Privacy Policy

Introduction

Mirsa (“we,” “us,” or “our”) is committed to protecting the privacy of individuals who access and use our Services. This Privacy Policy describes how we collect, use, share, and safeguard personal information through our website, applications, and any associated services, tools, or communications (collectively, the “Services”).

By accessing or using the Services, you agree to the practices described in this Privacy Policy and consent to the collection, use, and disclosure of your information as outlined herein. This Policy is incorporated into and forms part of our Terms and Conditions. If you do not agree with our practices, please do not use the Services.

We handle your personal information in accordance with applicable data protection laws, including the California Consumer Privacy Act (CCPA), the General Data Protection Regulation (GDPR), and other relevant privacy laws.

Information We Collect

Information You Provide Directly

• Account Information: Name, email address, profile picture, and other registration details when you create an account (including via Google OAuth through Supabase Auth).
• Billing and Payment Information: Transaction records and payment method details processed through Stripe. We do not store full credit card numbers on our servers.
• Chat Inputs and Conversations: The content of prompts, messages, and conversations you enter into our platform, including associated metadata such as timestamps, selected AI model, and session identifiers.
• Support Communications: Contact details and content of communications when you reach out for support or feedback.

Information Collected Automatically

• Device and Technical Information: IP address, browser type, operating system, device type, screen resolution, and language settings.
• Usage Data: Interactions with our platform including features used, pages viewed, session duration, and navigation paths.
• Approximate Location: General geolocation inferred from your IP address.

Cookies and Tracking Technologies

We use cookies, pixels, and similar technologies to collect information about your browsing behavior and engagement with the Services. This includes data collected by our analytics providers (see Third-Party Services below).

How We Use Your Information

• To provide, operate, and maintain the Services, including processing your conversations through third-party AI providers.
• To improve and optimize the Services by analyzing usage patterns.
• To process payments and manage subscriptions via Stripe.
• To communicate with you about your account, updates, and support.
• To secure the platform, detect fraud, and enforce our policies.
• To comply with legal obligations.

Third-Party Services

We use the following third-party services to operate and improve our platform:

• Supabase: Authentication (email, Google OAuth) and PostgreSQL database for storing user accounts, conversations, and messages. Your data is stored on Supabase's infrastructure.
• Stripe: Payment processing for subscriptions and one-time purchases. Stripe processes your billing information in accordance with its own privacy policy.
• PostHog: Product analytics and session recordings to help us understand how users interact with the platform and improve the product. PostHog may collect page views, click and interaction events, feature usage data, device and browser metadata, and session recordings. All session recordings are treated as strictly confidential and accessed only by authorized personnel for product improvement purposes. We do not use PostHog to identify you personally or share this data with third parties for advertising. See PostHog's Privacy Policy.
• Microsoft Clarity: Behavioral analytics including heatmaps and session replays to diagnose UX issues and improve the user experience. We configure privacy features including content masking. Clarity may collect mouse movements, clicks, scrolls, and device metadata. Recordings are retained for approximately 30 days; aggregated data for up to 13 months. See Microsoft's Privacy Statement.
• Google Tag Manager / Google Ads: We use Google Tag Manager to deploy tracking tags, including Google Ads conversion tags that measure when users complete actions such as signing up or subscribing following an ad interaction. Google may collect IP addresses, cookie identifiers, and behavioral signals to attribute conversions. Conversion data is used solely to measure advertising performance. See Google's Privacy Policy.

AI Model Providers and Your Data

Our Services allow you to interact with AI models from multiple providers, including:

• Anthropic (Claude models)
• OpenAI (GPT models)
• Google (Gemini models)

When you send a message, your conversation content is transmitted to the selected AI provider to generate a response. Each provider processes your data according to their own privacy policies and data handling practices.

We have configured our API access with each provider to opt out of having your data used for training their AI models. We use API-level access (not consumer-facing products) which typically excludes training by default. However, because these are independent third-party companies, we cannot fully guarantee how they handle data on their infrastructure. We encourage you to review each provider's privacy policy and API data usage terms:

• Anthropic API Usage Policy
• OpenAI API Data Usage Policy
• Google Cloud / Gemini API Terms
• xAI API Terms

We do not use your identifiable inputs to train our own AI models. We may use anonymized, aggregated data to improve the Services.

How We Share Your Information

We do not sell or rent your personal information. We share your information only in the following limited circumstances:

• With AI model providers to process your conversations (as described above).
• With service providers who perform essential functions on our behalf (Supabase, Stripe, PostHog, Microsoft Clarity, Google).
• When required by law, regulation, or legal process.
• To protect our rights, safety, or property, or the rights, safety, or property of others.
• In connection with a merger, acquisition, or sale of assets (with notice to you).

Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Services. Conversation data is stored in our database to enable features like conversation history and thread switching.

When you delete your account, we will remove your personal information from our active systems. Some data may remain in backups for a limited period. Anonymized or aggregated data may be retained indefinitely.

Data Security

We implement industry-standard security measures including encryption in transit (TLS), encryption at rest, secure credential management, and access controls. Our infrastructure is hosted with reputable cloud providers that maintain strict security standards.

No system can be guaranteed to be 100% secure. In the event of a data breach that poses a risk to your rights, we will notify you and applicable authorities as required by law.

Your Rights and Choices

Depending on your location, you may have the following rights:

• Access and receive a copy of your personal data.
• Correct inaccurate or incomplete data.
• Request deletion of your personal data.
• Object to or restrict certain processing.
• Data portability (receive your data in a structured format).
• Withdraw consent at any time.
• Opt out of marketing communications.

You can manage analytics preferences via your browser settings. You may also contact us to exercise any of these rights.

Children's Privacy

Our Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will delete it promptly.

International Users

Our Services are operated from the United States. If you access the Services from outside the US, your information will be transferred to and processed in the United States. By using the Services, you consent to this transfer. We implement appropriate safeguards for international data transfers where required by law.

California Residents

If you are a California resident, you have additional rights under the CCPA/CPRA including the right to know, right to delete, right to correct, and the right to opt out of the sale or sharing of personal information. We do not sell your personal information. Contact us to exercise your rights.

Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the “Last Updated” date and, for material changes, provide additional notice. Your continued use of the Services after changes constitutes acceptance of the updated Policy.

Contact Us

If you have questions about this Privacy Policy or your personal data, please contact us at:

Email: [email protected]