01Who we are and when this policy applies
MIRRO HQ, registered in Delaware, United States (“MIRRO”, “we”, “us” or “our”) operates MIRRO API and Mira. Our correspondence address is 2810 N Church St STE 90255, Wilmington, DE 19802, United States. Contact hello@mirroapi.com for privacy questions or requests.
This policy explains personal-data handling across our website, developer and trading APIs, prop-firm products, Website Studio, hosting and infrastructure services, Mira workspaces and APIs, integrations and support.
We determine how personal data is used for our own account administration, billing, security, website enquiries and service management. Where a business uses MIRRO to process its customers' data under its instructions, that business generally determines the purpose and is the controller; MIRRO acts as its service provider or processor for that processing. The applicable agreement defines those responsibilities.
If you use a firm's branded website or an assistant inside another business's application, read that business's privacy notice too. Your broker, payment provider, GitHub and other services you connect have their own practices. This policy does not replace them.
02Information we process
The information involved depends on the services you use:
- Account and business details: name, email, business name, role, contact details, account identifiers, authentication and verification records, workspace membership and settings.
- Trading information: broker and platform details, account identifiers, connection credentials or authorisation tokens, balances, equity, positions, orders, deals, signals, risk settings, consent records and execution outcomes.
- Firm and customer records: programme settings, account assignments, challenge progress, orders, customer identifiers, support cases and information supplied through an authorised integration. Identity documents are not needed for ordinary API signup; a firm's separately configured identity flow may involve additional information.
- Mira and project content: messages, instructions, uploaded files and images, source code, repository metadata, reference websites, business knowledge, tool inputs and results, generated output, task history, build logs, screenshots and deployment records.
- Voice information: audio you choose to submit for transcription and the resulting text. If you submit that text to a conversation, it becomes part of the relevant conversation or task.
- Payment information: purchases, invoices, amounts, currency, payment status, transaction references and limited payment-method details returned by a processor. For blockchain payments, this can include wallet addresses and public transaction identifiers. Card entry is handled by the payment provider; do not send full card details to support or Mira.
- Technical and usage information: IP address, approximate country derived from network information, browser/device information, request identifiers, timestamps, features used, token or compute usage, errors, security events and service performance.
- Communications: enquiries, support messages, feedback and the records needed to respond.
03Where information comes from
We receive information directly from you, your workspace owner or employer, authorised customer applications, connected brokers and platforms, payment providers, repositories and other integrations you enable. We also receive technical information when your device or application accesses our services.
Website-learning and browsing features can retrieve public pages or material you authorise us to access. Public availability does not remove privacy or intellectual-property obligations. Do not ask MIRRO to collect private or restricted information without the necessary permission.
04How and why we use information
- Provide the service: create accounts, authenticate access, connect platforms, process your instructions, run tools, host content, deliver account and challenge workflows, and provide customer support.
- Operate and bill: record usage, manage subscriptions and credit, reconcile transactions, maintain service records and communicate about your account.
- Protect the service: prevent unauthorised access, detect abuse, investigate incidents, enforce access controls and resolve disputes.
- Maintain and improve: investigate errors, assess performance and understand how features are used. Relevant content may be reviewed when you request support, report an issue or when reasonably necessary for security and service operation.
- Meet legal obligations: comply with lawful requests, preserve required records and protect legal rights.
- Communicate: respond to enquiries and send service notices. Marketing communications, where offered, follow your choices and applicable consent rules.
Where applicable data-protection law requires a legal basis, we rely on performance of a contract or steps you request before a contract, our legitimate interests in operating and protecting the service where those interests do not override your rights, legal obligations, or consent where required. If another business is the controller, it is responsible for its legal basis and instructions.
05Mira, AI processing and knowledge
Mira sends the context needed for an AI request to the configured inference infrastructure. This can include your messages, relevant project files, selected business knowledge, images and tool results. Avoid including information unrelated to the task. Customer integrations should return only the fields needed for the authorised action.
MIRRO currently uses open-weight models through Cloudflare Workers AI. Cloudflare's Workers AI data-usage terms describe its handling of inference content. Provider processing is separate from the task history, knowledge, output and records MIRRO saves to deliver your workspace. “No model training” does not mean that your MIRRO workspace stores nothing.
We do not use private customer prompts, repositories, documents or conversations to train a general-purpose shared AI model unless you separately agree to that use. Adding business knowledge makes it available to the authorised assistant as context; it does not automatically train a shared model.
Saved task state and scoped caches help continuity and reduce repeated work. The optional public-answer cache is for content your application explicitly identifies as public; it is separated by business, key and owner and expires within its configured short lifetime. Private customer records and conversations are not eligible for that public-answer cache.
AI output can contain incorrect information, including about people. Ask for correction or deletion of personal information through the contact route below. Generated content and automated actions remain subject to the review and controls described in our Terms of Service.
07Cookies, browser storage and analytics
Our websites and applications use cookies or browser storage for functions such as authentication, security, navigation, saved preferences, country or currency selection and recovery of work. Some functionality will not work if you disable or clear the necessary storage. Signing out and revoking access are separate from clearing your browser.
