Legal
Privacy Policy
Last updated October 1, 2026
1. Who We Are
MIRRA IDENTITY, LLC, a Delaware limited liability company, operates MIRRA. In this Privacy Policy, "MIRRA," "we," "us," and "our" refer to MIRRA IDENTITY, LLC.
This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use our mobile applications, website at mirra.co, public profiles, digital cards, Digital Personas, and related services, collectively the "Platform."
It also explains how we handle information about people who do not have a MIRRA account, including visitors and people whose information users provide through the Platform.
"Personal information" means information that identifies, relates to, or can reasonably be linked to a person, as defined by applicable law.
This Privacy Policy provides notice of our practices. It does not replace any separate consent or permission required by law. Our Terms of Use separately govern use of the Platform.
2. Important Things to Know
- Information you make public through a profile, digital card, or Digital Persona may be viewed, copied, shared, or indexed by others.
- When you interact with another person's Digital Persona, your conversation and related information may be available to that person. These conversations are not confidential communications solely between you and MIRRA.
- We use service providers, including AI providers, to operate features of the Platform. Relevant information may be sent to those providers as described below and through applicable feature notices.
- We do not sell personal information or share it for cross context behavioral advertising. We have not done so during the preceding 12 months.
- We do not currently use personal information to train general purpose large language models. We do not use private direct messages as a general purpose AI training dataset.
- Deleting the app from your device does not delete your MIRRA account.
3. Information We Collect
3.1 Information You Provide
Depending on the features you use, we collect:
- Account information. Your name, email address, phone number, username, authentication information, account preferences, and verification information.
- Profile information. Photos, videos, biography, professional or educational information, company, interests, skills, links, contact details, location, travel status, Life Slides, and other information you add to your profile or digital card.
- Communications. Direct messages, attachments, voice recordings, reactions, connection requests, Digital Persona conversations, and information submitted through contact or lead forms.
- Digital Persona and knowledge information. Files, text, instructions, memories, dictation, preferences, and other materials you provide to configure or support AI features, including a Digital Persona or Knowledge Hub.
- Search and interaction information. Search queries, prompts, filters, feedback, and requests submitted to Platform features.
- Contact information. Contacts you save, notes, tags, meeting details, and information you choose to enter about another person.
- Support information. Messages to us, troubleshooting information, feedback, survey responses, and information submitted through waitlists or other forms.
Where an invitation feature uses your device's contact picker, contact selection occurs on your device with the applicable permission. We do not upload your entire address book merely because you open that picker. Information you separately select, save, submit, or share through a Platform feature may be processed by MIRRA.
3.2 Information Collected Automatically
We collect information about your device and use of the Platform, including:
- Device information. IP address, device identifiers, operating system, browser, app version, language, time zone, and notification identifiers.
- Usage information. Pages and features accessed, searches, taps, interactions, referral information, profile visits, link activity, QR code activity, timestamps, and notification engagement.
- Diagnostic information. Error reports, crash information, performance measurements, logs, and, on supported web experiences, sampled session replay information.
- Location information. Approximate location derived from your IP address, location you enter, and precise device location when you grant the relevant permission.
- Cookies and similar technologies. Information collected through cookies, local storage, software development kits, and similar technologies described in Section 9.
3.3 Information From Other Sources
We may receive information from:
- Other users who save your contact information, send invitations, upload materials containing your information, or interact with you.
- Authentication providers, such as Apple or Google, including the information you authorize them to share.
- Services you connect to MIRRA, within the permissions you grant.
- Providers supporting verification, geocoding, delivery, security, and other Platform functions.
- App stores or operating systems that provide applicable account, transaction, or age related signals.
3.4 Inferences
We may derive information such as interests, likely relevant connections, approximate location, conversation summaries, interaction patterns, and other insights from the information described above.
We may create embeddings or similar mathematical representations to support search, retrieval, and recommendations. These representations are not automatically anonymous and remain subject to this Privacy Policy when they constitute personal information.
