Privacy Policy

Effective from 5 October 2026.

1. Who we are

Mittral is a product of AYOH, operated by Applied Optimisation UK Ltd, which also bills subscriptions. Applied Optimisation UK Ltd, registered in England and Wales with company number 14970295. Registered office: Studio 9, 50-54 St Pauls Square, Birmingham, B3 1QS, United Kingdom.

For the information in workspaces, such as purchase requests, attachments and supplier details, the organisation that uses Mittral decides what is collected and why: it is the controller (the “responsible party” under POPIA) and we process that information for it as its processor (“operator”), under our Data Processing Agreement. For account, billing and website information, we are the controller. This policy mainly covers that second kind.

2. What we collect

Account information: your name, email address and sign-in activity, handled with our identity provider.
Workspace information: company details, members and roles, purchase requests, approvals, attachments, supplier contact details and purchase orders, as entered by the workspace’s users.
Billing information: billing contact, address, tax ID and subscription history. Card details are collected and held by Stripe, not by us.
Email records: which emails we sent, to which addresses, and whether they were delivered.
Records of activity: an audit trail of decisions and settings changes in each workspace, and technical logs (including IP addresses) that keep the service secure.
Product usage records: which set-up steps a workspace has completed and which plan limits it has reached. They are kept per workspace, not per person.
Website visits: this website doesn’t use analytics or advertising tools.

3. How we use it, and our lawful bases

To provide Mittral under our contract with your organisation: sign-in, routing requests, creating and emailing POs, billing.
To keep the service secure and prevent abuse, such as fraudulent sign-ups or misuse of supplier email: our legitimate interests.
To send service messages about your account, workspace or subscription: contract and legitimate interests.
To help new workspaces get set up, with a welcome email and a set-up reminder that you can unsubscribe from, and to understand how Mittral is used so we can improve it: our legitimate interests.
To meet legal obligations, such as keeping financial records.

We do not sell personal information or use it for advertising.

The service providers listed on our subprocessors page, which process it for us under contract.
Suppliers your workspace sends POs to: the PO email includes the buyer’s details and, for replies, the requester’s email address (or another reply-to address the workspace sets).
Authorities, where the law requires it.

5. International transfers

We are based in the United Kingdom, and the app’s database and files are held in Western Europe. Our providers may process personal information outside the United Kingdom and the European Economic Area, mainly in the United States. Where they do, and the country is not covered by a UK or EU adequacy decision, the transfer is protected by the safeguards in our agreements with them: the UK International Data Transfer Addendum or the EU standard contractual clauses, or the provider’s certification under the UK–US Data Bridge and the EU–US Data Privacy Framework.

6. How long we keep it

Account information: for as long as your account exists. You can delete your account yourself (in the app, under Your account): your name and email address are then removed, your sign-in is deleted with our identity provider, and your drafts and devices are deleted. Requests you submitted, approvals you gave, purchase orders and activity records stay in each workspace as its business records, under the name they were made with; that workspace’s organisation decides how long to keep them. Deleted information can remain in our backups for up to 90 days before it is overwritten.
Workspace information: for as long as the workspace exists. When a workspace admin deletes it, it is deleted permanently 30 days later; admins can export it first. It can remain in our backups for up to 90 days after that.
Billing records: 6 years after the end of the financial year they relate to, as UK company and tax law requires.
Technical logs: request logs for 7 days; records of the emails we sent, and whether they were delivered, for up to 400 days.

7. Security

Mittral is served only over encrypted connections. Each workspace’s information is kept separate from every other workspace’s, and files are only served after checking the person may see them. Sign-in supports multi-factor authentication. Our hosting provider encrypts the database and stored files at rest. No service can promise perfect security; if a breach puts your rights at risk, we will tell you and the regulator as the law requires.

8. Your rights

Depending on where you are, you can ask to access, correct or delete your personal information, object to or restrict how we use it, and receive a copy of it. You can delete your Mittral account yourself at any time, as described in section 6. For information in a workspace, please ask that organisation first: we will help it respond. You can also complain to a supervisory authority: in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in South Africa, the Information Regulator; in the European Economic Area, the data protection authority where you live or work. We would appreciate the chance to put things right first.

Contact for privacy requests: privacy@mittral.com. We are not required to appoint a data protection officer and have not appointed one; this address reaches the people responsible for privacy at Applied Optimisation UK Ltd.

9. Children

Mittral is a business service and is not meant for children.

10. Cookies

See our cookie notice.

11. Changes

We will post changes to this policy here and tell workspace admins about significant ones.