At Miranda Network SL we take privacy seriously. This Privacy Policy explains how we collect, use, disclose and safeguard personal data when you use MakeRVN, our mobile-app attribution and analytics platform, and our related websites and services. It is designed to comply with the EU General Data Protection Regulation (“GDPR”), Spanish data-protection law and the California Consumer Privacy Act as amended (“CCPA/CPRA”).

1. Who we are

The data controller for the personal data described in this policy is Miranda Network SL, registered office at Granadilla de Abona, Santa Cruz de Tenerife, Spain, registered with the Registro Mercantil de Santa Cruz de Tenerife under tax identification number B75866194. For attribution and event data that our customers process through the Service on behalf of their own end users, our customer is the controller and we act as a processor; see our Data Processing Agreement.

2. Scope

This policy applies to: (a) visitors to our websites; (b) representatives of our customers and prospects who interact with us; and (c) personal data we process when providing the Service. It does not cover third-party websites, apps or ad platforms that you choose to use, which have their own privacy policies.

3. Information we collect

Account & contact data

Name, work email address, company, password (stored hashed), workspace settings, billing contact details and support correspondence.

Usage & device data

Log data, dashboard interactions, feature usage, approximate location derived from IP, and technical information such as browser type and device characteristics, used to operate and secure the Service.

Attribution & measurement data

To deliver our core service we process device-level attribution data on behalf of our customers, which may include:

Click identifiers passed by ad platforms, such as fbclid and ttclid, and campaign, channel and creative parameters.
IP address and user-agent, used for probabilistic matching of clicks to installs and for fraud prevention.
Device, session and app event metadata, install timestamps and deep-link data.
Subscription and purchase events, including events received via RevenueCat, to attribute revenue to campaigns.

Billing data

Subscription tier, usage metrics and invoices. Payment card details are collected and processed directly by our payment processor, Stripe; we do not store full card numbers.

4. How we use personal data

To provide, operate, maintain and secure the Service and your account.
To perform attribution, measurement and analytics, and to forward conversion events to advertising platforms as configured by our customers.
To process payments, manage subscriptions and prevent and detect fraud and abuse.
To provide customer support and to communicate service and security notices.
To improve and develop the Service, including aggregated and de-identified analytics.
To comply with legal obligations and to establish, exercise or defend legal claims.

5. Legal bases under the GDPR

We rely on the following legal bases for processing personal data:

Performance of a contract— to provide the Service to you and administer your account and billing.
Legitimate interests— to secure, improve and market the Service, prevent fraud, and ensure measurement integrity, balanced against your rights.
Consent— for non-essential cookies and certain communications, and where end-user consent is required for attribution; where consent applies, you may withdraw it at any time.
Legal obligation— to comply with accounting, tax and other legal requirements.

We do not sell personal data. We share personal data only as needed to provide the Service and with the following categories of recipients, each bound by appropriate contractual safeguards:

Infrastructure & database: Supabase, for application hosting, authentication and data storage.
Payments: Stripe, for subscription billing and payment processing.
Advertising platforms:Meta, Google, TikTok and similar networks, to which conversion events are forwarded via their server-side conversions APIs at our customers’ instruction.
Hosting, analytics & operational tools: providers that help us run, monitor and support the Service.
Professional advisers and authorities: where required by law or to protect our rights.

A current list of sub-processors used to process customer personal data is maintained in our Data Processing Agreement.

7. International transfers

Some recipients are located outside the European Economic Area, including in the United States. Where we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (“SCCs”) and supplementary measures, or on an adequacy decision where one applies.

8. Data retention

We retain personal data only for as long as necessary for the purposes described in this policy. Account data is retained for the life of your account and for a reasonable period afterwards; attribution and event data are retained according to your plan’s retention settings and our customers’ instructions; billing records are kept as required by tax and accounting law. When data is no longer required, we delete or anonymize it.

9. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict and object to processing of your personal data, and to data portability. Where processing is based on consent, you may withdraw consent at any time. You may also lodge a complaint with a supervisory authority — in Spain, the Agencia Española de Protección de Datos (AEPD).

You can exercise your right to erasure yourself at any time: from Settings → Profile → Delete account we permanently delete your account, the organizations you solely own (including their apps, tracking links, clicks, devices and events), and cancel any active subscription. Records we must retain for legal or tax reasons (e.g. invoices) are kept only for the period required by law.

If you are a California resident, you have the right to know, access and delete your personal information, to correct inaccurate information, and to opt out of the sale or sharing of personal information. We do not sell personal information. To exercise any right, contact us using the details below; we will not discriminate against you for exercising your rights. Where we process personal data on behalf of a customer, please direct requests to that customer and we will assist them as their processor.

10. Cookies

We use cookies and similar technologies on our websites and dashboard. For details on what we use and how to manage your preferences, see our Cookie Policy.

11. Security

We implement technical and organizational measures designed to protect personal data, including encryption in transit and at rest, access controls and monitoring. Learn more on our Security page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Children

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified through the Service or by email, and the “last updated” date above will be revised. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

14. Contact & Data Protection Officer

For privacy questions or to exercise your rights, contact us at makervn@mirandanetwork.es. You can reach our Data Protection Officer at makervn@mirandanetwork.es, or write to Miranda Network SL, Granadilla de Abona, Santa Cruz de Tenerife, Spain.