Privacy Policy

1. Who we are

Miarulla Ltd is a software company incorporated in England and Wales. We build and operate independent SaaS products and digital services.

Data Controller: Miarulla Ltd
Suite A, 82 James Carter Road
Mildenhall, Suffolk, IP28 7DE
United Kingdom

Email: info@miarulla.com

2. Information we collect

Information you provide directly

• Account information — name, email address, password (hashed), and company name when you register for any of our services.
• Billing information — payment card details (processed securely by our payment provider; we do not store card numbers), billing address, and VAT number where applicable.
• Communications — messages you send us via email or contact forms, including support requests and feedback.
• Content you upload — files, documents, and data you submit to our platforms when using our services (e.g. documents uploaded to PolarPDF).

Information collected automatically

• Usage data — pages visited, features used, time spent, clicks, and navigation paths within our services.
• Device and technical data — IP address, browser type and version, operating system, device type, and referring URLs.
• Cookies and similar technologies — see Section 9 for full details.

3. How we use your information

We use the information we collect to:

• Create and manage your account and provide access to our services.
• Process payments and manage your subscription.
• Send transactional emails such as account confirmations, receipts, and service notifications.
• Respond to your support requests and enquiries.
• Improve, maintain, and develop our products and services.
• Monitor for fraud, abuse, or security threats.
• Comply with legal obligations.
• Send you product updates or marketing communications where you have given consent or where we have a legitimate interest to do so (you may opt out at any time).

4. Legal basis for processing

Under UK GDPR, we process your personal data on the following legal bases:

• Contract — processing necessary to perform the contract you have with us (e.g. providing the service you signed up for).
• Legitimate interests — for security monitoring, fraud prevention, product improvement, and certain marketing activities, where these are not overridden by your rights.
• Legal obligation — where we are required to process data to comply with the law (e.g. financial record-keeping).
• Consent — where you have explicitly agreed, such as subscribing to our marketing emails or accepting non-essential cookies. You may withdraw consent at any time.

5. Sharing your information

We do not sell your personal data. We may share it with:

• Service providers — trusted third parties who help us operate our services, such as cloud hosting providers, payment processors, email delivery services, and analytics platforms. These parties are bound by data processing agreements and may only process your data on our instructions.
• Legal authorities — where required by law, court order, or regulatory obligation, or to protect the rights, property, or safety of Miarulla, our users, or the public.
• Business transfers — in the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

6. International transfers

Some of our service providers operate outside the United Kingdom. Where we transfer personal data internationally, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or equivalent standard contractual clauses approved by the ICO.

7. Data retention

We retain your personal data only as long as necessary for the purposes outlined in this policy:

• Active accounts — for the duration of your relationship with us.
• Closed accounts — up to 3 years after account closure, unless a longer retention period is required by law (e.g. for financial records, 6 years).
• Uploaded content — deleted within 24 hours of processing, or as described in the relevant product's documentation.
• Support communications — up to 3 years.

You may request earlier deletion of your data subject to any overriding legal obligations — see Section 8.

8. Your rights

Under UK GDPR you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure — request deletion of your data in certain circumstances (“right to be forgotten”).
• Right to restriction — ask us to pause processing of your data in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests, including direct marketing.
• Rights related to automated decision-making — we do not use your data for automated decision-making or profiling that produces significant effects.

To exercise any of these rights, contact us at info@miarulla.com. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

We use cookies and similar tracking technologies on our websites. Cookies are small text files placed on your device to help us operate and improve our services.

Types of cookies we use

• Strictly necessary — essential for the website and services to function. These cannot be disabled.
• Analytics — help us understand how visitors use our site (e.g. page views, session duration). Used only with your consent.
• Preference — remember your settings and choices to personalise your experience.

You can manage or withdraw cookie consent at any time through your browser settings or our cookie preference centre. Note that disabling certain cookies may affect the functionality of our services.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include encryption in transit (TLS), hashed password storage, access controls, and regular security reviews.

No method of internet transmission or electronic storage is completely secure. If we become aware of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO as required by law.

11. Children's privacy

Our services are not directed at children under the age of 13, and we do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised effective date, and where appropriate by email. We encourage you to review this page periodically.

13. Contact us

If you have any questions about this Privacy Policy or how we handle your data, please get in touch: