- Application
- MIKA (also shown in the app as Miko Client)
- Operator
- Mohamed Khalafalla, a sole proprietorship in Ontario, Canada
- Effective date
- 4 October 2026
- Last updated
- 4 October 2026
- French version
- Politique de confidentialité
This policy describes how MIKA handles information when you use the mobile application (iOS and Android) and the related services that power it.
MIKA is a multi-business app. You choose a participating business (for example a spa or other walk-in service). That business’s systems are used to create your account, store your profile, process payments, and record purchases. The operator of MIKA also processes some information so the app can function (for example routing your request to the correct business and delivering push notifications).
This policy matches how the app works. It is not a certificate of legal compliance. If a law that applies to you conflicts with this text, that law prevails.
1. Who we are
MIKA is operated by Mohamed Khalafalla, a sole proprietorship.
- Address: 151 Lefebvre Avenue, Cornwall, Ontario, Canada K6H 5G8
- Email: engmkmika@gmail.com
The operator is based in Ontario and offers the app to customers in Canada, including Quebec.
Questions about the app or platform: engmkmika@gmail.com
Questions about your visits or purchases at a business: contact that business.
If you write about a specific business, include the business name and the email address on the account.
2. Age requirement
You must be 18 years of age or older to create a MIKA account. Sign-up asks for your date of birth and refuses an account if that date shows you are under 18.
This is based on the date you provide. It is not government ID verification.
We do not knowingly create accounts for children. If we learn an account belongs to someone under 18, we will delete it. A parent or guardian may use their own adult account in connection with a service for a child or a pet.
3. Information we collect
3.1 Information you provide
When you create an account we ask for:
- First name and last name
- Email address
- Phone number
- Date of birth
- A password (stored by Firebase Authentication, not in readable form in the app)
When you check out or save an address, you may provide phone, street, city, state or province, postal code, and country. Address fields are saved on your device and are copied onto an order when you place one.
We do not offer Google, Apple, or Facebook sign-in. Guest sign-in is not offered.
3.2 Information created when you use the app
- A unique account ID for the business you selected
- Whether your email is verified (required for new accounts created on or after 3 October 2026, UTC)
- Favorites (product identifiers)
- Shopping cart contents on the device
- Language preference (English or French), where the business enables it
- Which business you selected
- Loyalty points, reward claims, and points history
- Membership status, if you subscribe
- Orders: items, prices, discounts, coupons, rewards applied, payment method, and related fulfilment fields
- A QR code on your device that encodes your account ID so the business can identify you in person
3.3 Date of birth
We use your date of birth to:
- Confirm you are 18 or older at sign-up
- Allow the business you selected to send a birthday offer when that feature is used
Birthday offers are not sent automatically by the app today. When they are sent, they are a type of promotional message from that business. We do not use your date of birth for advertising networks or for any other purpose described here.
3.4 Payments
If you pay by card, Stripe processes the payment for the business you selected. We send Stripe information such as your email address, name, account ID, and the amount and currency. Stripe may collect card details, billing information, and fraud-prevention data in Stripe’s own forms. The app does not store your full card number.
You may receive a receipt from Stripe at the email on your account.
Memberships, if offered, are billed as Stripe subscriptions for that business.
If you use a method the business marks as not prepaid (for example cash), card details are not collected for that order.
3.5 Push notifications
If you allow notifications, we collect a push token from Apple or Google and store it with your account ID, the business ID, and whether the device is iOS or Android.
The business you selected can then send push messages. These may include:
- Order or account updates (including automated messages)
- Announcements (for example hours or service changes)
- Promotional offers, including a possible birthday offer
There is one device permission. The app does not currently offer a separate “promotions only” switch. You can turn notifications off in your device settings. Signing out unregisters the current token. Deleting your account removes stored tokens for that business.
3.6 Technical and log information
The application server records the time, requested path, and IP address of requests, and limits repeated requests from the same IP. Hosting and database providers may keep access logs.
The app does not include a separate analytics, advertising, or crash-reporting SDK.
3.7 Information we do not collect through the app
We do not request access to your device location, camera, photos, contacts, or microphone. We do not use advertising identifiers for ads. Showing a business address and letting you open it in Maps is not tracking your location.
4. Why we use this information
| Purpose | Examples |
|---|---|
| Create and secure your account | Email and password, verification, password reset, 18+ check |
| Provide the service | Profile, QR check-in, catalog, cart, orders, rewards, memberships |
| Take payment | Stripe customer and payment confirmation |
| Contact you about your account or order | Email via Firebase or Stripe; phone on the order for the business |
| Send notifications you have allowed | Device token; promotions, announcements, and automated messages |
| Birthday offers | Date of birth, when the business uses that feature |
| Remember settings on this device | Saved address, language, selected business, favorites cache |
| Operate and protect the service | Authentication checks, rate limits, server logs |
5. How we share information
We do not sell your personal information.
