Data processing agreement
Last updated October 19, 2026
This agreement explains how Mira processes personal data on your behalf when you use it for your work or business, as Article 28 of the GDPR requires. It is part of our Terms of Service and applies automatically. You don’t need to sign anything.
1. When this applies
For most people, Mira is a personal email client, and we are the controller of the information we handle, as our Privacy Policy explains. If you use Mira for your work or business, for example with a work mailbox, you may be responsible for the personal data in your email, such as that of your clients and contacts. For that data, you are the controller, and we, Filippos Rafail Papadakis, trading as Mira, are your processor. Our contact details are in the Terms of Service.
2. What we process
| Purpose | Showing, searching, sending, and organizing the email in the mailboxes you connect, and running the AI features you use, including Smart inbox on Pro. |
|---|---|
| People involved | The people in your email: senders, recipients, and anyone named in messages or attachments. |
| Types of data | Names and email addresses, subjects, previews, dates, and message headers, kept to list your mail quickly; message bodies and attachments, fetched from your email provider when needed and not stored; and what you save in Mira, such as Ask Mira chats and Smart inbox’s quotes and labels. |
| Special data | Email can contain special categories of data, such as health information, when people send it to you. We don’t look for it, and handle it with the same protection as the rest of your email. |
| Duration | As long as the mailbox is connected to Mira, then until the data is deleted as described in section 8. |
3. Your instructions
We process the data only to provide Mira to you, following your documented instructions: these terms and the settings and actions you choose in Mira. If we believe an instruction breaks the GDPR, we will tell you. If the law requires us to process data in another way, we will tell you first, unless the law forbids it.
4. Confidentiality
Everyone who can access the data on our side is bound by confidentiality, and only accesses it when needed to run, support, or secure the service.
5. Security
We protect the data with technical and organizational measures, including:
- encrypted connections (HTTPS) for all traffic;
- access tokens, mailbox passwords, Ask Mira chats, and Smart inbox’s quotes and labels encrypted at rest;
- message bodies and attachments not written to our database;
- data stored on servers in the EU, with access limited to the people who need it;
- every request checked against its account, so no one can reach another person’s mail;
- AI with read-only access by design: it cannot send, delete, or change any email;
- firewalls, regular updates, and monitoring of our systems; and
- regular backups, kept in the EU.
6. Subprocessors
You allow us to use the service subprocessors listed on our Subprocessors page. They are the only companies that handle your email, and each one is bound by a data processing agreement with the same level of protection as this one. The other companies we use, for payments and this website, only handle data about our own account holders and never see your email. We stay fully responsible to you for the work of our subprocessors.
We will tell you in Mira or by email at least 7 days before we add or replace a service subprocessor. In an emergency, for example if a provider suddenly stops working or has a security problem, we may switch first and tell you as soon as we can. If you have a reasonable objection, tell us within those 7 days. If we can’t solve it, you can cancel, and we will refund any prepaid fees for the time left.
7. Helping you
- Requests from people: you can disconnect a mailbox or delete your account at any time, and we help you answer requests to access, correct, or delete data that you can’t handle in Mira.
- Data breaches: we tell you without undue delay, and within 48 hours of becoming aware of a breach that affects your data, with the information you need to meet your own duties.
- Assessments: we give you reasonable help with data protection impact assessments and talks with authorities.
8. Deleting data
Disconnecting a mailbox deletes what Mira stored for it at once. Settings that apply to all your mailboxes, such as which Smart inbox view a sender belongs in, stay until you change them or delete your account, which deletes your data at once. Copies in backups are deleted as those backups expire, within 30 days, unless the law requires us to keep them. Your mail at your email provider is not affected.
9. Audits
We give you the information you need to show that we meet this agreement. If you need more, you can ask for an audit with 30 days’ notice, once a year, at your cost, done in a way that protects other users’ data and our security.
10. Transfers outside the EU
Your email is stored and processed in the EU by our service subprocessors, and we don’t transfer it outside the EU. Your email providers and the apps you connect to Mira are chosen by you, and handle data under their own terms.
11. Liability and contact
The limits of liability in our Terms of Service apply to this agreement, as far as the GDPR allows. Questions? Email legal@mirahq.app.