3.5 Sensitive Information
Some features may involve sensitive information, including precise location, account credentials, private communications, or sensitive information you choose to include in content.
Do not submit government identification numbers, financial account credentials, medical records, or other highly sensitive information unless a feature expressly requests and supports that information.
Providing information through a general upload field does not replace any separate consent or protection required by law.
4. How We Use Information
We use personal information to:
- Create, authenticate, maintain, and secure accounts.
- Provide profiles, digital cards, messaging, connections, saved contacts, Digital Personas, and other requested features.
- Process searches, retrieve relevant information, generate responses, and personalize discovery and recommendations.
- Display or share information according to your actions, settings, and the relevant feature.
- Send verification messages, service notices, security alerts, support responses, and other operational communications.
- Send optional promotional communications where permitted, subject to applicable consent and unsubscribe requirements.
- Measure performance, diagnose problems, evaluate feature quality, and improve the Platform, subject to the AI limitations in Section 6.
- Detect and address fraud, spam, abuse, security incidents, and violations of our terms.
- Screen public content, such as profiles, statuses, links, group names, and photos, with automated tools to detect content that violates our Terms.
- Comply with legal obligations, maintain necessary records, resolve disputes, and protect lawful rights.
- Evaluate or complete a corporate transaction, subject to appropriate confidentiality and privacy protections.
Authorized personnel may access information when reasonably necessary for these purposes, subject to appropriate access restrictions and confidentiality obligations.
We do not treat private messages as a general marketing dataset. Private messages are not sent to AI providers for moderation. We do not rely on this Privacy Policy as blanket permission for materially different or incompatible uses.
5. Aggregated and Deidentified Information
We may create and use aggregated or deidentified information for analytics, research, product development, and other lawful business purposes.
Where required by law, we maintain reasonable measures to prevent identification, commit not to attempt reidentification except as legally permitted, and require recipients to follow applicable restrictions.
Removing a name alone does not necessarily make information deidentified.
6. AI Features and Digital Personas
6.1 How AI Processing Works
AI features may process prompts, conversations, uploaded materials, profile information, recordings, transcripts, images, and other relevant inputs to provide responses, retrieval, summaries, transcription, recommendations, safety checks, or requested media generation.
We send relevant information to providers supporting the feature. We seek to limit the information sent to what is reasonably necessary for the requested processing.
6.2 Digital Persona Visibility
A Digital Persona may use information supplied by its owner to answer questions from other people. Information placed in its knowledge sources may appear in responses, depending on the feature and settings.
Only provide information you are authorized to use for that purpose.
Conversations with a Digital Persona may be stored and made available to its owner, including conversation content and related insights. If you are signed in, those interactions may be associated with your account. Interactions without an account may still involve technical identifiers.
AI responses may be inaccurate or incomplete. A response does not necessarily represent the owner's actual statement, approval, or commitment.
6.3 Permission and Choices
Where required, we request explicit permission before sending personal information to an external AI provider. Relevant notices identify the processing and recipients as required.
You may decline an optional AI feature. The feature may not function without the information needed to provide it.
You may withdraw applicable consent through available settings or by contacting support@mirra.co with the subject "AI Privacy Request." Withdrawal applies prospectively and does not make earlier lawful processing unlawful.
Stopping use of the app does not automatically disable an existing Digital Persona or delete its knowledge sources. Use the available controls or contact us to request those actions.
6.4 Evaluation and Model Training
We may evaluate inputs, outputs, feedback, and feature performance to diagnose problems, improve reliability, and assess safety, consistent with applicable notices, permissions, and law.
We do not currently use personal information to train general purpose large language models. We do not use private direct messages for that purpose.
If we propose a material change to these practices, we will provide appropriate notice and obtain any required consent before implementing it. Updating this Privacy Policy alone does not override an existing consent requirement or prior binding commitment.
Provider processing and retention depend on the relevant service, configuration, and contractual terms. We do not represent that every provider retains information for zero time.
