This Privacy Policy explains how Equals One Ventures Sdn. Bhd. (“Mida”, “we”, “us”) collects and uses personal data when you visit www.mida.so, sign up for Mida, or use our services as a customer.
1. Who We Are
Equals One Ventures Sdn. Bhd. (1379015-X)
7-2, Plaza Danau 2, Jalan 2/109F, Taman Danau Desa, 58100 Kuala Lumpur, Malaysia
Privacy contact: donald@mida.so or privacy@mida.so
2. Our Two Roles
Mida as controller. We decide how and why the personal data described in this policy is used. This covers people who visit mida.so, sign up for Mida, use the Mida dashboard, or act as billing or support contacts for our customers.
Mida as processor. When our customers run A/B tests on their own websites, Mida processes data about their website visitors on the customer’s behalf. That processing is governed by the customer’s own privacy policy and by our Data Processing Agreement (DPA), not by this policy. If you visited a website that uses Mida and have a question about your data, please contact the owner of that website.
3. Personal Data We Collect
- Account data: name, business email address, company name, role, and login details for you and your team members.
- Billing data: billing contact details, company address, VAT number and invoice history. Card details are entered directly with our payment providers, and we never see or store them.
- Support data: the content of your messages to our support team.
- Usage data: how you use the Mida dashboard, such as features used, log-in times, and device and browser information.
- Website data: when you visit mida.so, the data described in Section 9.
- Marketing data: your email address and how you interact with our emails, such as opens and clicks.
4. How We Use Your Data and Our Legal Bases
- Creating and managing your account and providing the services: performance of a contract (Art. 6(1)(b) GDPR).
- Billing, invoicing and payment processing: performance of a contract (Art. 6(1)(b) GDPR).
- Keeping invoices and accounting records: legal obligation (Art. 6(1)(c) GDPR).
- Answering support requests: performance of a contract (Art. 6(1)(b) GDPR).
- Sending service emails, such as security notices and changes to the services: performance of a contract and legitimate interest (Art. 6(1)(b) and (f) GDPR).
- Sending product updates, tips and offers to people who have signed up: legitimate interest in promoting similar services to our users (Art. 6(1)(f) GDPR). You can unsubscribe at any time from any email.
- Improving our website and services using usage statistics: legitimate interest (Art. 6(1)(f) GDPR).
- Protecting our forms and services from abuse and fraud: legitimate interest (Art. 6(1)(f) GDPR).
- Complying with legal requests and enforcing our terms: legal obligation and legitimate interest (Art. 6(1)(c) and (f) GDPR).
5. Who We Share Your Data With
We do not sell your personal data. We share it only with the service providers that help us run Mida, under data processing agreements:
- Google Cloud Platform: hosting and data storage (United States, Germany)
- Cloudflare: DNS and bot protection (global)
- Netlify: dashboard web hosting (United States)
- Auth0: login and single sign-on (United States)
- Google Firebase: login (United States)
- Customer.io: service and marketing emails (United States)
- Mailgun: transactional email (United States)
- Intercom: customer support (United States)
- ChartMogul: subscription analytics (Germany)
- Plausible: website analytics (Germany)
- Stripe: payment processing (United States)
- Paddle: merchant of record and billing (United Kingdom)
- Lemon Squeezy: merchant of record (United States)
Where Paddle or Lemon Squeezy act as merchant of record for your purchase, they process your payment data as independent controllers under their own privacy policies.
We may also share personal data:
- with professional advisers, such as lawyers and accountants;
- with authorities where the law requires it; and
- with a buyer or successor if Mida is involved in a merger or acquisition, in which case this policy continues to apply to your data.
6. International Transfers
Our team is based in Malaysia, and several of our service providers are based in the United States and the United Kingdom. When personal data from the EU or the UK is transferred to a country without an adequacy decision, we use the European Commission’s Standard Contractual Clauses (and the UK Addendum for UK data). For US providers certified under it, we rely on the EU-US Data Privacy Framework. The Standard Contractual Clauses are published by the European Commission on EUR-Lex.
7. How Long We Keep Your Data
- Account and usage data: while your account is active, and deleted within 90 days after it is closed.
- Support conversations: 24 months after the conversation is closed.
- Invoices and billing records: 7 years, as required by tax and accounting law.
- Marketing data: until you unsubscribe. We then keep your email address on a suppression list so that we do not email you again.
- Experiment data processed for customers: on paid plans, for as long as the subscription is active, unless the customer asks us to delete it sooner. On the free plan, including after a paid subscription ends, results can be viewed for 60 days after the experiment ends, and raw event data is deleted after 18 months. Customers can ask us to delete their data at any time. See our DPA for details.
After these periods, we delete the data or make it anonymous so that it can no longer identify you.
8. Your Rights
If you are in the EU, the UK, or another region with similar laws, you have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- have your data deleted;
- restrict or object to our processing, including objecting to direct marketing at any time;
- receive your data in a portable format;
- withdraw your consent where we rely on it, without affecting earlier processing; and
- lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.
To use any of these rights, email donald@mida.so or privacy@mida.so. We will reply within one month.
9. Cookies and Similar Technologies on mida.so
- Plausible: cookie-free website analytics. It does not use cookies or collect personal data.
- Cloudflare Turnstile: protects our sign-up and other forms from automated abuse. Turnstile runs silently in the background. You are not asked to solve a puzzle or tick a box, and in most cases you will not see anything at all. To tell real visitors apart from bots, Turnstile processes a limited set of technical signals from your browser: your IP address, TLS fingerprint, User-Agent header, and the site key of the form you are using together with its origin. Cloudflare processes these signals on our behalf to protect our forms, and separately as its own controller to improve its bot detection. Cloudflare's handling of this data is described in its Turnstile Privacy Addendum.
- Support chat (Intercom): if you choose to open our chat, Intercom sets the cookies needed to run it and remember your conversation.
- A/B testing (Mida): we use our own product to improve mida.so. It stores a random, pseudonymous identifier on your device so that you see the same version of a page on each visit.
10. Security
Mida is certified to ISO/IEC 27001:2022. We protect personal data with measures such as encryption in transit and at rest, access controls based on job need, and regular independent penetration tests.
11. Children
Mida is a business service and is not directed at children under 16. We do not knowingly collect their personal data.
12. Automated Decision-Making
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
13. California Residents
We do not sell or share personal information as these terms are defined under the California Consumer Privacy Act. California residents may exercise their rights by emailing donald@mida.so or privacy@mida.so.
14. External Links
Our website may link to external sites that are not operated by us. We have no control over the content and practices of these sites and are not responsible for their privacy policies.
15. Changes to This Policy
We may update this policy from time to time. We will post the new version on this page and update the effective date. If the changes are significant, we will notify customers by email.
16. Contact
For any questions about this policy or your personal data, contact us at donald@mida.so or privacy@mida.so.
This policy is effective as of 16 October 2026.
