How Milvao supports the GDPR

Last updated 5 November 2026

Where the GDPR applies, your community is the controller and Milvao its processor, with consent per purpose, redacted AI text and tools for access and erasure.

1. 01Controller and processor

   • Community owners are controllers for their members' personal data. They decide to use Milvao, which groups join and which profile questions are asked.
   • Milvao is a processor for that data, acting only on the community's instructions under the data processing agreement (Art. 28).
   • Milvao is a controller for operator accounts, billing, website visitors and enquiries, as described in the privacy policy.

2. 02Lawful basis for each purpose

   Purpose	Lawful basis
   Running private requests and introductions for a community	Set by the community as controller. Milvao records members' consent (Art. 6(1)(a)) for each step below.
   Sending a member introduction requests	The member's consent, off until they turn offers on (Art. 6(1)(a)).
   Sharing a contact between two members	Consent of both people for that one request and introduction (Art. 6(1)(a)), checked again before sending.
   Operator accounts and providing the service to the community	Contract with the community (Art. 6(1)(b)).
   Security, fraud prevention and audit trails	Legitimate interest in keeping the service and its members safe (Art. 6(1)(f)).
   Billing records and tax	Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).
   Replying to enquiries and pilot requests	Steps taken at your request before a contract (Art. 6(1)(b)).

   The community, as controller, confirms the lawful basis for its own use. Where it relies on consent, Milvao's consent records (purpose, wording version and time for each grant and withdrawal) help it show that consent was given (Art. 7).

3. 03Data subject rights

   Right	How it works
   Access and portability (Art. 15, 20)	The member sends MY DATA. The owner exports the member's data as a file from Settings, Data requests.
   Rectification (Art. 16)	Members edit their own profile through a private link. Operators can correct details, and the member is told by default.
   Erasure (Art. 17)	The member sends DELETE MY DATA and confirms. Offers stop at once, and the owner completes the deletion. De-identified counts and consent proofs remain.
   Objection and restriction (Art. 18, 21)	PAUSE or STOP, or switching offers off, stops further offers immediately. Other requests go to the community's team or to Milvao.
   Automated decisions (Art. 22)	Milvao ranks members to decide whom to ask about a request. Being asked or not has no legal or similarly significant effect, and communities can switch to approving each match by hand.

   Every request gets a 30-day due date, within the GDPR's one-month limit, and is recorded in the audit trail. Members can also complain to their local supervisory authority.

4. 04International transfers

   Milvao's database is hosted in Singapore, and some providers process data in other countries, including the United States (see sub-processors). Personal data of people in the EU, EEA or UK that leaves those areas will be covered by the European Commission's standard contractual clauses, with the UK addendum, set out in the data processing agreement, which is being finalised.

5. 05Security of processing

   Milvao's measures under Art. 32 include encryption of phone numbers and tokens, separation of each community's data in the database, least-privilege access, two-factor sign-in available to everyone and required for staff support access, and an audit trail in a separate database. See the security page for the full list and what is planned.

6. 06Breach notification

   Milvao will inform the community without undue delay after becoming aware of a breach affecting its data (Art. 33(2)), with the details it needs to notify its supervisory authority within 72 hours and, where required, the people affected.

7. 07Records and sub-processors

   Milvao uses only the sub-processors listed on the sub-processors page and tells community owners before adding one. Records of processing (Art. 30) are being prepared alongside the data processing agreement. Questions: hello@milvao.com.