6.5 Optional Media Features
Optional photo animation or other media features may send selected images and instructions to providers such as BytePlus ModelArk or Google Vertex AI.
Only submit images you are authorized to use. Where a feature involves processing that requires a separate biometric or sensitive information notice or consent, we must provide that notice and obtain the required consent before that processing.
7. How We Disclose Information
7.1 Public Information
Information you publish may be available to other users, visitors, search engines, and people outside the Platform.
Public information may be copied or stored by others. Changing visibility or deleting content from MIRRA does not automatically remove independently maintained copies.
7.2 Other Users and Intended Recipients
We disclose information when you direct us to do so, including through messages, connections, contact forms, shared profiles, Digital Personas, and other interactive features.
Profile or Digital Persona owners may receive interaction analytics and information associated with relevant visits or conversations, depending on the feature and applicable notices.
Recipients may have their own privacy responsibilities. Their responsibilities do not eliminate MIRRA's obligations for processing we control.
7.3 Service Providers
We use providers for infrastructure, authentication, storage, AI processing, communications, analytics, diagnostics, and security.
Principal providers include:
- OpenAI: AI responses, retrieval, transcription, summaries, search support, and safety processing, including automated screening of public profile content and images.
- Cohere: Ranking and retrieval support for knowledge features.
- Reducto: Extraction and processing of uploaded knowledge materials.
- BytePlus ModelArk and Google Vertex AI: Optional media generation or animation.
- Supabase: Authentication and database services.
- Vercel: Hosting and web infrastructure.
- Cloudflare: Storage, content delivery, and related infrastructure.
- Trigger.dev and Upstash: Background processing, infrastructure support, and rate limiting.
- PostHog: Product analytics.
- Sentry: Diagnostics, performance monitoring, and sampled web session replay.
- OneSignal: Push notifications.
- Resend: Email delivery.
- Twilio: SMS delivery and verification.
- Google: Authentication.
- Apple: Authentication and map related services.
- Giphy: GIF search and delivery.
- Expo: Application update delivery.
Providers receive information relevant to their functions, subject to applicable agreements and legal requirements. Some integrations also involve independent provider processing under their own notices.
This list does not identify every infrastructure subprocessor. Providers may change, but changes remain subject to our privacy commitments, applicable notice obligations, and any required consent.
7.4 Connected Services
When you choose to connect or interact with an external service, information may pass between MIRRA and that service according to your permissions and the feature.
Review that service's privacy information. MIRRA remains responsible for its own processing.
7.5 Corporate Transactions
We may disclose information in connection with financing, investment, a merger, acquisition, reorganization, sale of assets, bankruptcy, or a similar transaction.
Appropriate confidentiality protections apply where relevant. A transaction does not eliminate existing privacy commitments or applicable legal requirements.
7.6 Legal and Safety Purposes
We may disclose information when reasonably necessary to comply with law or valid legal process, investigate abuse, enforce applicable terms, protect security, or protect the rights and safety of MIRRA, users, or others.
7.7 Affiliates and Authorized Disclosures
We may disclose information to affiliates assisting with the purposes described in this Privacy Policy, subject to appropriate protections, or when you authorize a particular disclosure.
8. Location Information
Location features may use location you enter, approximate location derived from your IP address, or precise device location when you grant permission.
Location may support maps, meeting context, location attached to a shared interaction, or relevant discovery features.
The audience for location information depends on the feature and your choices. Permission to access device location does not by itself authorize making all location information public.
You can revoke device location permission through your device settings. Revocation stops future access through that permission but does not automatically delete previously stored or shared information.
You may edit or request deletion of stored location information, subject to applicable retention obligations.
9. Cookies, Analytics, and Similar Technologies
We use cookies, local storage, and similar technologies to support authentication, preferences, security, performance, and analytics.
On supported web experiences, sampled session replay may capture interactions such as clicks, scrolling, and displayed content. We use configuration and masking measures intended to reduce collection of sensitive information, but these measures should not be understood as a guarantee that recordings cannot contain personal information.
