Privacy policy

Mivva is owned and run by One Rectangle Limited. For the purposes of UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the controller of your personal data. That means we decide how and why it is used, and we are responsible for looking after it.

• Company: One Rectangle Limited, registered in England and Wales
• Company number: 15416016 (opens in a new tab) (Companies House)
• Registered office: 82a James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE
• ICO registration: ZC254045 (opens in a new tab)
• Email: hello@orlimited.com
• Website: orlimited.com (opens in a new tab)

We are not required to appoint a Data Protection Officer. Our privacy contact is the email address above, and messages sent there are read by the people who run One Rectangle Limited.

This policy explains how we handle personal data when you visit the Mivva website, create an account, use the Mivva app or contact us.

It does not cover Amazon KDP, IngramSpark, Lulu or any other website we link to. When you upload a book to a platform, that platform handles your data under its own privacy notice.

Information you give us

• Account details: your email address and a password. Your password is stored scrambled (hashed) by our sign-in provider, so nobody at Mivva can read it. We create a display name from the first part of your email. Before you can use your account, we email you a link to confirm the address is yours.
• Author name: the name you put on a book, which may be your real name or a pen name. We remember the last one you used so the next book starts with it filled in.
• What you create: research questions and filters, book ideas, concepts, page plans, page instructions, generated pictures, covers, PDFs and listing text. This is mostly business information rather than personal data, but it becomes personal data if you type personal details into it.
• Chats with Mivva: what you type or paste when you plan a book with Mivva, including any story you paste in. We keep it with the book so you can carry on later, and delete it with the book.
• A book idea from the home page: if you type an idea into the box on our home page and press Start my book, we keep it in a cookie in your browser, and with your new account if you sign up, only until the New book screen has shown it to you. Then we delete it. It lasts no more than a day in the cookie.
• Character photos: if you choose to add a photo of a person, pet, toy or drawing as a book character. Before a photo of a person is saved, you confirm that you own it and have permission from the person in it, or from their parent or guardian. We remove the hidden data phones add to photos, such as the location and camera, before storing it. Photos stay private to your workspace and are only used to draw that book.
• Messages: anything you send us by email, including your name and email address.

Information created when you use Mivva

• Security and audit records: when you sign up, sign in, sign out and take key actions, such as approving a concept, with the time it happened. The sign-up record includes your email address. When our staff take an action on your account, such as adding tokens or suspending it, we record who did it, when and why.
• Usage and cost records: which features ran, how much was used and what it cost, so we can show estimates and plan fair prices.
• Wallet and payment records: each top up, the amount paid, the tokens added and spent, the reference Stripe gives each payment, and your Stripe customer reference, which links any cards you save to your account. We use these to show your balance and handle refunds.
• Technical data: your IP address, browser and device type, recorded in the request logs of our hosting and sign-in providers. When you open the payment form, Stripe also collects device details to spot fraud, and the form loads a font from Google Fonts, which sees your IP address.
• Technical logs: when you use Mivva or something goes wrong, our hosting and database providers record technical details, which can include your IP address.

Public marketplace data

Research gathers publicly available product listings and search results from Amazon and Google. We keep product-level facts, such as titles, prices, ratings and review counts, and summarised buyer themes. We do not collect reviewer names or profiles.

What we do not collect

• Your Amazon or KDP password, or access to your KDP account.
• Payment card details. The payment form on our wallet page is served by Stripe, so your card number, expiry date and security code go straight to Stripe and never reach our servers. Stripe handles them under its privacy policy (opens in a new tab). We only receive a payment reference, the amount and whether the payment went through.
• Special category data, such as health, religion or ethnicity. We do not ask for it, so please do not add it to your workspace.

UK law says we must have a lawful reason, called a lawful basis, for each way we use personal data. These are ours.

Contract means we need the data to provide the service you signed up for. Legitimate interests means we have a genuine business reason that does not override your rights, such as keeping accounts secure. You can ask for a copy of our assessment of those interests. Legal obligation means the law requires it.

We do not send marketing emails. If that changes, we will only send them with your consent, and every one will include a one-click way to stop.

When you top up your wallet, you pay in a form that appears on our wallet page but is run by Stripe, a regulated payment provider certified to the highest card security standard (PCI DSS Level 1). We sell the tokens and Stripe processes the payment. Stripe checks each payment for fraud using details about the payment and your device.

• Saving a card is your choice. The form offers to save your card for your next top up. If you tick it, Stripe stores the card and gives us a customer reference so it can show your saved card next time. We never see or store the card number.
• We never charge a saved card on our own. A saved card is only used when you start a top up and confirm the amount.
• Other ways to pay. If you pay with Apple Pay, Google Pay or Stripe's Link, Apple, Google or Stripe also handle the payment under their own privacy policies.
• Removing a saved card. Email hello@orlimited.com from the address on your account and we will ask Stripe to delete it. We do the same when you close your account.

Mivva uses AI providers to summarise research, suggest ideas, write listing text and draw pages. To do this we send them the text you enter, such as your research question or a page instruction, together with instructions we write. When drawing pages, we may also send earlier pictures from the same book, so characters look the same from page to page. We do not send your email address, password or account details.

If you add a character photo, we send it to the AI provider that writes a short description of how the character looks, and to the picture service that draws your book (OpenAI, Google or Recraft, whichever you choose), so the character looks the same on every page. Photos are never sent to analytics tools or written to our logs.

Under their business terms, OpenAI and Anthropic do not use data sent through their APIs to train their models. They may keep it for a limited period to detect misuse, under their own policies.

We do not use your books, prompts or files to train AI models.

Title research results and quality checks are worked out automatically from market data and your pages. They are guidance about markets and books, not decisions about you. Mivva does not make decisions about people based solely on automated processing that have legal or similarly significant effects.

We use trusted providers, called processors, to run Mivva. They only act on our instructions, under written contracts that require them to keep your data secure and confidential. Stripe is a processor when it takes payments for us, but it also uses some payment information for its own fraud prevention and legal duties, as a separate controller under its own privacy policy.

Canva and Amazon Ads connections are planned but not live. We will update this policy before any of them go live, and they will only receive data if you choose to connect them.

Other Mivva users, only if you share a book. Books are private by default. If you share one on the Community shelf, other signed-in Mivva users can see its title, subtitle, pen name, kind, age range, length, short description, cover and some of its page pictures. They cannot see your email, your account or your other books, and a pen name is not linked to your account. If the author name on the book is your real name, they will see it, so use a pen name if you prefer. Books drawn from photos of real people cannot be shared. Take a book off the shelf at any time in its settings.

We may also share personal data:

• with professional advisers, such as lawyers and accountants, under a duty of confidentiality
• with the police, regulators or courts where the law requires it, or to protect people from harm
• with a buyer or successor if all or part of our business is sold or reorganised, who must treat it in line with this policy

We do not sell your personal data, and we do not share it with advertisers.

Some of our providers store or process data outside the UK, mainly in the United States and some in the European Economic Area. When personal data leaves the UK, we protect it with one of these safeguards, depending on the provider:

• the ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, included in the provider's data processing terms. Most of our US providers rely on these.
• UK adequacy regulations. These cover the European Economic Area and US organisations certified under the UK Extension to the EU-US Data Privacy Framework.

You can ask us which safeguard applies to any provider, and for a copy of it. We may remove commercially sensitive parts.

We keep personal data only for as long as we need it for the reasons in this policy.

Shared research results, such as cached Amazon search data, contain product information rather than personal data and expire automatically.

• All connections to Mivva are encrypted in transit (HTTPS), and our database and file storage are encrypted at rest.
• Each workspace is walled off at database level, so one account cannot read another account's books.
• Your files sit in private storage and are shown through short-lived links that expire.
• Passwords are hashed, service keys stay on our servers, and we strip secrets out of our logs.
• You confirm your email address before your account can be used, and you are signed out automatically after 24 hours without activity, so a forgotten session cannot be used to spend your tokens.
• Card details never reach our servers. Stripe handles them.
• Access to production systems is limited to the people who need it. A small number of authorised staff can use an admin panel to help with support and keep Mivva safe, for example to see an account's email and token balance, add or remove tokens, send a password reset email, or suspend or delete an account. Each admin only gets the permissions they need, and every admin action is recorded.

If a breach puts your data at risk, we will report it to the ICO within 72 hours where the law requires, and tell you without undue delay if it is likely to cause you high risk.

Under UK data protection law you have the right to:

• access your personal data and get a copy
• correct data that is wrong or incomplete
• delete your data, including closing your account
• restrict how we use your data while a concern is looked into
• move your data, by receiving it in a common, machine-readable format
• object to uses based on legitimate interests, and to direct marketing at any time
• withdraw consent where we rely on it, without affecting anything done before
• not be subject to decisions based solely on automated processing that significantly affect you

To use any of these rights, email hello@orlimited.com from the address on your account. It is free. We will reply within one month. If a request is complex, we may extend this by up to two more months and will tell you why within the first month. We may ask you to confirm your identity before acting, to protect your account.

If you are unhappy with how we have handled your data, please tell us first at hello@orlimited.com. We will acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection:

• Online: ico.org.uk/make-a-complaint (opens in a new tab)
• Phone: 0303 123 1113
• Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Mivva is for adults. You must be 18 or over to create an account, and the service is not designed for children. If we learn that someone under 18 has an account, we will close it and delete their data.

Many books made in Mivva are for children. Only add a photo of a real child as a book character if you are their parent or guardian, or have their parent or guardian's permission. Mivva asks you to confirm this before the photo is saved. You can remove a character at any time, and the photo is deleted straight away. Deleting the book deletes its photos too.

Mivva never asks for your password for Amazon KDP, IngramSpark, Lulu or any other platform, and does not connect to those accounts. You download your files and upload them yourself. What happens after that is between you and the platform, under its own terms and privacy notice.

Mivva only uses essential cookies: to keep you signed in, to sign you out after 24 hours without activity, and Stripe's fraud-prevention cookies when you open the payment form. There are no analytics or advertising cookies. Our cookie policy lists each one.

We will update this policy when Mivva changes, for example when new features or connections launch. The date at the top shows the latest version. If a change significantly affects how we use your data, we will email you before it takes effect.

For anything about this policy or your data, email hello@orlimited.com, or write to One Rectangle Limited at the registered office above. We aim to reply within 2 working days.