Privacy Policy

1. Who is responsible for your data

The controller of your personal data is Miyav, Baku, Azerbaijan (“Miyav”, “we”, “us”). You can reach us about any privacy question at privacy@miyav.site.

We are not currently required to appoint a Data Protection Officer. If we start offering the service to people in the European Union at scale, we will appoint a representative in the EU under Article 27 of the GDPR and list their details here. Until then, please contact us at privacy@miyav.site.

2. What data we collect

We collect the data you give us, the data created when you use Miyav, and a small amount of technical data. We do not buy data about you from other companies.

• Account data: your name, email address, phone number (confirmed with an SMS code), Baku district, preferred language, an optional profile photo and your password. We store the password only as a one-way bcrypt hash, never in readable form.
• Pet data: your pet's name, species, breed, size, age, care notes and an optional photo.
• Sitter profile data: headline, bio, services and prices, district, experience, photos, availability calendar, and the rating and reviews you receive.
• Sitter verification data: photos of your identity document and your answers to a pet-care quiz. Staff review the documents, and we delete them after the decision. We keep only the outcome (approved or not approved).
• Booking data: booking requests and their status, dates, services, prices, visit and walk reports (photos, notes and duration), reviews, disputes, abuse reports and users you have blocked.
• Messages: what you write in the in-app chat. Before a booking is confirmed, contact details in messages may be hidden automatically.
• Payment data: payment status, amounts, the last 4 digits of your card and reference numbers from the payment provider. You enter your card details on the payment provider's page. Miyav never sees or stores your full card number.
• Payout data (sitters): a card token and the last 4 digits of the card, or your IBAN. We store the IBAN encrypted.
• Technical data: your IP address and browser information in our server security logs, and data used to limit repeated login attempts.
• Cookies: only the strictly necessary cookies described in our Cookie Policy.

3. Why we use your data and our legal bases

Where the EU or UK GDPR applies, we must have a legal basis for each use of your data. We use your data only for the purposes below.

We do not use your data for automated decisions or profiling that have legal or similarly significant effects on you. Staff, not algorithms, decide on sitter verification.

• To create and run your account, show sitter profiles, handle bookings, payments, payouts, messages, visit reports and reviews. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).
• To keep financial, accounting and tax records. Legal basis: legal obligation (Article 6(1)(c) GDPR).
• To keep the service safe: security logs, login rate limiting, fraud prevention, sitter verification, moderation of content, reviews, disputes and abuse reports. Legal basis: our legitimate interest in a safe and trustworthy marketplace (Article 6(1)(f) GDPR).
• To send you service messages about your account and bookings by email, SMS and in-app notification. Legal basis: performance of our contract with you.
• Optional data, such as profile and pet photos, where we ask for your consent. Legal basis: consent (Article 6(1)(a) GDPR). You can withdraw consent at any time by removing the data; this does not affect earlier use.

4. Who we share your data with

We share personal data only where needed to run the service, and only with:

• The other party of your booking: a sitter sees the details of your pet and your first name; contact details are shared after the booking is confirmed. An owner sees the sitter's profile and the visit reports.
• Our hosting provider, which stores the website and database in a data centre.
• Our payment provider, which processes card payments and payouts.
• Our SMS provider, which delivers verification codes and booking messages.
• Our email delivery provider, which delivers service emails.
• Public authorities, courts or law enforcement, when the law requires us to.
• A buyer or successor, if Miyav is ever reorganised, merged or sold, under the same protections described here.

5. What is public

Sitter profiles are public: anyone visiting miyav.site can see a sitter's name as shown on the profile, headline, bio, services and prices, district, experience, photos, availability, rating and reviews.

Reviews written by owners are shown on the sitter's profile. Please do not include private information in reviews or profile texts.

6. We do not sell your data

We do not sell personal data, and we do not “share” it for cross-context behavioural advertising, as those terms are defined in US state privacy laws. We do not use advertising or tracking cookies, and we do not let third parties track you on miyav.site.

Our service providers (processors) may use your data only to provide their service to us, under written contracts.

7. International transfers

Your data may be stored or processed outside the country where you live, for example by our hosting, payment, SMS or email providers.

Where the GDPR applies, we transfer data outside the European Economic Area only to countries with an adequacy decision of the European Commission, or under the Standard Contractual Clauses approved by the Commission, with additional safeguards where needed. You can ask us for a copy of these safeguards at privacy@miyav.site.

8. How long we keep your data

We keep data only as long as we need it:

• Account and profile data: until you delete your account.
• After account deletion: your profile is anonymised and your pets, photos and profile picture are removed. Booking, payment and ledger records are kept as long as accounting and tax law requires, typically 5 years.
• Sitter verification documents: deleted after the verification decision; only the outcome is kept.
• In-app notifications: 12 months.
• SMS delivery log: 6 months.
• Server security logs (IP address, browser information): 14 days.