Mobile technologies may support analytics, crash reporting, updates, and notifications. Some information may be associated with an account or device.
Where required, we obtain consent before using nonessential technologies. Browser controls may not control every technology used in a mobile app.
We honor legally required browser based privacy signals, including Global Privacy Control where applicable. Such signals do not automatically disable processing necessary to provide the service. We do not otherwise respond to every "Do Not Track" signal.
10. Your Choices
You may use available controls to:
- Edit account and profile information.
- Adjust supported visibility and sharing settings.
- Manage device permissions and notifications.
- Disconnect external services.
- Manage or disable supported AI features.
- Request account deletion.
You can unsubscribe from promotional email using the message's unsubscribe option. We may still send necessary service, transaction, or security communications.
Disconnecting an integration does not automatically delete information already imported. Request deletion separately where needed.
Account deletion is available through supported account settings or by contacting support@mirra.co. People without an account may also submit privacy requests.
11. Retention and Deletion
We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, considering the type and sensitivity of information, the service provided, user expectations, security needs, legal obligations, and applicable limitation periods.
Our retention criteria include:
- Account and profile information: Maintaining your account and requested profile features until deletion or an earlier applicable retention limit.
- Messages and Digital Persona conversations: Providing communication and conversation history, subject to applicable deletion rights and legal obligations.
- Knowledge materials and embeddings: Supporting the associated knowledge feature, subject to removal requests and any limited lawful retention.
- Recordings and transcripts: Completing requested processing and necessary troubleshooting. Saved transcripts may have a different retention period from temporary recordings.
- Location information: Providing the relevant feature and maintaining necessary contextual or security records.
- Analytics, diagnostics, and replay information: Measuring performance, diagnosing problems, and protecting the Platform for reasonably necessary periods.
- Support, consent, and compliance records: Handling requests, demonstrating compliance, resolving disputes, and meeting legal obligations.
- Safety reports and moderation records: when you report content, we keep a copy of the reported content and related recent messages as evidence, even if it is later deleted, for up to 1 year after the report is resolved, or longer where required by law.
When a valid deletion request applies, we delete or deidentify relevant information and instruct applicable providers as required by law.
We may retain limited information where necessary for legal compliance, fraud prevention, security, dispute resolution, or another legally permitted reason. Retained information remains protected and is not used for unrelated purposes.
Backup copies may remain until overwritten through the applicable backup cycle. Information retained only in backups is restricted from ordinary use, subject to necessary recovery and legal requirements.
Copies maintained independently by other people may remain outside our control. This does not excuse MIRRA from deleting information under its control when required.
12. Privacy Rights
Depending on your location and applicable law, you may have rights to:
- Know whether we process your personal information and obtain information about that processing.
- Access or obtain a portable copy of your information.
- Correct inaccurate information.
- Request deletion.
- Withdraw consent.
- Object to or restrict certain processing.
- Opt out of covered targeted advertising, sales, sharing, or certain profiling.
- Limit certain uses of sensitive information.
- Appeal a decision about a privacy request.
Submit requests through available settings or email support@mirra.co with the subject "Privacy Request."
Provide enough information for us to identify the relevant records. We may verify identity and authority using measures proportionate to the request. We will not require verification for requests where applicable law prohibits it.
Authorized agents may submit requests with appropriate evidence of authority.
We respond within applicable legal deadlines. We may deny or limit a request where law permits, including to protect another person's rights or comply with legal obligations. Where required, we explain our decision and available appeal rights.
To appeal, email support@mirra.co with the subject "Privacy Appeal."
We do not unlawfully discriminate against people for exercising privacy rights. Some features cannot function without information reasonably necessary to provide them.
12.1 California Disclosures
During the preceding 12 months, the categories of information we may have collected, depending on use of the Platform, include:
- Identifiers and contact information.
- Account and customer records.
- Internet, electronic activity, and device information.
