Privacy Policy

1. Who We Are

MirrAi Chat LTD ("MirrAi", "we" or "us") is a company incorporated in the United Kingdom (Company No. 16403306). We are the data controller for your personal data under applicable data protection laws.

Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, UNITED KINGDOM

Contact: [email protected]

By using MirrAi Coach, you agree to this Privacy Policy and our Terms of Service.

2. Information We Collect

We only collect what's necessary to operate, secure, and improve MirrAi Coach:

2.1 Information You Provide Directly

• Email address. Used for passwordless ("magic link") login, session summaries, receipts, and essential account communications.
• Session content & summaries. We process your chat inputs with the AI in real time but do not store full transcripts. At the end of each session we generate and save a brief summary of the key points you choose to keep.
• Payment details. All payments go through Stripe. From Stripe we receive and store only:
  • Stripe customer ID and/or transaction ID
  • Payment method type (e.g. Visa), last four digits and expiration date
  • Amount paid
  • Your email (to match the transaction to your account)
  We do not store full card numbers or CVV codes.
• Feedback & support messages. Anything you submit via our feedback form or support email is kept so we can respond to your request and improve the Service.

2.2 Information Collected Automatically

• Log data. Technical details such as IP address, device and browser type, operating system version, timestamps (e.g. login time, session duration), and error reports. We use this to monitor performance, troubleshoot issues, and detect abuse. Logs are stored only as long as needed for security and maintenance, then deleted or anonymized in our routine workflows.
• Cookies and similar technologies.
  • Authentication cookie. Keeps you logged in during your active session (no passwords).
  • Cloudflare security cookie. Protects against malicious traffic and speeds up delivery.
  • Stripe cookies. Applied on Stripe's pages for fraud prevention and payment processing.

  Note: In this MVP we do not use any advertising or third-party analytics cookies (e.g. Google Analytics). If we add analytics or other SDKs in the future, we will update this Privacy Policy and obtain any required consents.

We also do not intentionally collect any sensitive personal data (such as racial or ethnic origin, health or biometric information, political opinions, etc.). For your own privacy, please avoid sharing highly sensitive details in your chat inputs.

3. How We Use Your Information

We process your personal data only for the purposes set out below and under the legal bases indicated:

3.1 To Provide and Operate the Service

(Legal basis: Performance of contract)

• Authenticate you via magic link and maintain your session.
• Forward your session inputs to the AI model and deliver the AI's responses.
• Generate and deliver your session summary.
• Process payments via Stripe and send transaction confirmations.
• Send essential account communications (e.g., login links, receipts, service announcements).

3.2 To Maintain, Secure & Improve the Service

(Legal basis: Legitimate interests)

• Analyze aggregated usage patterns (e.g., session counts, duration, error rates) to enhance performance and user experience.
• Review feedback and support requests to fix bugs and add features.
• Monitor logs and IP addresses to detect and prevent fraud or abuse.
• Perform security testing, incident response, and infrastructure maintenance.

You may object to processing based on our legitimate interests by contacting us at [email protected].

3.3 To Comply with Legal Obligations

(Legal basis: Legal obligation)

• Retain financial and transaction records (e.g., transaction IDs, amounts, dates) as required by UK law.
• Respond to data subject requests under GDPR, CCPA, and other applicable laws.
• Disclose data when required by valid legal processes (e.g., court orders, subpoenas).

3.4 Marketing & Promotional Communications

We may send you optional marketing communications—such as newsletters, product updates, feature announcements, or surveys—from MirrAi Chat LTD only. We will never share or sell your personal data to any third party for their marketing purposes. You can unsubscribe or opt out of these communications at any time via the unsubscribe link in each email or by contacting us at [email protected].

4. How We Share Your Information

We only share your personal data in the scenarios described below, under strict controls and only to the extent necessary:

4.1 Service Providers (Processors)

We engage trusted third-party providers to perform certain functions on our behalf. Each provider is bound by a contract that limits use to our instructions and requires appropriate safeguards. Key processors include:

• Supabase: Stores your email, session summaries, and feedback.
• Stripe: Processes payments; we receive only customer IDs, transaction IDs, payment method metadata, amount, and your email.
• Google Cloud / Gemini AI: Hosts and runs the AI model; processes session content to generate responses.
• Cloudflare: Provides security (DDoS protection) and content delivery; logs IP addresses and request metadata.
• Email Delivery Service: Delivers magic links, session summaries, receipts, and marketing communications.

4.2 Internal Sharing

Within MirrAi Chat LTD, access to your personal data is restricted to employees or contractors who need it to perform their roles. All personnel are bound by confidentiality and data-protection obligations.

4.3 Legal Requirements

We may disclose personal information if required by law or valid legal process (e.g., court orders, subpoenas), to protect our rights, enforce our Terms, or ensure the safety of users or the public. Where permitted, we will notify you before disclosure.

4.4 Business Transfers

If MirrAi Chat LTD is involved in a merger, acquisition, sale of assets, or other corporate reorganization, your personal data may be transferred to the successor entity. We will require the successor to honor this Privacy Policy and will notify you of any material changes.

4.5 Aggregated or Anonymized Data

We may aggregate or anonymize usage data (so that it can no longer be linked to you) and use or share it for research, analytics, or product improvement. Such data contains no personal identifiers.

4.6 No Third-Party Marketing

We do not sell, rent, or share your personal data with any third party for their marketing or advertising purposes.

