Privacy Policy
Effective October 14, 2026.
The data controller is DenyaDev LLC, doing business as Miatafy, 102 Bergeron Way, Cary, NC 27519, United States. Privacy requests can be sent to support@miatafy.com or by post to the address above.
Miatafy does not sell or rent personal information and does not use it for third-party advertising.
What is collected and why
Section titled “What is collected and why”| Activity | Data | Purpose and legal basis |
|---|---|---|
| ScreenTune intake | Name, email, VIN, original vehicle market, vehicle details decoded or confirmed from the VIN, firmware confirmation, selected features, delivery choice, form timestamps, intake reference, and IP address | Answer a request, assess compatibility, prepare a requested order, bind the requested configuration to the correct vehicle, prevent abuse, and perform a purchase. The bases are steps requested before a contract, performance of a contract, and legitimate interests in security and reliable order handling. |
| Intake progress | The same details completed through the end of each form step | Recover an incomplete intake, avoid losing a prospective customer’s configuration, and follow up on a requested product. This includes one reminder email about an unfinished configuration, sent about an hour after the last activity, with an unsubscribe link. It is not sent to vehicles first sold in the EU, EEA, UK, or Switzerland. The form says when this happens. The bases are requested pre-contract steps and legitimate interests; a person can ask for deletion at any time. |
| Checkout evidence | VIN, vehicle authorization, server timestamp, intake reference, selected delivery method, and IP address | Link checkout to the authorized vehicle configuration, prevent disputes, and fulfill the order. The bases are contract performance and legitimate interests in reliable order handling. |
| Payment and order | Stripe checkout/session identifiers, payment status, amount, tax, currency, billing country, email, and limited billing/contact details returned by Stripe | Take payment, send confirmation, keep accounting records, prevent fraud, and handle refunds or disputes. The bases are contract performance, legal obligations, and legitimate interests. Miatafy does not receive the full card number. |
| License records | An opaque ScreenTune license ID, VIN, linked order and intake references, vehicle description, policy version, release and configuration IDs, signed-configuration identifier, entitlement dates, and transfer, reissue, or refund status | Tie the license to the ordered vehicle, sign and verify the ordered configuration, provide updates and re-downloads, process transfers and replacement-unit reissues, and maintain order evidence. The bases are contract performance, legal obligations, and legitimate interests in reliable fulfillment and fraud prevention. The signed configuration contains the opaque license ID, normalized licensed VIN, and install plan so the installer can show the customer which vehicle it is for and enforce the license offline. Names, emails, addresses, Stripe IDs, dates, and private signing keys are not embedded. |
| Support and contact | Name, email, message, product, attachments supplied later, and IP address | Reply, troubleshoot, provide support, and establish or defend claims. The bases are contract performance and legitimate interests. |
| Beta and reservation forms | Email, vehicle details, requested product, and IP address | Manage the requested reservation or invitation. The bases are requested pre-contract steps and legitimate interests. |
| Newsletter | Email address and subscription status | Send the emails requested. The basis is consent, which can be withdrawn using the unsubscribe link. |
| Security and delivery logs | IP address, request time, browser/device metadata, and requested URL in ordinary server, CDN, and email-delivery logs | Operate and secure the site, diagnose errors, and limit abuse. The basis is legitimate interests. |
The standalone VIN decoder runs locally in the browser. A VIN goes to the U.S. NHTSA vPIC service only when the user actively selects the official NHTSA decode; it does not pass through Miatafy’s API. The ScreenTune configurator also decodes the VIN locally, then sends it to Miatafy as part of the vehicle configuration only when the user continues to checkout or requests a compatibility review.
Basic cookieless analytics
Section titled “Basic cookieless analytics”Miatafy uses a self-hosted instance of Umami for first-party traffic and website funnel analytics. The tracker sends page views and selected actions, such as product-link clicks, product-page sections reached and time the page stayed open, configurator steps and the reason a step could not continue, checkout attempts and handoffs, newsletter signups, and support-form submissions, to Miatafy’s analytics server. It does not set analytics cookies or store visitor identifiers in browser storage.
