Skip to content
MikabotMikabot logo overlayMikabot

Privacy Policy

Last updated: June 2026

1. Introduction

This Privacy Policy explains how Studio Mikado, a company registered in Belgium ("Studio Mikado", "we", "us"), collects, uses, stores, and protects personal data when you use Mikabot, including the website, web application, dashboard, API, and chatbot widget.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), Belgian data protection law, and other applicable privacy legislation.

This policy should be read together with our Terms of Use and Cookie Policy.

2. Data Controller

The data controller for personal data processed through the website and Mikabot service is:

Studio Mikado
Belgium
Email: [email protected]
Website: mikabot.chat

If you are a store owner who installs Mikabot on your own website, you are the controller for your visitors' personal data. Studio Mikado processes that data as your processor.

3. Personal Data We Process

3.1 Account and Billing Data

  • Name, email address, language preference, and account settings
  • Hashed passwords, subscription details, and billing history
  • Mollie customer and subscription identifiers for payments

3.2 Store, Product, and Chatbot Data

  • Store name, URL, configuration, and branding
  • Product catalog data such as names, descriptions, prices, images, and categories
  • Chatbot instructions and settings

3.3 Conversation Data

  • Chat messages between visitors and the chatbot
  • Session identifiers, timestamps, and detected language
  • Personal data a visitor voluntarily shares in a conversation

3.4 Technical and Analytics Data

  • IP address, anonymised or truncated where possible
  • Browser, device, operating system, pages visited, referring URL, and access time
  • Aggregated website analytics and session insights through Google Analytics 4 and Microsoft Clarity when analytics is active

4. Purposes and Legal Bases

Purpose Legal basis
Providing the service, managing accounts, and operating chatbot functionality Performance of a contract (Art. 6(1)(b) GDPR)
Processing payments and managing subscriptions Performance of a contract (Art. 6(1)(b) GDPR) and legal obligation (Art. 6(1)(c) GDPR)
Security, fraud prevention, and troubleshooting Legitimate interest (Art. 6(1)(f) GDPR)
Website analytics, heatmaps, and session insights through Google Analytics 4 and Microsoft Clarity in regions where consent is required Consent (Art. 6(1)(a) GDPR)
Marketing communications Consent (Art. 6(1)(a) GDPR)

5. AI Processing

Mikabot uses third-party AI models, including OpenAI, to generate chatbot responses. Conversation messages and relevant product data may be sent to these providers to generate a response. We do not use your personal data or conversation data to train AI models.

6. Recipients and Processors

We do not sell personal data. We may share personal data with service providers that may process it only on our instructions:

  • Hosting provider - infrastructure and storage, primarily in the EU
  • OpenAI - AI-powered chatbot responses
  • Mollie - payments and subscriptions
  • Mailgun or Resend - transactional email
  • Google Tag Manager - website tag management
  • Google Analytics 4 - website analytics
  • Microsoft Clarity - heatmaps, session insights, and usage analytics

7. International Transfers

We store data primarily within the European Economic Area. Where personal data is processed outside the EEA, we use appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or data processing agreements with supplementary measures.

8. Retention

  • Account data: retained while your account is active, then deleted or anonymised unless longer retention is required by law.
  • Billing data: retained according to Belgian tax and accounting retention periods.
  • Conversation data: retained while the store owner's account is active unless deleted earlier.
  • Analytics data: retained in aggregated or pseudonymised form according to the Google Analytics and Microsoft Clarity settings.

9. Your Rights

You have the right of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You can exercise these rights by contacting [email protected].

10. Complaints

You may lodge a complaint with the Belgian Data Protection Authority at www.gegevensbeschermingsautoriteit.be, or with the supervisory authority in your EU Member State.

11. Contact

Questions about this Privacy Policy can be sent to [email protected].