Privacy Policy

This policy applies to mirra.page, app.mirra.page and the Mirra service. For the personal data described here we are the “data controller”, as defined by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you are in the European Economic Area, the EU GDPR gives you equivalent rights.

Who we are

Mirra is a product operated by Mirra Tech LTD, a company registered in England and Wales (company number 17358343), with its registered office at Unit A, 82 James Carter Road, Mildenhall, IP28 7DE. We are registered with the UK Information Commissioner's Office (ICO) under ZC209668. For any privacy question, contact us at privacy@mirra.page.

The data we collect

• Account data: your name, email address, company name and login details when you sign up for Mirra.
• Billing data: billing name, address, plan, any promotion code used and transaction records. Card details are collected and processed by Stripe; we never see or store full card numbers.
• Enquiries: what you enter in our contact, enterprise or full conversion forms (name, email, company or website, and your message), and any emails you send us.
• Affiliate applications: your name, email, website or company, and what you tell us about your audience. If you are accepted, the payout details you give us (PayPal or Wise account) and records of referrals and commission.
• Site data: the URLs and public content of websites you ask us to speed up or convert, and the performance metrics we generate for them.
• Usage and device data: IP address, browser and device type, pages visited and how you interact with them. On this website, analytics are only collected if you agree to them (see our Cookie Policy). We also process IP addresses to protect our forms from spam and abuse.

How and why we use it

• To provide the service (contract): creating and running your account, capturing and serving your site, billing, and support.
• To answer enquiries and affiliate applications (legitimate interests, or steps before entering a contract): replying to you and assessing applications.
• To keep the service secure and working (legitimate interests): preventing fraud, spam and abuse, and fixing problems.
• To understand and improve the website (consent): analytics and session insights, only where you have accepted them.
• Marketing emails (consent, or for existing customers our legitimate interest in telling you about similar services): you can unsubscribe from any marketing email with one click, at any time.
• To meet legal obligations: tax, accounting and other legal requirements.

We do not sell your personal data, and we do not make decisions about you by automated means that have legal or similarly significant effects.

Who we share it with

We use trusted service providers who process data on our behalf, under contracts that require them to protect it and use it only on our instructions:

• Cloudflare: website and application hosting, edge delivery, and form handling.
• Stripe: payments and subscription billing.
• Google: Google Workspace (our email) and, with your consent, Google Analytics via Google Tag Manager.
• Microsoft Clarity: with your consent, anonymised session insights such as heatmaps and session replays, used to improve the website.
• Resend: delivering the emails we send, such as confirmations and replies.
• Klaviyo: managing our email lists, including launch offer and affiliate communications.
• PayPal or Wise: paying affiliate commission.

We may also disclose data where required by law, to protect our rights, or to a buyer or successor if our business is sold or reorganised.

When we act for you (your site’s visitors)

When Mirra serves your website, requests from your visitors pass through our infrastructure. For that visitor data we act as a “processor” on your behalf, and you remain the controller responsible for your own privacy notice and cookie consent. We only process it to serve and secure your site. A data processing agreement is available on request from privacy@mirra.page.

International transfers

Several of these providers are based in, or access data from, the United States and other countries outside the UK. Where that happens we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework), or on the International Data Transfer Agreement or Addendum, to keep your data protected to UK standards.

How long we keep it

• Account and site data: while your account is open, then deleted within 90 days of closure.
• Billing and tax records: 6 years after the end of the financial year they relate to, as UK law requires.
• Enquiries and unsuccessful affiliate applications: up to 24 months after our last contact.
• Affiliate payout records: 6 years, for tax purposes.
• Website analytics: up to 14 months in Google Analytics, and up to 13 months in Microsoft Clarity.
• Marketing lists: until you unsubscribe, after which we keep only what we need to respect that choice.

Your rights

Under data-protection law you have the right to access, correct or delete your data, to restrict or object to our processing of it, to data portability, and to withdraw consent at any time (this does not affect processing already carried out). To exercise any of these, email privacy@mirra.page. We will respond within one month. You also have the right to complain to the ICO at ico.org.uk, though we ask you to contact us first so we can help.

Security

Data is encrypted in transit, access is limited to people who need it, and we use providers with strong security practices. No system is perfectly secure, but we will tell you and the ICO without undue delay if a breach puts your data at risk.

Children

Mirra is a business service and is not intended for anyone under 18. We do not knowingly collect children’s data.

Changes to this policy

We may update this policy from time to time. Changes will be posted here with an updated date, and we will tell account holders about material changes by email.