5. International Data Transfers

To provide and support MirrAi Coach, we may transfer your personal data to our trusted third-party service providers (e.g., Stripe, Supabase, Google Cloud/Gemini, Cloudflare, and our email delivery service) located in jurisdictions outside the UK and EEA, including the United States.

All such providers act as "data processors" under our instructions and are bound by Data Processing Agreements that include Standard Contractual Clauses or equivalent safeguards required by UK and EU law. These agreements ensure that your personal data continues to receive the same level of protection and your rights remain enforceable.

By using MirrAi Coach, you consent to these international transfers. For more information or to request a copy of our Data Processing Agreements, please contact us at [email protected].

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy and to comply with applicable legal or regulatory requirements:

• Account Information & Session Summaries. We keep your email address and session summaries for as long as your account is active or until you request deletion. Upon request or account closure, we remove or anonymize your personal identifiers as part of our standard data-removal processes.
• Payment Records. We retain transaction details (e.g., transaction ID, amount, date) for the period required by law for accounting and tax purposes in the UK. When you delete your account, we dissociate personal identifiers from these records while preserving only what is necessary for legal compliance.
• Feedback & Support Correspondence. We store any feedback or support emails for as long as needed to resolve your request and to support service improvements.
• Log Data. Technical logs (IP addresses, device/browser info, timestamps, error reports) are kept only as long as needed for security monitoring, troubleshooting, and maintenance, after which they are routinely deleted or anonymized.
• Backups. Personal data may persist in secure backups for a limited period; such data is isolated from active systems and is permanently deleted or anonymized in accordance with our backup retention policy.

When data is no longer necessary for its original purpose or required by law, we either delete it permanently or aggregate/anonymize it so that it can no longer be linked to an individual.

7. Your Rights

You have certain rights regarding your personal data under various data protection laws. To exercise any of these rights, please contact us at [email protected].

7.1 Rights under UK/EU GDPR

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Ask us to correct incomplete or inaccurate data.
• Right to erasure ("right to be forgotten"): Request deletion of your personal data where we have no lawful reason to retain it.
• Right to restrict processing: Ask us to limit processing while you contest accuracy or object.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on our legitimate interests.
• Right to withdraw consent: If we rely on consent for any processing, you may withdraw it at any time.
• Right related to automated decision-making: You have the right not to be subject to solely automated decisions that produce legal or similarly significant effects.

We will respond to UK/EU data requests within 30 days (or up to 60 days if necessary, with notice). You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).

7.2 Rights under California Consumer Privacy Act (CCPA/CPRA)

If you are a California resident, you additionally have the right to:

• Know: Request disclosure of the categories of personal data we have collected, sources, purposes, and third parties shared with.
• Delete: Request deletion of personal information we have collected, subject to certain exceptions.
• Correct: Request correction of inaccurate personal information.
• Opt-out of sale/sharing: Although we do not sell or share your data for advertising, you have the right to opt out if this changes.
• Limit use of sensitive data: Request limits on our use of any sensitive personal information.
• Non-discrimination: You will not be discriminated against for exercising your CCPA rights.

We will respond to California privacy requests within 45 days (or 30 days with a 15-day extension if reasonably necessary). You also have the right to contact the California Attorney General or the California Privacy Protection Agency.

7.3 Other Jurisdictions

Where local data protection laws apply, you may have additional rights (for example, under Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act, South Africa's POPIA, Japan's APPI, etc.). To learn more or exercise any rights beyond those listed above, please contact us at [email protected].

8. Data Security

We implement reasonable technical and organizational measures to help protect your personal data, including:

• Encryption in transit. All data exchanged between your device and our servers is transmitted over HTTPS/TLS.
• Access controls. Access to personal data is limited to authorized personnel and service providers on a need-to-know basis.
• Regular updates. We keep our systems and dependencies up to date to address known vulnerabilities.
• Basic monitoring. We monitor for obvious security issues and address incidents as they arise.

Please note that no system is entirely risk-free. We do not make any guarantees of absolute security or commit to specific breach-notification timelines at this MVP stage. If you suspect unauthorized access or other security concerns, contact us at [email protected].

9. Children's Privacy

MirrAi Coach is intended for use only by individuals aged 18 or older. By accessing the Service, you confirm that you meet this age requirement. We do not knowingly collect personal data from anyone under 18. If we learn that we have received personal data from a minor, or if a parent or guardian requests deletion of a child's data, please contact us at [email protected], and we will delete that information upon request.

10. Third-Party Links and Services

MirrAi Coach may contain links to third-party websites or services (for example, payment pages hosted by Stripe or external resources). This Privacy Policy applies only to information collected by MirrAi Chat LTD. We are not responsible for the privacy practices, content, or security of any third-party site. When you follow links to other websites, please review their privacy policies and terms before submitting any personal data.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time by revising the "Last Updated" date at the top. If we make material changes that significantly affect how we use your personal data, we will make reasonable efforts to notify you—such as by email or in-app notice.

We encourage you to review this Privacy Policy periodically. Your continued use of MirrAi Coach after any changes take effect indicates your acceptance of the revised policy.

12. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: [email protected]

Postal Address:

MirrAi Chat LTD

71-75 Shelton Street

Covent Garden, London, WC2H 9JQ, UNITED KINGDOM

We will make reasonable efforts to respond to inquiries promptly.