Privacy Policy
Effective August 16, 2026.
The data controller is DenyaDev LLC, doing business as Miatafy, 102 Bergeron Way, Cary, NC 27519, United States. Privacy requests can be sent to support@miatafy.com or made by phone at +1 925-481-4495.
Miatafy does not sell or rent personal information and does not use it for third-party advertising.
What is collected and why
Section titled “What is collected and why”| Activity | Data | Purpose and legal basis |
|---|---|---|
| ScreenTune intake | Name, email, original vehicle market, model, year, trim, firmware confirmation, selected features, delivery choice, form timestamps, intake reference, and IP address | Answer a request, assess compatibility, prepare a requested order, prevent abuse, and perform a purchase. The bases are steps requested before a contract, performance of a contract, and legitimate interests in security and reliable order handling. |
| Intake progress | The same details completed through the end of each form step | Recover an incomplete intake, avoid losing a prospective customer’s configuration, and follow up on a requested product. The form says when this happens. The bases are requested pre-contract steps and legitimate interests; a person can ask for deletion at any time. |
| Checkout evidence | Vehicle authorization, server timestamp, intake reference, selected delivery method, and IP address | Link checkout to the authorized vehicle configuration, prevent disputes, and fulfill the order. The bases are contract performance and legitimate interests in reliable order handling. |
| Payment and order | Stripe checkout/session identifiers, payment status, amount, tax, currency, billing country, email, and limited billing/contact details returned by Stripe | Take payment, send confirmation, keep accounting records, prevent fraud, and handle refunds or disputes. The bases are contract performance, legal obligations, and legitimate interests. Miatafy does not receive the full card number. |
| License records | An opaque ScreenTune license ID, linked order and intake references, a non-personal vehicle description, policy version, release and configuration IDs, signed-configuration identifier, entitlement dates, and transfer, reissue, or refund status | Sign and verify the ordered configuration, provide updates and re-downloads, process transfers and replacement-unit reissues, and maintain order evidence. The bases are contract performance, legal obligations, and legitimate interests in reliable fulfillment and fraud prevention. Names, emails, addresses, VINs, Stripe IDs, dates, and private signing keys are not embedded in the signed configuration. |
| Support and contact | Name, email, message, product, attachments supplied later, and IP address | Reply, troubleshoot, provide support, and establish or defend claims. The bases are contract performance and legitimate interests. |
| Beta and reservation forms | Email, vehicle details, requested product, and IP address | Manage the requested reservation or invitation. The bases are requested pre-contract steps and legitimate interests. |
| Newsletter | Email address and subscription status | Send the emails requested. The basis is consent, which can be withdrawn using the unsubscribe link. |
| Security and delivery logs | IP address, request time, browser/device metadata, and requested URL in ordinary server, CDN, and email-delivery logs | Operate and secure the site, diagnose errors, and limit abuse. The basis is legitimate interests. |
The VIN decoder runs locally in the browser. A VIN goes to the U.S. NHTSA vPIC service only when the user actively selects the official NHTSA decode; it does not pass through Miatafy’s API.
Basic cookieless analytics
Section titled “Basic cookieless analytics”Miatafy uses Google Analytics 4 in permanent-denied Advanced Consent Mode for basic aggregate traffic and event measurement. Analytics storage, advertising storage, advertising user data, personalization, and Google signals remain disabled. GA4 therefore sends limited cookieless page and event pings but does not set Google Analytics cookies or use browser storage on this site.
The limited pings can include the requested page, referrer, timestamp, browser user agent, coarse consent state, and a per-page random number. Miatafy uses them to understand aggregate visits and whether important site actions work, relying on its legitimate interest in measuring and operating the site. They are not used by Miatafy for advertising or cross-site profiles. Google’s processing is described in Google’s privacy policy.
Strictly necessary local storage used to preserve an in-progress ScreenTune intake or retry a requested form submission is not used for advertising.
Service providers and international processing
Section titled “Service providers and international processing”- Stripe processes checkout, payment, fraud, billing-address, and tax information. Its role and independent obligations are described in Stripe’s privacy policy.
- Amazon Web Services hosts the public site and database, provides CDN and security logs, and sends transactional email through SES.
- Google receives the limited cookieless analytics pings described above with storage and advertising consent permanently denied.
Miatafy is based in the United States, so information submitted to Miatafy is processed in the United States. Providers may also process data in other countries. Where data-protection law requires transfer safeguards, Miatafy and its providers rely on the provider’s applicable contractual safeguards or another lawful transfer mechanism. Contact Miatafy to request information about the safeguard relevant to a particular transfer.
Retention
Section titled “Retention”- Incomplete ScreenTune progress snapshots are automatically deleted after 30 days.
- Ordinary support/contact messages are deleted after 3 years, unless an active dispute or legal duty requires longer retention.
- Completed order, payment, tax, license, and package evidence is normally kept for 7 years. Minimal license and package identifiers may be retained longer when needed to honor a perpetual license, re-download, transfer, or replacement-unit reissue.
- Reservation and beta records are reviewed at least annually and removed when the program closes or the request is no longer active.
- Newsletter records remain until unsubscribe, plus the minimal suppression record needed to honor that choice.
- CDN, server, security, and email-provider logs use the provider’s configured operational retention and are not kept longer than reasonably needed for security and delivery diagnostics.
Data may be kept longer when reasonably necessary for an active claim, chargeback, fraud investigation, or legal preservation duty, then deleted when that reason ends.
Rights and choices
Section titled “Rights and choices”Depending on location, a person may have rights to access, correct, delete, restrict, or object to processing; receive portable data; withdraw consent; and complain to a data-protection authority. Withdrawing consent does not undo processing that was lawful before withdrawal.
Send a request from the relevant email address to support@miatafy.com. Miatafy may ask for proportionate verification before disclosing or deleting order information. EEA residents may complain to the supervisory authority where they live or work, including Norway’s Datatilsynet.
Changes
Section titled “Changes”If this policy changes materially, the effective date above changes and the current version remains available at this URL.