Privacy Policy

Effective date: 29 March 2026 · Version: 1.0

This Privacy Policy describes how personal data is processed in connection with the Smart Find & Replace Miro application, related website, and supporting infrastructure (together, the “Service”). The Service helps users find and replace text on Miro boards, with optional advanced features such as pattern matching and AI-assisted suggestions where available and enabled.

1. Data controller

The operator of the Service is the data controller for the personal data described in this Policy. Legal name, registration details, and a dedicated privacy contact will be added here when confirmed.

References to “we”, “us”, and “our” mean that operator.

We aim to comply with applicable data protection law, including where relevant the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and related requirements.

2. Scope

This Policy applies to:

Visitors to our marketing website;
Users who install or use the Smart Find & Replace app inside Miro;
Interactions with our server-side components that support the Service (for example, API routes used for optional features).

It does not govern Miro’s own platform; Miro processes personal data under Miro’s policies. Where we only process data on Miro’s behalf as a processor, Miro’s instructions and agreement apply in addition to this Policy.

3. Categories of personal data

Depending on how you use the Service, we may process the following categories of information:

Category	Examples	Purpose (summary)
Miro / board content you choose to process	Text in stickies, shapes, cards, frames, or other supported widgets that you search, preview, or replace	Provide find-and-replace, preview, undo, and related in-app functionality
Optional AI / semantic features	Text snippets or derived representations sent to AI or embedding endpoints when you enable those features	Provide optional smart matching, suggestions, or similar features only where you opt in and your tier allows it
Technical and usage data	IP address, browser or client identifiers, timestamps, diagnostic logs, approximate location from IP	Operate, secure, and improve the Service; detect abuse; comply with law
Support and communications	Email address, message content, metadata you send us	Respond to enquiries and provide support
Billing (Smart Pro)	Name, email, payment-related identifiers processed by our payment provider	Process subscriptions or payments where offered

We do not require you to create a separate Smart Find & Replace account. Identity is typically tied to your Miro session and, where applicable, your interaction with our website or payment flow.

4. Legal bases (UK GDPR)

We rely on one or more of the following legal bases:

Performance of a contract — to provide the Service you request (including paid features, if any).
Legitimate interests — to secure and improve the Service, prevent fraud or misuse, and understand aggregate usage, where not overridden by your rights.
Consent — where we use optional AI, embeddings, or similar processing that goes beyond core replace functionality and is presented as opt-in in the app.
Legal obligation — where we must retain or disclose information to comply with law or competent authority requests.

5. How processing works (high level)

In Miro. Much of the Service runs in your browser as a Miro app. Text you choose to search or replace is read from the board via the Miro APIs/SDK in line with the permissions you grant when installing the app.
Our servers. Some features may call our backend (for example, a proxy for embeddings or other AI-related requests). Those requests are designed to carry only what is needed for the feature, subject to technical limits and configuration described in our technical documentation.
Third parties. Infrastructure hosts (e.g. Vercel), AI providers (e.g. OpenAI) if you use optional AI features, payment processors (e.g. Stripe) for billing, and Miro itself may process data as described in their respective policies.

6. Retention

We keep personal data only as long as necessary for the purposes above, unless a longer period is required by law. Operational logs and security data are typically retained for a limited rolling period. Board text is not intended to be stored on our systems for general browsing; any temporary processing should be minimised. Backup and caching practices follow our hosting provider’s defaults unless we configure shorter retention.

7. International transfers

Data may be processed in the UK, the EEA, the United States, or other countries where our subprocessors operate. Where personal data is transferred from the UK to countries not subject to an adequacy decision, we use appropriate safeguards such as the UK International Data Transfer Agreement / Addendum or other approved mechanisms, in line with UK GDPR requirements.

8. Your rights

Under UK data protection law you may have the right to:

Request access to your personal data;
Request rectification or erasure;
Restrict or object to certain processing;
Data portability, where applicable;
Withdraw consent at any time, where processing is consent-based (without affecting prior lawful processing);
Lodge a complaint with the UK Information Commissioner’s Office (ICO): ico.org.uk.

To exercise rights, use the privacy contact details that will be published in section 1 when available. We may need to verify your request.

9. Security

We implement appropriate technical and organisational measures appropriate to the risk, including HTTPS for transport, access controls on infrastructure, and separation of secrets from client bundles in production builds. No method of transmission or storage is completely secure; we encourage you to use Miro’s access controls for sensitive boards.

10. Children

The Service is not directed at children under 13 (or the digital consent age in your jurisdiction). If you believe we have collected data from a child, please contact us and we will take appropriate steps.

11. Changes

We may update this Policy from time to time. We will post the updated version on this page and adjust the effective date. Material changes may be communicated through the Service or Miro listing where appropriate.

12. Contact

For privacy questions or requests: use the contact details that will be added to section 1 when available. For Miro-specific account or platform issues, contact Miro support.