Privacy Policy

In short

• Your email stays with your email provider. Mira shows it to you and acts only when you ask.
• Email bodies and attachments are not stored in our database.
• Mira’s AI is read-only, and receives only the emails a feature needs, never your whole mailbox.
• We don’t sell your information, show you ads, or use your email to train AI.
• Mira’s servers, database, AI, and email delivery are all in the EU.
• You can disconnect a mailbox or delete your account at any time, and its data goes with it.

1. Who is responsible

Mira is run by Filippos Rafail Papadakis, a sole trader based in Greece (“we”). We are the controller of the information in this policy under the GDPR. If you use Mira for your work or business, our Data processing agreement covers the personal data in your email that you are responsible for. You can reach us at legal@mirahq.app.

2. Your Mira account

When you create an account and use Mira, we process:

• Account details: your email address, username, and name; your password, stored only as a secure hash, if you sign in with one; your two-factor settings if you turn them on; and short-lived codes for verifying your email and resetting your password. We need these to give you the service (contract).
• Sign-in with Google: if you choose it, we receive your name, email address, and profile photo from Google. Google’s own privacy policy applies to your Google account.
• Sign-in and security data: the IP address and browser of each signed-in session, shown to you in Settings, and a log of sign-ins with their method, device, and IP address. We use these to keep your account secure and stop abuse (legitimate interest).
• Plan and billing: your plan, your subscription status, and how many AI credits each feature used, without any of the content. Our payment provider, Stripe, holds your card, billing name and address, and invoices; your card details never reach Mira. We need these for the contract and to keep the records Greek tax law requires.
• Emails we send you: such as email verification, password resets, invitations, billing notices, and notices about your account (contract).
• Feedback and messages to us: what you send with Share feedback or by email, any screenshot you add, and, if you leave them on, technical details: your browser, screen size, language, time zone, and the page you were on. We use them to help you and improve Mira (legitimate interest).
• Invitations: if we invite you to Mira, we keep your email address and the invitation.

You need an email address to create an account. Without it, we can’t give you the service.

The Mira app uses only the cookies it needs to work: to keep you signed in, and to remember a device you trust for two-factor sign-in. Your browser’s local storage keeps your theme, the mailbox you used last, your recent searches, and which sidebar sections you keep open; these stay on your device. We don’t use advertising or tracking cookies.

3. Your mailboxes

When you connect a mailbox, Mira processes it to show your mail and carry out what you ask (contract):

• Access to the mailbox: for Gmail and Microsoft mailboxes, the access you grant when you connect them (see sections 7 and 8); for other mailboxes, the IMAP and SMTP server settings, username, and password you enter. Access tokens and passwords are encrypted before they are stored.
• Kept to show your mail quickly: for the conversations in each folder you have loaded, the subject, sender and recipient names and addresses, a short preview, dates, read, starred, and attachment status, and message headers (such as Message-ID and References) to group messages into conversations.
• Your settings: signatures, sender names, mailbox names and icons, image preferences, the senders whose images you choose to always show, and, for recipient suggestions, the addresses you write to and how often.
• Not stored: email bodies and attachments are fetched from your provider when you open a message and are never written to our database. They may be kept in server memory for a short time, so that reopening a message is fast.

Images in emails load through Mira’s servers, so senders don’t see your IP address or device. A sender can still tell that an email was opened when its images load. In Settings, you can choose to be asked before images load, for each mailbox.

4. AI features

Mira’s AI can summarize a conversation, answer questions about your mail, and suggest the text of an email. It has read-only access: it cannot send, delete, move, or change any email. Suggested text only appears in your composer, and you decide whether to send it.

• When you use an AI feature, Mira sends its AI provider your request with only what the feature needs: the conversation you are viewing, the emails it found relevant to your question, the files you ask about, or the text in your composer. Summaries and answers in the reader are not stored.
• Ask Mira chats are saved, encrypted, with your messages, Mira’s answers, the emails it cited, and the text of files you add, so you can come back to them. You can delete a chat at any time, and disconnecting a mailbox deletes the chats that used it.
• Smart inbox, on Pro, runs in the background as new mail arrives. To sort your inbox, it sends the AI provider each new sender’s name and address with the subjects of their latest emails. To find what needs you, it sends the newest few messages of recent conversations from people. For trips and bills, it sends the subject and preview. Mira keeps which view each sender belongs in, when you last opened each view, the one sentence that asks you for something, and a trip’s or bill’s date with a short label such as “Flight to Prague”. The sentences and labels are encrypted.

Mira’s AI provider is Mistral AI, which processes requests in the EU, under a paid plan whose terms don’t allow it to train models on your data. It processes each request only to answer it. We don’t use your email to train AI models. We process this information to give you the features you use (contract).

5. Notifications and the daily summary

• Notifications for new mail: if you turn them on, Mira keeps your browser’s push address for each device and your notification settings. A notification can show the sender, subject, and preview, and you can turn each of them off. Notifications reach your device through your browser’s push service, encrypted so that the service can’t read them.
• Daily summary: on Pro, if you turn it on, Mira keeps the time and time zone you choose, and whether to send it by email or as a notification. Sent by email, it goes through our email provider, Lettermint.

We send these only because you turned them on (consent). You can turn them off at any time in Settings.

6. Connected AI apps

On Pro, you can connect AI apps such as Claude or ChatGPT to Mira through its MCP server. Mira keeps which apps you connected, the mailboxes each may read, and when you connected it. A connected app can search and read those mailboxes, including the text of attachments, and cannot send, delete, or change anything. What it reads is then handled under that app’s own terms and privacy policy. You can disconnect an app at any time in Settings, which stops its access at once.

