midL

Privacy Policy

Public website advertising — updated 18 October 2026

On public marketing pages, midL uses the Meta Pixel and Conversions API to measure page views, waitlist-popup openings and successful new waitlist signups, and to optimise advertising. Meta receives the page URL, IP address, browser information, advertising cookie identifiers (_fbp/_fbc), event ID and client-count range. Signup email and name are not sent to Meta. This tracking is not installed inside the workspace, admin pages or client portals.

Advertising is off for every visitor, in every country, until you click Accept; nothing is loaded or sent to Meta before then. Open Cookie settings on any public page to accept, reject or withdraw. We keep dated records of your choice and the notice version; withdrawal stops future reporting and does not erase earlier records.

Last updated: October 20, 2026

This Privacy Policy explains how MidL Social ("midL", "we", "us", "our") collects, uses, shares, and protects personal data when you use the midL platform, website, and related services (the "Service"). MidL Social is the responsible party / data controller for the personal data described in this Policy.

1. Information Officer

Our Information Officer under South Africa's Protection of Personal Information Act (POPIA) is [Information Officer full name], reachable at privacy@getmidl.com. If you are unhappy with how we handle your data, you may complain to South Africa's Information Regulator at inforegulator.org.za.

2. Data We Collect

  • Account data — name, email, password hash, workspace and role, and your recorded acceptance of our Terms and Privacy Policy.
  • Profile & client data — agency, clients, team members, brand assets and files you upload.
  • Content data — posts, captions, media, comments, approvals, and midLy chats and prompts.
  • Connected-platform data — encrypted access tokens, page/ad-account IDs, posts, insights, and ad-performance metrics from Meta (Facebook & Instagram), TikTok, LinkedIn, Google, Mailchimp, Klaviyo and MailerLite, only when you connect them.
  • Instagram Social Inbox — where enabled, comments and direct messages received on a connected Instagram account, the sender's handle, and replies sent from midL.
  • Google data — when you connect a Google account, midL may access: Google Analytics (GA4) property data including sessions, users, and traffic metrics; Google Search Console data including search queries, impressions, clicks, and page rankings; Google Ads campaign performance data including spend, impressions, clicks, and conversions; Google Drive files you explicitly select or upload through midL; and Google Calendar events where enabled. This data is used solely to display analytics, manage content, and provide the features you request within midL. midL's use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.
  • Client portal visitors — the email addresses invited to a client portal, emailed access codes (stored hashed, short-lived), and the dated access keys that keep a visitor signed in.
  • Two-step verification — emailed sign-in codes (stored hashed, expire after 10 minutes) and, if you choose to trust a device, a hashed device token with a device label and last-used date.
  • Public posts and ads — through Apify, we collect publicly available posts, trends and ads from competitor and trend accounts you ask midL to track. We do not collect private content this way.
  • Usage & device data — log data, IP address, browser, pages viewed, feature usage and error reports.
  • Support data — messages you send us and our replies.
  • Billing data — collected and processed by our Merchant of Record, Paddle. We receive limited transactional data (plan, status, country, last-4 of card) — never your full card details — and your renewal acknowledgement at checkout.

3. Why We Use Your Data

  • provide, secure, and operate the Service (contract);
  • publish, schedule, and report on content via the platforms you connect (contract);
  • read campaign and ad-performance data from the ad accounts you connect and show it in midL (contract / legitimate interests);
  • improve product quality, debug, and prevent abuse (legitimate interests);
  • send service emails and, only if you tick the opt-in box, midL tips and product news (consent);
  • comply with legal obligations and enforce our Terms (legal obligation / legitimate interests).

We do not sell your personal data.

4. AI (midLy)

midLy uses AI models from Google (Gemini) and OpenAI, accessed through Lovable's AI gateway. midLy reads your client's data and metrics to write summaries, plans and answers. This data is not used to train AI models.

5. Sub-processors and Sharing

We share personal data only with:

  • Lovable Cloud — hosting, database and email sending.
  • Lovable AI gateway, Google (Gemini) and OpenAI — AI processing for midLy.
  • Paddle — our Merchant of Record, for payments, subscriptions, invoicing, tax and refunds.
  • Apify — collection of public trend posts and competitor ads.
  • Meta Conversions API — public-site advertising events, only after you accept advertising cookies.
  • Platforms you connect — Google, Meta, TikTok, LinkedIn, Mailchimp, Klaviyo and MailerLite, only when you connect them, to perform the actions you ask midL to perform.
  • Professional advisers — legal, accounting, insurance.
  • Authorities — where required by law or court order, or to protect rights and safety.
  • Successors — in a merger, acquisition, or sale of assets, subject to equivalent protections.

6. International Transfers

Our main providers process data outside South Africa: Lovable Cloud, Google, OpenAI and Meta mainly in the United States and the European Union; Paddle in the United Kingdom and European Union; Apify in the European Union (Czech Republic) and United States; TikTok, LinkedIn, Mailchimp, Klaviyo and MailerLite in the United States and European Union. We rely on these providers' standard contractual safeguards (such as Standard Contractual Clauses) to protect your data.

7. Retention

  • midLy chats — deleted after 90 days unless you choose Keep.
  • Deleted clients — recoverable for 30 days, then permanently deleted.
  • Client portal links — expire after 30 days.
  • Deleted accounts — recoverable for 30 days, then account data is removed.
  • Billing and legal-consent records — kept as long as the law requires.
  • Other data — kept while your account is active and needed for the Service.

8. Your Rights

You may have the right to access, correct, delete, restrict, port, or object to processing of your personal data, and to withdraw consent at any time. Email privacy@getmidl.com. We will respond within the period required by applicable law. You may also complain to the Information Regulator (see section 1) or your local data protection authority.

9. Security

We apply appropriate technical and organisational measures including encryption in transit, encryption at rest for platform credentials, role-based access controls, optional two-step verification and routine security review. No system is perfectly secure.

10. Cookies and Site Analytics

We use strictly necessary cookies and browser storage to keep you signed in and secure the Service. midL's hosting (Lovable) records anonymous page views and clicks on getmidl.com to measure site usage; this runs on midL's own domain and isn't shared with advertisers. Public marketing pages use Meta advertising cookies only after you accept them, as described above. You can withdraw advertising permission through Cookie settings.

11. Children

The Service is not intended for, and we do not knowingly collect data from, children under 16.

12. Changes

We will post any changes here and, for material changes, notify you by email or in-app.

13. Contact

MidL Social — privacy@getmidl.com.