Analytics records include page paths, referring site origins, timestamps, browser and device information, language, approximate location, and event names and placement labels. Page titles and URL fragments are excluded. URL query strings are excluded except for standard campaign tags (utm_source, utm_medium, utm_campaign, utm_content, and utm_term) that Miatafy adds to its own posts, ads, and emails to see which ones bring visitors. Umami processes the request’s IP address and user agent to derive location and generate a hashed visitor identifier for counting visits and connecting steps in a funnel; it does not store the raw IP address in its analytics database. Ordinary server logs are separate and may contain IP addresses as described above.
Miatafy uses these records to understand which pages visitors use and where they leave a website flow, relying on its legitimate interest in measuring and operating the site. Analytics are not used for advertising or cross-site profiles. Form answers, VINs, email addresses, and payment details are not included in analytics events. A configurator event may record a fixed label such as whether an entered VIN was eligible, needed review, or was mistyped, but never the VIN itself. This is Miatafy’s own installation, so analytics records are not sent to Umami’s hosted service or Google Analytics.
Strictly necessary local storage used to preserve an in-progress ScreenTune intake or retry a requested form submission is not used for advertising.
Email measurement
Section titled “Email measurement”Promotional and product-update emails from Miatafy may include a small invisible image and tracked links served by the same self-hosted Umami instance. When an email app loads the image, Umami counts an open; when someone clicks a tracked link, Umami counts the click and then forwards to the normal Miatafy page. These records include the campaign name and email version label carried in the image or link address, the timestamp, browser and device information, and approximate location, processed the same way as website analytics. They are counted in aggregate and do not contain or link to the recipient’s email address, name, or other identity.
Miatafy uses these counts to learn whether its emails are useful, relying on its legitimate interest in measuring its own communications. Some email apps load images automatically, and others block them. To avoid open counting, turn off automatic image loading in the email app; clicking a link is always optional, and every promotional email includes an unsubscribe link.
Service providers and international processing
Section titled “Service providers and international processing”- Stripe processes checkout, payment, fraud, billing-address, and tax information. Its role and independent obligations are described in Stripe’s privacy policy.
- Amazon Web Services hosts the public site and database, provides CDN and security logs, and sends transactional and promotional email through SES.
- Miatafy’s hosting infrastructure runs the self-hosted Umami analytics application and its database, including email open and click counts.
Miatafy is based in the United States, so information submitted to Miatafy is processed in the United States. Providers may also process data in other countries. Where data-protection law requires transfer safeguards, Miatafy and its providers rely on the provider’s applicable contractual safeguards or another lawful transfer mechanism. Contact Miatafy to request information about the safeguard relevant to a particular transfer.
Retention
Section titled “Retention”- Incomplete ScreenTune progress snapshots are automatically deleted after 30 days. A one-way hash of each address sent the unfinished-configuration reminder is kept so it is never sent twice.
- Ordinary support/contact messages are deleted after 3 years, unless an active dispute or legal duty requires longer retention.
- Completed order, payment, tax, license, and package evidence is normally kept for 7 years. Minimal license and package identifiers may be retained longer when needed to honor a perpetual license, re-download, transfer, or replacement-unit reissue.
- Reservation and beta records are reviewed at least annually and removed when the program closes or the request is no longer active.
- Newsletter records remain until unsubscribe, plus the minimal suppression record needed to honor that choice.
- CDN, server, security, and email-provider logs use the provider’s configured operational retention and are not kept longer than reasonably needed for security and delivery diagnostics.
- Self-hosted analytics records, including email open and click counts, remain until Miatafy deletes them; automatic expiry is not currently configured.
Data may be kept longer when reasonably necessary for an active claim, chargeback, fraud investigation, or legal preservation duty, then deleted when that reason ends.
Rights and choices
Section titled “Rights and choices”Depending on location, a person may have rights to access, correct, delete, restrict, or object to processing; receive portable data; withdraw consent; and complain to a data-protection authority. Withdrawing consent does not undo processing that was lawful before withdrawal.
Send a request from the relevant email address to support@miatafy.com. Miatafy may ask for proportionate verification before disclosing or deleting order information. EEA residents may complain to the supervisory authority where they live or work, including Norway’s Datatilsynet.
Changes
Section titled “Changes”If this policy changes materially, the effective date above changes and the current version remains available at this URL.