7. Google user data

When you sign in with Google, Mira receives your basic profile and email address. When you connect a Gmail account, Mira asks for permission to read, send, and organize your Gmail (the gmail.modify permission), so it can show your mail and carry out the actions you take, such as sending, archiving, starring, or moving messages to the trash.

Mira’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Gmail data is used only to provide the email features you use in Mira.
• It is not used for advertising, sold, or used to train general-purpose AI models.
• It is shared only for features you use: with our AI provider when you use an AI feature, including Smart inbox on Pro, or with an app you connect through Mira’s MCP server, for the mailboxes you choose.
• No person reads it unless you ask us to (for example, for support), it is needed to investigate security or abuse, or the law requires it.

You can remove Mira’s access at any time in your Google Account permissions.

8. Microsoft user data

When you connect an Outlook.com, Hotmail, Live, or Microsoft 365 mailbox, you sign in with Microsoft and allow Mira to read and organize your mail and to send email on your behalf. Mira uses this access only to show your mail and carry out the actions you take, the same way as for Gmail: the data is not used for advertising, sold, or used to train AI models, and it is shared only for features you use, with our AI provider or with an app you connect through MCP.

You can remove Mira’s access at any time in your Microsoft account’s app permissions, or ask your organization’s administrator for a work or school account.

9. Visiting our website

• This website uses no analytics, no tracking cookies, and no ads.
• Cloudflare, which hosts it, processes your IP address and browser details to deliver pages and protect the site from attacks.
• The status badge in the footer gets its status from our status page provider, Better Stack, through our servers. Your browser connects to them only if you open the status page.
• Your browser’s local storage keeps the theme you choose.
• If you use the contact form, we receive your name, email address, topic, and message, delivered to us by Lettermint, and keep them as long as we need them to help you.

We do this based on our legitimate interest in running a secure website.

10. Who we share data with

We share information only as needed to run Mira:

• your email providers, such as Google, Microsoft, or your IMAP host, to carry out what you ask;
• UpCloud, which hosts Mira’s servers, database, and backups in the EU;
• Mistral AI, when you use an AI feature, including Smart inbox on Pro;
• Lettermint, which delivers the emails Mira sends you, and the feedback you send us;
• Stripe, to handle payments for Pro;
• Cloudflare, which hosts this website;
• apps you connect through Mira’s MCP server, for the mailboxes you choose;
• your browser’s push service, to deliver notifications you turned on; and
• authorities, when the law requires it or to protect the rights and safety of people.

The companies that work for us process data only on our instructions, under data processing agreements. The full and latest list, with what each one does and where, is on our Subprocessors page. We never sell your information, and we don’t use it for advertising or to build profiles of you.

11. Data outside the EU

Mira’s servers, database, backups, AI, and email delivery are in the EU, so your mail is stored and processed in the EU. Stripe, which handles payments, may process billing details outside the EU, and Cloudflare delivers this website from servers close to each visitor. These transfers are covered by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. Your email providers and the apps you connect handle data under their own terms.

12. How we keep data safe

Connections to Mira are encrypted, and access tokens, mailbox passwords, Ask Mira chats, and Smart inbox’s sentences and labels are encrypted at rest. Every request is checked against your account, so no one can reach another person’s mail. Our logs exclude email content, passwords, and access tokens.

A small number of Mira admins can see account details, such as your email address, plan, AI credits used, and sign-ins, to support you and stop abuse. Admin tools can’t open your mailboxes, sign in as you, or change your password, and every admin action on an account is logged.

No system is perfect, but if a data breach affects you, we will tell you and the authorities as the law requires.

13. How long we keep data

• Your account: while it exists. Deleting your account deletes your information at once, except the records described below, and copies in backups within 30 days.
• A mailbox: until you disconnect it. Disconnecting deletes what Mira stored for it and the chats that used it; your mail at your provider is not affected. Settings that apply to all your mailboxes, such as which Smart inbox view a sender belongs in and the senders whose images you always show, stay until you change them or delete your account.
• Ask Mira chats: until you delete them, or disconnect a mailbox they used.
• Sessions: until you sign out or revoke them, or after 90 days without use. A device you trust for two-factor sign-in is remembered for 30 days.
• The sign-in log: 90 days.
• Feedback and messages to us: as long as we need them to help you, then deleted.
• Billing records: Stripe keeps them for as long as Greek tax and accounting law requires.
• Invitations and admin actions: the record of an invitation, or of an admin action on your account such as a suspension, keeps your email address after your account is deleted, so we can show who was invited and what our admins did.

14. Your rights

You can view and change your account details, disconnect mailboxes, delete chats, revoke sessions, and delete your account in Settings. Under the GDPR, you also have the right to:

• get a copy of your information;
• correct information that is wrong;
• have your information deleted;
• limit or object to how we use it;
• get your information in a portable format; and
• withdraw your consent, where we rely on it.

Where we rely on our legitimate interest, you can object at any time. We don’t make decisions about you based only on automated processing; Smart inbox sorting your mail is not such a decision. Email legal@mirahq.app and we will answer within one month. You can also complain to the Hellenic Data Protection Authority (dpa.gr), or to the authority in your own EU country.

15. Children

Mira is not meant for anyone under 16, and we don’t knowingly collect their information.

16. Changes to this policy

If we change this policy in an important way, we will tell you in Mira or by email before the change applies. The date at the top always shows the latest version. See also our Terms of Service.