymized audience measurement (anonymized IP) | 13 months | Yes |
| Marketing / Attribution | PromoteKit (promotekit_*) | Attribute visitors coming from an affiliate link | 30 days | Not currently collected (see the note below) |
| Marketing / Advertising | X Ads (X conversion pixel: twclid click identifier, X advertising cookies) | Measure conversions from our advertising campaigns on X and feed its advertising audiences | 13 months maximum | Yes |
X advertising pixel. It is only set after you explicitly consent to the advertising category, never before: the script is loaded only once that choice is recorded. If you withdraw that consent, the script is removed and the page is reloaded so that already-executed code stops running. Conversion events are sent with no parameter at all: X learns that a sign-up, a trial start or a purchase happened, never the amount, your email or your account identifier.
PromoteKit affiliate attribution. As an exception, this script is loaded as soon as you arrive on the site, before your choice is collected, so that a visit coming from a partner link can be attributed to that affiliate: without it, the partner's commission would be lost for every visitor who does not answer the banner. This is therefore not currently based on your consent, and the banner's "Advertising" switch does not control it. We state it here rather than presenting it as optional. To object to this cookie alone, write to hello@mimikflow.com or clear the site cookies from your browser.
No data is sold. You can refuse all optional cookies without affecting the functioning of the Service.
9. Security
We implement appropriate technical and organizational measures to protect your data: encryption in transit (HTTPS/TLS), secure authentication, per-user data isolation, and restricted database access.
10. Artificial Intelligence
The Service uses artificial intelligence models to generate personalized messages. Public LinkedIn profile data and the user's configuration data are transmitted to AI providers for content generation. No data is used to train our sub-processors' AI models (opt-out option enabled by default at Anthropic, OpenAI and OpenRouter).
11. Google User Data (connecting your Google Calendar)
If, and only if, you choose to connect your Google Calendar, MimikFlow accesses certain data from your Google account. This connection is optional: the Service works without it, and you can revoke it at any time.
What Google user data we access, and why:
- Your availability (busy / free): we read the busy periods of your calendar so that we only offer your prospects time slots that are genuinely free, and never create a double booking. We do not use the content of your existing events (title, attendees, description, location) for any other purpose.
- Creating the meeting event: once a prospect accepts a slot, we create a single event in your calendar for that meeting, with the prospect added as an invitee. We never modify or delete any other event.
- Reading back that event: we read only the meeting we created, in order to detect a cancellation or a time change and adapt the reminders sent to the prospect.
What we never do. Google user data obtained through this connection is never sold, never rented, never used for advertising or targeting, never transferred to a data broker, and never used to train any artificial intelligence model, whether ours or a third party's. No human at MimikFlow reads this data, except with your explicit consent to resolve an issue you reported to us, for security purposes, or where required by law.
Limited Use (Google API Services User Data Policy). MimikFlow's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Retention and deletion. Calendar data is not archived: availability is read at the moment a slot needs to be proposed and is not stored. We only store the access token required for the connection, plus the technical reference of the meeting we created, so that we can handle reminders and detect a cancellation. You can disconnect your calendar at any time from the Service settings, which deletes the token and ends all access. You can also revoke access directly from your Google account permissions page.
12. Prospect Data Processed on Behalf of the User (GDPR Article 14)
You are a prospect contacted via MimikFlow?
Your public professional data (name, role, company) was collected from LinkedIn by the user who messaged you, as part of B2B prospecting based on legitimate interest (GDPR Article 6.1.f).
To exercise your right to object, access or erase your data, write to unsubscribe@mimikflow.com or hello@mimikflow.com. We forward your request to the data controller within 7 days and block your profile in our systems.
This section concerns the LinkedIn prospects contacted via the Service, not the MimikFlow end user.
When a MimikFlow user runs a prospecting campaign, the Service collects publicly available information from LinkedIn profiles (name, role, summary, company). On that data:
- The MimikFlow user is the data controller (GDPR Article 4.7). They define the target and the purpose.
- MimikFlow acts as a data processor within the meaning of GDPR Article 28: we process this data only on the user's documented instructions, in the framework of these terms and our Terms of Service.
- This privacy policy, combined with our Terms of Service, constitutes a data processing agreement (DPA) within the meaning of GDPR Article 28.3. A standalone DPA can be signed on request for Enterprise accounts.
As data controller, the MimikFlow user must in particular:
- Ensure a valid legal basis (most often legitimate interest for B2B prospecting, GDPR Art. 6.1.f)
- Inform prospects in accordance with GDPR Article 14 (information at indirect collection)
- Honor prospects' right to object and provide them with a simple opt-out
- Comply with LinkedIn's Terms of Service and applicable anti-spam laws (GDPR, CAN-SPAM, CASL, etc.)
If you are a prospect contacted via MimikFlow and wish to exercise your rights (access, objection, erasure), please first contact the user who reached out to you. You can also write to us at hello@mimikflow.com and we will relay your request to the relevant user within 7 days at most.
13. Complaints
If you believe that the processing of your data constitutes a GDPR violation, you can file a complaint with the French data protection authority (CNIL): www.cnil.fr. California residents may also contact the California Attorney General.
14. Changes
This policy may be updated. Material changes will be communicated by email. The date of the last update is shown at the top of this page.
15. DPO Contact
For any question regarding the protection of your data: hello@mimikflow.com