- Approximate and precise geolocation.
- Audio, visual, and electronic content.
- Professional and educational information supplied through the Platform.
- Protected characteristics voluntarily supplied or otherwise lawfully processed.
- Inferences derived from personal information.
- Sensitive personal information, including credentials, precise location, and private communications.
The sources, purposes, recipient categories, and retention criteria are described in Sections 3 through 11. Disclosures may include service providers, intended recipients, and public audiences when information is published.
We do not sell personal information or share it for cross context behavioral advertising, and have not done so during the preceding 12 months. We do not have actual knowledge of selling or sharing information of people under 16 for those purposes.
We do not disclose personal information to independent third parties for their own direct marketing.
Where our use of sensitive personal information creates a legal right to limit that use, we provide the required means to exercise that right.
12.2 European Economic Area, United Kingdom, and Switzerland
MIRRA IDENTITY, LLC is the controller for processing described in this Privacy Policy where we determine its purposes and means.
Our legal bases depend on the processing and may include:
- Contract: Processing objectively necessary to provide services you request under an applicable contract.
- Legitimate interests: Proportionate processing for security, service improvement, relevant recommendations, and business operations, after considering your rights and reasonable expectations.
- Consent: Processing requiring consent, including certain device access, optional technologies, marketing, or sensitive information processing.
- Legal obligations: Processing necessary to comply with applicable law.
Where special category information is involved, we must also have an applicable additional legal condition. Legitimate interests alone do not satisfy that requirement.
You may object to processing based on legitimate interests and to direct marketing. You may withdraw consent without affecting earlier lawful processing.
You may complain to an appropriate supervisory authority, including in the country where you live, work, or believe an infringement occurred.
13. Security
We use reasonable technical and organizational safeguards designed to protect personal information.
No system is completely secure. We cannot guarantee that unauthorized access, loss, or misuse will never occur.
Do not assume that direct messages are encrypted from end to end. Protect your device and account credentials, and notify us promptly if you suspect unauthorized access.
We provide security incident notifications when required by applicable law.
14. International Processing
MIRRA and its providers may process information in the United States and other countries, including locations where infrastructure and AI providers operate. Optional media processing may involve providers operating in the Asia Pacific region.
Privacy laws in those locations may differ from those where you live.
Where required, we use appropriate transfer safeguards, such as adequacy decisions, standard contractual clauses, and applicable supplementary measures.
You may contact us for information about relevant safeguards and available copies, subject to lawful redactions.
This Privacy Policy does not serve as blanket consent for international transfers where another legal mechanism is required.
15. Children and Teenagers
The Platform is not intended for children under 13, or under 16 in the European Economic Area and United Kingdom, unless a higher minimum age applies by law.
An app store age rating does not override these eligibility requirements.
Where parental or guardian permission is legally required for an eligible minor, that permission must be obtained.
We do not knowingly collect personal information from children below the applicable minimum age. If we learn that we have done so, we take appropriate steps to delete the information and address the account.
Contact support@mirra.co with the subject "Child Privacy" if you believe a child has provided information contrary to these requirements.
Additional protections for teenagers apply where required by law.
16. Information About Other People
Only provide information about another person when you have the authority or other lawful basis to do so.
This applies to contacts, notes, invitations, messages, uploaded knowledge, photos, and other content.
Do not submit unnecessary sensitive information or assume that the ability to upload information authorizes public disclosure, marketing, or AI processing.
MIRRA remains responsible for any notice or other obligations that apply to its own processing of information received indirectly.
People whose information was provided by someone else may contact us to exercise applicable rights.
17. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes to the Platform, our practices, or legal requirements.
We will update the date above and provide additional notice where required. For material changes, we will provide appropriate notice before the change takes effect where required.
We will obtain any consent required for a new use. Continued use alone does not replace consent where consent is legally required.
18. Contact Us
MIRRA IDENTITY, LLC
Email: support@mirra.co
Website: mirra.co