Privacy policy

At Mirupa, your privacy is a priority. This policy explains what data we collect, why, for how long, and what your rights are — in accordance with the General Data Protection Regulation (GDPR) and French law.

Data we collect

We only collect data strictly necessary to produce your analysis:

• Conversation screenshots: sent to generate your analysis. They are processed transiently and are not retained on our servers after the analysis.
• Optional context: the text you add to describe the situation.
• Email (optional): to find your analysis again and, where relevant, your payment receipt.
• Generated analysis: the result (verdict, gauge, reading) is kept so you can find it again via its link.
• Technical data: IP address, browser, pages visited.

Analytics and campaigns

To understand our traffic and campaigns, we use Vercel Analytics and Microsoft Clarity (statistics and experience improvement, inputs masked), as well as the TikTok Pixel (to measure our TikTok campaigns). You can opt out via your browser or device settings.

Why we process your data

• Generate your analysis (legal basis: contract performance)
• Give you access to your full analysis after payment (contract performance)
• Measure and improve the service (legitimate interest)
• Meet our legal and accounting obligations (legal obligation)

Retention

• Screenshots: not retained (transient processing only)
• Generated analyses: up to 36 months after last use, or on deletion request
• Payment data: kept by Stripe, never on our servers (Mirupa never sees any banking data)
• Technical logs: 12 months

Processors and transfers

Your data is processed by the following sub-processors:

• Vercel — application hosting and analytics (United States, standard contractual clauses)
• Supabase — database (European Union, eu-west-1)
• n8n — processing orchestration, on our self-hosted server (European Union, Paris)
• OpenAI — AI analysis (United States; screenshots sent transiently to generate the analysis, not used for model training)
• Stripe — payment processing (Ireland, PCI-DSS compliant)
• Microsoft Clarity and TikTok — analytics and campaign measurement (United States)

Your rights

Under GDPR, you have the following rights, exercisable at any time at contact@mirupa.com:

• Right of access to your data
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object
• Right to lodge a complaint with a supervisory authority (in France: CNIL)

Security

Your data is encrypted in transit (TLS 1.3) and at rest. Access is restricted to strictly authorized personnel. In the event of a data breach, you would be informed within 72 hours.

Contact

For any question about this policy: contact@mirupa.com.