Privacy Policy

MIRA

Email: [email protected]

Switzerland

This Privacy Policy explains how we process personal data when you use MIRA Stories, including login, upload, AI analysis and story generation, editing, publishing, sharing, embedding and billing features, and when you view a story someone has published.

• Account data: email address, name, chosen username, Google account identifier when you sign in with Google, account status. There is no password: you sign in with a one-time link sent by email or with Google.
• Photo and story data: photos you upload, metadata such as EXIF information (including date and GPS location when present), AI-generated analysis results, captions, story text, versions, layouts, and your manual edits.
• Publishing data: visibility setting of each story (draft, unlisted, public), share links, collection membership, and embed usage.
• Payment data: plan, subscription status, billing interval, Trip Pack purchases (date, amount, currency), Stripe customer ID; we do not store full credit card details.
• Usage data: app actions, timestamps, session information, generation counts.
• Technical data: IP address, browser or device information, security and rate-limiting logs.
• Visitors of published stories: we process the technical data necessary to deliver the page (IP address, user agent) in server logs. We do not build profiles of story visitors.
• Print notification: whether and when you clicked Notify me for the printed photo book in the editor.

• Providing the service (photo analysis, story generation, editing, publishing).
• Authentication and account management.
• Payment processing and invoicing.
• Sending transactional emails (for example sign-in links, freeze warnings, billing notices).
• Enforcing plan and fair-use limits.
• Security, abuse prevention and service stability.
• A single email once printed photo books can be ordered, if you asked for it in the editor. We delete the note after that email.

• Art. 6(1)(b) GDPR: performance of a contract (service delivery, account management, billing).
• Art. 6(1)(c) GDPR: compliance with legal obligations (for example accounting retention duties).
• Art. 6(1)(f) GDPR: legitimate interests (security, abuse prevention, service reliability).
• Art. 6(1)(a) GDPR: consent, where specific optional processing requires it.

Under Swiss data protection law (nFADP), data is processed for the stated purposes in good faith and proportionately.

We use providers that may process data on our behalf or in their own responsibility:

• Google Gemini (via Google Cloud Vertex AI) - AI analysis of photos and text generation.
• Google OAuth - authentication (Google login).
• Stripe - payment processing.
• Railway - hosting and servers.
• Hetzner - storage of photos and backups (Germany).
• Resend - transactional emails.
• Google Gmail and Cloudflare Email Routing: receiving and handling email sent to our support address.
• Cloudflare - security, DNS, CDN and bot protection (Turnstile).

The following providers may process data in third countries: USA: Google (AI analysis, login, support inbox), Stripe (payments), Cloudflare (security/CDN, email forwarding), Resend (email), Railway (hosting). Transfers are based on Standard Contractual Clauses (SCCs). Germany: Hetzner (storage). Data processing agreements are in place or being established with all processors under Art. 28 GDPR.

• Photos and stories: as long as your account exists. Deleting a story or photo removes it from storage within a reasonable time. Free-plan and edit-locked stories are kept in full quality and not deleted automatically.
• Account data: until account deletion. Deleted accounts are deactivated immediately and irreversibly erased after a 30-day grace period during which you can reactivate.
• Payment and accounting data: up to 10 years where legally required.
• Security and system logs, including audit logs for sign-in and account deletion: generally up to 90 days.
• Backups: up to 30 days, encrypted at rest.

Your photos and story text are never used to train AI models. Analysis and generation are performed only to provide the service. Photos are sent to Google Gemini for this purpose; Google does not use data processed via Vertex AI to train its models.

When you publish a story, it becomes reachable by anyone who has the link ("Unlisted"). If you set it to "Public", it may additionally be listed on the site and indexed by search engines. For public stories we strip EXIF metadata (including GPS location, camera serial numbers, and capture timestamps) from the publicly served photo variants. Your originals keep their metadata so you can re-download them. Your display name is shown as the story byline unless you turn the byline off in the editor.

We record server-side events (for example sign-up, story creation, generation, publish, checkout) in an internal audit log to operate the service, enforce fair-use limits and understand how the product is used. IP addresses in these logs are used for rate-limiting and security only. In addition, we measure reach on our own servers without cookies: pages viewed, where a visit came from (referring website, campaign parameters in the link), device type, browser, country and clicks on buttons. Nothing is stored on your device for this. Your IP address is only used for a moment to form an identifier that changes every day, and it is never stored. These statistics are not linked to your account and are deleted after 12 months. When you create an account, we keep where your visit came from (for example the campaign) with your account, and delete it together with the account. No data is shared with third-party analytics services. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating and improving the service).

MIRA Stories only uses technically necessary cookies, which do not require consent (§ 25(2)(2) TDDDG / ePrivacy Directive). We do not use analytics or advertising cookies. The following cookies and mechanisms are used:

• __Secure-authjs.session-token: authentication (encrypted session token), 30 days, strictly necessary.
• __Host-authjs.csrf-token, __Secure-authjs.callback-url: login flow and CSRF protection, session, strictly necessary.
• mira-stories.analytics.optout (localStorage): only set if you turn off the reach measurement in the section on usage analytics, kept until you turn it back on, set at your request.
• __cf_bm, cf_clearance: Cloudflare bot protection and security, session / 30 min, strictly necessary (set by Cloudflare, including Turnstile on sign-up).
• No analytics or marketing cookies: our reach measurement works without cookies (see the section on usage analytics). No third-party advertising. We respect the browser's Do-Not-Track and Global Privacy Control signals.

• Access information about your personal data.
• Request correction of inaccurate data.
• Request deletion of your account and data.
• Receive your data in a machine-readable format.
• Object to processing where applicable.

You can export your data and delete your account yourself at any time in /app/settings/privacy. For other privacy requests: [email protected]

• Right to know what personal data is collected.
• Right to request deletion of personal data.
• We do not sell personal data to third parties.

Data is transmitted in encrypted form (HTTPS). Photos are stored on secure Hetzner infrastructure in Germany. Sign-in links work only once and expire. Story passwords (Studio) are stored encrypted. Access is limited to authorized systems.

If we make material changes, we will update the date at the top of this page.

Privacy requests: [email protected]

Supervisory authority (Switzerland): Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch

EU users have the right under Art. 77 GDPR to lodge a complaint with the competent data protection authority in their member state.