9. How we protect your data

No system is perfectly secure. If a personal data breach happens, we will notify the competent supervisory authority within 72 hours where the GDPR requires it, and inform affected users without undue delay when the breach is likely to put them at risk.

• HTTPS encryption on every page, with HSTS.
• Passwords are stored as bcrypt hashes and checked against lists of known breached passwords.
• Staff accounts are protected with two-factor authentication.
• Sensitive fields, such as IBANs, are encrypted at rest.
• Access to personal data is limited to staff who need it for their work.
• Rate limiting protects logins and other sensitive actions against abuse.

10. Your rights

Depending on where you live, including under the GDPR and the Azerbaijani Law “On Personal Data”, you have the following rights:

To use a right that has no button in your account, email us at privacy@miyav.site. To protect your account, we will verify your identity before acting on a request, usually by asking you to write from the email address of your account or to confirm a code. We aim to answer within 30 days. Where the GDPR applies, we answer within one month at the latest; for complex requests this can be extended by two more months, and we will tell you if so. Using your rights is free of charge.

If you think we handle your data unlawfully, you can complain to a supervisory authority. In the EU, this is the data protection authority of your country of residence, work or of the alleged infringement. In Azerbaijan, you can contact the relevant state authority responsible for personal data protection. We would appreciate the chance to resolve your concern first at privacy@miyav.site.

• Access and copy: get a copy of your data. You can download it yourself in JSON format with “Download my data” in Account settings.
• Rectification: correct inaccurate data. You can edit most data yourself in your profile.
• Erasure: delete your data with “Delete my account” in Account settings. Deletion is not possible while a booking is active, and some records are kept as required by law (see “How long we keep your data”).
• Restriction: ask us to limit the use of your data, for example while we check a complaint.
• Objection: object to uses based on our legitimate interests.
• Portability: receive your data in a structured, machine-readable format (the JSON download).
• Withdraw consent: at any time, for uses based on consent, without affecting earlier use.

11. Notice for US residents

This section adds information required by the California Consumer Privacy Act as amended by the CPRA and similar US state privacy laws. In the last 12 months we have collected the following categories of personal information, from you, from other users (for example reviews and messages), from our payment provider and automatically from your device:

We use these categories for the purposes in “Why we use your data” and disclose them only to the recipients in “Who we share your data with”. We keep each category for the periods in “How long we keep your data”. We do not sell or share personal information, and we have no actual knowledge of selling or sharing personal information of consumers under 16.

You have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing (we do neither); and to limit the use of sensitive personal information. We use sensitive personal information (identity documents) only to verify sitters, which is a permitted purpose, so there is nothing to limit. We will not discriminate against you for using any of these rights, for example by denying the service or charging different prices.

You can use your rights through Account settings or by emailing privacy@miyav.site. You can also use an authorised agent; we will ask for written permission signed by you and may ask you to verify your identity directly. Under US state laws we respond within 45 days; if we need more time, we can extend this by another 45 days and will tell you why.

If we decline your request, you can appeal by writing to privacy@miyav.site with the subject “Privacy appeal”. We will reply in writing within the time required by your state's law and explain our decision. If you are not satisfied, you can contact your state Attorney General.

• Identifiers: name, email address, phone number, IP address, account ID.
• Customer records: payment references, last 4 digits of cards, IBAN for sitters.
• Commercial information: bookings, prices, fees, refunds and payouts.
• Internet or network activity: security logs and login attempts.
• Audio or visual information: profile, pet and visit report photos.
• Professional information (sitters): experience and services.
• Sensitive personal information: identity document photos (sitters only, deleted after the decision) and account login credentials.

12. Your privacy choices

Miyav does not sell your personal data, does not share it for cross-context behavioural advertising and does not use tracking or advertising cookies. This means there is nothing you need to opt out of.

We honour Global Privacy Control (GPC) signals. If your browser sends a GPC signal, we treat it as a valid request to opt out of sale and sharing, even though we do not sell or share data.

You stay in control of your data in Account settings: edit your profile, remove optional photos, download your data or delete your account. For anything else, write to privacy@miyav.site.

13. Emails, SMS and notifications

We send only transactional messages that are needed for the service: SMS verification codes, and email, SMS and in-app notifications about your account and bookings. We do not send marketing messages.

If we ever add marketing emails or SMS, we will send them only with your prior opt-in consent, every marketing email will include an unsubscribe link and our postal address, and you will be able to opt out at any time.

Your mobile carrier may charge standard message and data rates.

14. Children

Miyav is only for people aged 18 or over. The service is not directed at children, and we do not knowingly collect personal data from children under 13 (as defined by the US COPPA) or under 16.

If we learn that an account belongs to a minor, we will delete it. If you believe a child has given us personal data, please contact privacy@miyav.site.

15. Changes to this policy

We may update this policy when our service or the law changes. We will show the date of the latest update at the top. If we make important changes, we will tell you by email or in the app before they take effect.

16. Contact

For questions, requests or complaints about privacy, contact Miyav, Baku, Azerbaijan, email privacy@miyav.site.