Privacy policy

1. Who we are

“Mirra,” “we,” or “us” refers to MirraLabs, the company that operates mirra.run and the Mirra product (the “Service”). If you want to reach our privacy team, write to [email protected].

2. What we collect

Information you give us

• Access request data. When you submit the request-access form, we store your email, company (optional), team size, the vendors you plan to mirror, any notes you share, and the time of submission. This is used to prioritize private-beta invites.
• Email to founders. If you email us at [email protected], [email protected], or another addressed inbox, we keep the message in the relevant inbox.

Information we collect automatically

• Server logs. Our hosting provider records standard request metadata (IP address, user-agent, URL, timestamp, response status). Logs are used to detect abuse and debug errors. We retain them for up to 30 days.
• No client-side analytics. We do not run Google Analytics, Segment, Mixpanel, or any third-party analytics SDK on this site. We do not use cookies for tracking or advertising.

Information collected by the Mirra product

Mirra provisions isolated mirror sessions — containers that imitate third-party APIs like Stripe, Resend, or Twilio — which your code talks to instead of the real vendor. We collect account metadata (email, workspace, seat roles), session metadata (start time, duration, which mirrors were active, which scenarios ran), and the request payloads your code sends to mirror URLs during a session. We never store your production credentials and we do not call real vendor APIs on your behalf. Mirror sessions and their state are retained per your plan's retention window (7, 30, or 90 days on Free, Pro, and Team; configurable on Enterprise) and then deleted. Full product-specific privacy details will be published here before Mirra leaves private beta.

3. How we use information

• To invite you to the private beta and send important product updates.
• To respond to your contact messages and scheduled demos.
• To operate, secure, and improve the website and the Mirra product (e.g. prevent abuse, fix bugs, design new features).
• To meet legal obligations, if applicable.

We do not sell personal information to anyone. We do not use it for advertising.

4. Who we share with

We share information only with service providers that run infrastructure for us:

• Supabase — stores access-request and account records in a managed Postgres database.
• Vercel — hosts the Mirra website and runs server-side code for the request-access flow.
• Cloud infrastructure providers — run the mirror session containers that back the Mirra product.
• GitHub — when you install the Mirra GitHub App (Team and Enterprise tiers) to gate pull requests on scenario results, GitHub passes us repository and pull-request metadata needed to post check runs. This only applies to Mirra product users, not site visitors.

Each of these providers is contractually bound to handle data only as needed to deliver the service. We do not share personal information with marketers or data brokers.

5. Data retention

• Access-request entries are kept until we invite you to the private beta or you ask us to delete the entry.
• Email correspondence is kept for up to 24 months after we last corresponded.
• Server logs are retained for up to 30 days.
• Mirror sessions and session state are retained per your plan's window — 7 days on Free, 30 days on Pro, 90 days on Team, and configurable on Enterprise — then deleted.

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete the personal information we hold about you, and to object to or restrict how we use it. To exercise any of these rights, email [email protected] from the address you used to sign up. We will respond within 30 days.

7. International transfers

Our infrastructure runs in the United States and the European Union. If you access Mirra from outside those regions, your information will be transferred to and processed in one of them. We use standard contractual clauses with our sub-processors where required.

8. Security

Access to databases is restricted to named team members; service keys are stored in the deployment environment and never checked into source control. We use TLS everywhere on mirra.run and require two-factor authentication for every internal tool. No system is perfect — if you discover a vulnerability, please email [email protected].

9. Children

Mirra is a product for developers and engineering teams. It is not directed to children under 16, and we do not knowingly collect information from them.

10. Changes

We may update this policy as the product evolves. Material changes will be announced on this page with a revised “last updated” date at the top and, for people who have submitted an access request or hold an account, by email.

11. Contact

Questions or requests: [email protected].