Privacy Policy

Effective date: 24 May 2026 · Last updated: 24 May 2026

This Privacy Policy explains how MIR DIGITAL (“we”, “us”, “our”) collects, uses, shares and protects personal data when you visit mir.digital, use the AI diagnosis, upload documents, request a demo, or otherwise interact with our services.

1. Who we are

MIR DIGITAL is a product factory and software development company with offices in Canada, England, Spain and Turkey. You can contact us at [email protected] for any privacy-related question, including to exercise your rights described below.

2. Information we collect

Contact data you provide voluntarily — name, business email, company name, website, phone number — when you submit a lead form, book a demo or upload documents.
AI diagnosis responses — the answers you select or type during the 6-step diagnosis flow, the recommendation we generate, and a summary used by our team to follow up.
Documents you upload (PDF files) through the “Upload Documents” flow, along with any optional message describing them.
Usage and device data — IP address, browser, device type, pages visited, referrer, and timestamps. Collected by our infrastructure, CDN (Cloudflare), minimal server logs, and aggregate measurement via Google Tag Manager & Google Analytics.
Cookies — see our Cookie Policy for the full list.
Communications — emails you send to [email protected] and our replies.

We do not knowingly collect special category data (health, religion, sexual orientation, biometrics, etc). Please do not upload such information through our forms.

3. How we use your data

To run the AI diagnosis and generate a recommendation that fits your business.
To respond to your messages, send the recommendation by email, and schedule demos or calls.
To deliver, maintain, secure and improve our products and the mir.digital website.
To detect, prevent and address fraud, abuse, security and technical issues.
To comply with legal obligations and enforce our Terms of Service.

4. Legal bases for processing (GDPR / UK GDPR)

Contract — to provide the service you requested (AI diagnosis, recommendation, demo, document review).
Legitimate interests — to operate, secure and improve the website and our products, in a way you can reasonably expect and that does not override your rights.
Consent — for non-essential cookies and any optional marketing email, where applicable. You can withdraw consent at any time.
Legal obligation — to comply with applicable laws and respond to lawful requests.

5. Sharing your data

We do not sell personal data. We share it only with the following categories of recipients:

AI provider — OpenAI (US) processes the AI diagnosis prompts to generate the recommendation text. Data is sent over TLS and OpenAI does not train its models on API data by default.
Infrastructure providers — our hosting provider (Linux VPS) and CDN (Cloudflare) process traffic on our behalf.
Measurement — Google Tag Manager and Google Analytics aggregate site usage so we can plan capacity and improve the product. See Google’s Privacy Policy and the opt-out add-on.
Email provider — when you submit a lead, we send a notification email to our team and a confirmation email to you via standard SMTP transports.
Professional advisors and authorities — lawyers, accountants and regulators, where required by law.

6. International data transfers

Because our team and providers operate in multiple jurisdictions (Canada, EU, UK, Turkey, US), your personal data may be transferred outside your country of residence. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.

7. How long we keep your data

Lead and diagnosis data: up to 24 months after the last interaction, then deleted or anonymised.
Uploaded documents: up to 12 months after upload, unless we agree on a longer retention for an ongoing project.
Email correspondence: up to 36 months.
Server and security logs: up to 12 months.

We may retain data longer when required by law, to defend or bring legal claims, or to address security incidents.

8. Your rights

Depending on your location, you have rights of access, rectification, erasure, restriction, portability, objection, and (where applicable) to withdraw consent or lodge a complaint with a supervisory authority. To exercise your rights, email [email protected]. We respond within statutory deadlines (in the EU/UK, within one month, extendable by two months for complex requests).

9. Security

We use TLS in transit, restricted access to production systems, signed CRM session cookies, principle of least privilege, and regular updates. No system is perfectly secure — please use a strong password and do not share access credentials.

10. Children

Our services are intended for businesses and professional users. We do not knowingly process the personal data of children under 16. If you believe a child has provided us data, contact us and we will delete it.

11. Automated decisions

Our AI diagnosis produces an indicative recommendation. It does not make legal or significant decisions about you on its own. A human at MIR DIGITAL reviews recommendations before any commercial proposal or contract.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be highlighted at the top of this page, and where required by law, communicated by email.

13. Contact

MIR DIGITAL · [email protected]
Offices: Port Moody (Canada), London (England), Oviedo (Spain), Antalya (Turkey).

Company & payments

MIR DIGITAL is operated by GiTMiR Ltd, registered in England & Wales (Company No. 15860347). Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

Payments are processed by GiTMiR Ltd via Stripe, a third-party payment processor. By completing a purchase, you agree to Stripe's Privacy Policy and Terms of Service. Your payment information is shared with Stripe only to the extent necessary to complete your transaction.