The public website uses Cloudflare Web Analytics to understand page performance and traffic. Cloudflare describes this service as privacy-first analytics. Network delivery and security still involve processing technical connection information.
We do not use advertising cookies for cross-site behavioural targeting. Where optional tracking requires consent, it must be enabled only after that consent. Browser privacy controls can restrict storage and requests. We do not use a “Do Not Track” signal to change essential service processing; we honour applicable opt-out rights and recognised signals where required by law.
08How long information is kept
We keep information for the purposes described here, considering the active service, your instructions, security, billing, legal requirements and disputes. Different records have different lifetimes:
- Workspace content: account details, projects, saved tasks, business knowledge and support records remain available while needed to provide the workspace, until an applicable deletion process or agreed retention rule applies.
- API audit traffic: ordinary trading API audit events follow a 180-day retention rule. Payment evidence and other records needed for accounting, disputes or legal obligations may be retained longer.
- Recoverable Mira responses: the recoverable-response endpoint limits payload access to 24 hours. Payload cleanup occurs as records are processed; this is not a promise that every physical copy is erased at precisely 24 hours. Other Mira task histories and saved business knowledge have separate lifecycles.
- Short-lived caches: temporary request and task caches expire or are evicted. The optional public-answer cache is limited to a maximum of five minutes. A cache expiry does not delete the underlying workspace record.
- Billing and security evidence: transaction references, usage and request identities may remain after content deletion where needed to reconcile charges, prevent duplicate actions, meet legal obligations or resolve disputes.
- Backups: deleted information may remain in protected backups until those copies are replaced or expire. A deletion request does not erase an independent broker, provider or public blockchain record.
Contact us to request deletion, an export or information about retention for a particular service. We will explain any legal or operational reason that prevents deletion and retain only what is needed for that reason.
09Security and access
We use measures appropriate to the service, including access controls, protected transport, workspace separation, restricted credential handling, authentication and operational monitoring. Connected secrets use protected storage where required for the integration. Access to customer content is limited to authorised people and systems that need it to provide, secure or support the service.
No internet service is completely secure. Protect your devices and credentials, use available multi-factor authentication, review team access and remove integrations you no longer need. Report suspected compromise to hello@mirroapi.com. We will provide incident notifications where required by applicable law or our agreement.
10International processing
MIRRO operates across borders. Information may be accessed or processed in the United States and other countries where our infrastructure providers, authorised personnel or connected services operate. The country in your account or billing preferences is not a promise that all data remains in that country.
Where a transfer is restricted by applicable law, an appropriate lawful mechanism and safeguards are required, such as an applicable adequacy decision or approved contractual safeguards. Contact us for the arrangements relevant to your service and to request information about applicable safeguards. We do not claim that MIRRO is certified under the EU–US Data Privacy Framework or that every plan provides regional data residency.
11Your choices and privacy rights
Depending on where you live and the law that applies, you may have rights to access or obtain a copy of your personal information, correct it, request deletion, restrict or object to processing, receive portable information, withdraw consent, or appeal a refused request. You may also have rights relating to significant decisions based solely on automated processing.
Write to hello@mirroapi.com with “Privacy request”, the account email or service involved and what you want us to do. We may ask for information reasonably needed to verify your identity or an authorised representative's authority. Do not send passwords, API keys or identity documents unless we provide an appropriate secure route.
We respond within the period required by applicable law and explain any valid exception or extension. We will not discriminate against you for exercising a protected privacy right. If you disagree with our response, reply asking for a review and explain your concern.
If we process the information for another business, direct the request to that business first. We will assist as required by our agreement and the law, rather than disclose another business's customer records to an unverified requester.
You can also complain to your competent data-protection authority, including an EEA supervisory authority, the UK Information Commissioner's Office, or the Nigeria Data Protection Commission, where applicable.
12Additional US state information
Where applicable US state privacy law covers our processing, the categories, sources, purposes and recipients are described above. Categories may include identifiers, commercial and transaction information, internet activity, professional information, approximate location, audio or visual content you submit, and sensitive information such as authentication or financial-account access details when necessary to provide the service.
We use sensitive information for requested services, security and other permitted purposes, not to infer personal characteristics for advertising. We do not sell personal information or share it for cross-context behavioural advertising, including information about people we know are under 16.
Eligible residents may use the contact method above to exercise access, correction, deletion, portability, opt-out, limitation or appeal rights under their applicable law. California residents can find more information from the California Attorney General. These disclosures do not limit rights under other applicable laws.
13Children and restricted information
MIRRO API accounts and services are intended for adults aged 18 or older. We do not knowingly collect children's personal information to provide them with an account. If you believe a child has supplied information, contact us so we can investigate and take appropriate action.
A business integrating Mira is responsible for its audience, age-appropriate design and any parental-consent obligations. Do not use the services for children's data or specially regulated information unless the applicable service agreement and legal requirements support that use.
14Policy changes and contact
We will update this policy when our practices change and show the revised effective date. We will provide additional notice of material changes where appropriate or required, and obtain consent before a new use where the law requires it. Publishing an update does not remove rights concerning information previously collected.
MIRRO HQ
2810 N Church St STE 90255
Wilmington, DE 19802, United States
hello@mirroapi.com
+1 302 384 5660