We share information with:
The business you selected. Your profile, orders, rewards, membership, and related records live in that business’s Firebase project. People who work for that business and have staff access can read information needed to serve you.
Service providers
- Google Firebase — accounts, databases, files the business uploads (such as product images), and push delivery
- Stripe — payments, subscriptions, receipts, and related fraud tools, for that business’s Stripe account
- Our hosting and API provider — the application server that creates orders, registers devices, and processes account deletion
- Our database provider for notification records — push tokens and notification send history
- Google Maps — only if you tap the business address (or if a map preview is enabled)
- A shipment-tracking website — only if the business adds a tracking link to your order and you open it; that site has its own policy
Providers act on their own terms as well as our instructions. We do not control how long Apple, Google, or Stripe keep security or payment records after an account is deleted.
We may disclose information if required by law or to protect rights, safety, or the service, where we are legally permitted to do so.
6. Multi-business accounts
Your account exists for the business you selected. If you register at another business in MIKA, that is a separate account. Deleting one account does not delete the other.
7. Cookies and similar technologies
The native app does not use web cookies for advertising. It stores small amounts of data on the device (see section 3). If you open a tracking page in the in-app browser, that page may use cookies under that site’s policy.
8. Security
Measures in use include:
- Separate login systems per business
- Access rules so customers cannot read other customers’ profiles or payment internals
- Server-side confirmation of prices and payments
- Password confirmation before account deletion
- Encrypted transport (HTTPS) to our API and to Firebase and Stripe
No method of transmission or storage is completely secure. We do not promise that information cannot be accessed without authorization.
9. How long we keep information
We keep account and service data until you delete the account for that business, or until we no longer need it to provide the service or meet legal, tax, or dispute needs — whichever is longer.
We do not currently publish a fixed automatic deletion period for inactive accounts.
After you delete your account (section 10):
- Your login and profile for that business are removed
- Rewards, points history, and membership records for that business are removed
- Push tokens for that business are removed
- We ask Stripe to delete the customer record we created; this can fail and we may not be able to remove Stripe’s own copies
- Orders are kept so the business can maintain operational and financial records, but we remove the name, email, phone, and address from those orders and label the customer as a deleted user. The internal account ID may remain on the order
- Some payment and session records used to prevent double-charging may remain
- Device logs, server logs, and provider backups are not deleted by the in-app deletion feature
Signing out does not delete your account. Uninstalling the app does not delete your account.
10. Your choices and deletion
Notifications. Use your device settings, or sign out to unregister the current token.
Saved address. You can change the address stored on the device. Signing out does not reliably erase it.
Password. Use “Forgot password” on the sign-in screen. Reset email is sent by Firebase to the address on that business’s account.
Email. New accounts must verify email. You can correct a mistaken address during verification using “Wrong email.”
Delete account. In Profile, use Delete account and confirm with your password. This applies only to the business you are signed into. Staff accounts cannot be deleted from the customer app.
If you cannot use the app, email engmkmika@gmail.com with the business name and the email on the account. We will need enough information to verify that the request is yours. The app does not currently offer a self-serve download of all of your data.
11. Privacy rights (including Canada)
Depending on where you live, you may have the right to know what personal information is collected, access a copy, request correction, withdraw consent where processing is based on consent (for example push notifications), request deletion subject to the exceptions in section 9, and complain to a supervisory authority.
Canada. You may contact engmkmika@gmail.com. You may also complain to the Office of the Privacy Commissioner of Canada or, if you are in Quebec, the Commission d’accès à l’information.
Quebec. A French version of this policy is published on the French page.
We will not refuse the app’s core service merely because you exercise a privacy right, except where the information is required to provide that service (for example we cannot create an account without an email address).
This section describes rights that may apply. It does not claim that every process is already certified under a named statute.
12. International transfers
Firebase, Stripe, Apple, Google, and our hosting and database providers may process information in the United States or other countries. Those countries may not provide the same legal protections as your home jurisdiction. We use these providers because they are required to operate accounts, payments, and the app.
13. Changes to this policy
We may update this policy when the app or the law changes. We will post the updated text at https://sites.google.com/view/mika-privacy-policy/home and change the “Last updated” date. If changes are material, we will provide additional notice where required.
The current app does not yet display this policy inside the app. That link should be added before store release.
14. Contact
Mohamed Khalafalla
151 Lefebvre Avenue
Cornwall, Ontario
Canada K6H 5G8
Email: engmkmika@gmail.com
Policy URL: https://sites.google.com/view/mika-privacy-policy/home