Mira Privacy Policy
Mira is a mobile app that generates personalized style analyses (hair, outfit and color) from a photo. This policy explains what data we process, why, for how long, and your rights under the EU General Data Protection Regulation (GDPR, EU 2016/679).
1. Data controller
MLApps SL
Contact and privacy email: info@mlapps.es
2. Data we process
| Category | Data | Source |
|---|---|---|
| Account | User ID, email, name, profile photo (optional), sign-in provider (Google, Apple or email) | You, at sign-up |
| Style profile | Gender, birth year, country, language, style-quiz answers (styles, occasions, dislikes, body type, eye color, skin undertone) | You, during onboarding or profile editing |
| Photos | The photo you submit for each analysis | You, per analysis |
| Results | AI-generated images and texts for each analysis, while cloud history remains enabled | Generated by the service |
| Transactions | Token balance, purchases and spend (no card data: payments are processed by Apple/Google) | Your use of the app |
| Device | Push notification token, device language, app version | Your device |
| Diagnostics | Crash and error reports (Sentry) | Your device, on errors |
| Usage (optional) | Aggregated usage events (e.g. "analysis completed") — only with your consent in Privacy Controls | Your use of the app |
| Abuse prevention | One-way hash of the user identifier, platform and welcome-credit date; the user identifier is not retained in this record | Created when the welcome credit is claimed |
3. Purposes and legal bases
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Providing the service: account, AI style analyses, history, tokens and purchases | Contract performance (6.1.b) |
| Processing your photo to generate the analysis | Contract performance (6.1.b); each photo upload is voluntary and user-initiated |
| Push notifications (analysis ready, offers, news) | Consent (6.1.a) — OS permission plus per-category preferences in Settings |
| Usage analytics (Firebase Analytics) | Consent (6.1.a) — off by default, enabled only via the "Trends & analytics" control |
| Error diagnostics and security (Sentry, App Check) | Legitimate interest (6.1.f): keeping the service stable and secure |
| Welcome-credit fraud and abuse prevention | Legitimate interest (6.1.f): preventing duplicate claims after reinstall or account deletion |
| Legal obligations (e.g. invoicing) | Legal obligation (6.1.c) |
If you are between 13 and 15 years old, we require verifiable consent from a parent or guardian before you can use the app.
4. Retention
- Photos submitted for analysis: stored temporarily and deleted automatically at most 1 hour after upload.
- Analysis photos: deleted at most 1 hour after upload. Result images and text: retained in cloud history while that option is granted; read links expire after 2 hours, but a fresh link can be issued while the result remains retained. If you withdraw consent, cloud content is purged after the app confirms the download; your on-device history copy may remain available, but it cannot be recovered on a new device.
- Account and profile: for as long as you keep the account. When you request deletion the account is disabled immediately and all data is irreversibly erased after a 24-hour grace period.
- Error reports (Sentry): per the provider's standard retention (90 days).
- Welcome-credit abuse record: the one-way device/user hash and minimum grant data are retained while needed to prevent duplicate claims, including after account deletion.
- RevenueCat subscriber data: may be retained after account deletion for the period required by invoicing and accounting obligations.
5. Your rights
- Access and portability: email info@mlapps.es and we will provide a structured copy of your data.
- Rectification: edit your profile and style preferences directly in the app (Profile → Edit profile / Style preferences).
- Erasure: use Profile → Delete account or see our public deletion page. Deletion is irreversible after the 24-hour grace period and covers your account, profile, transactions, analyses, photos and avatar, except for the retained data expressly described above.
- Withdrawing consent: Profile → Privacy (cloud history and analytics) and Profile → Notifications.
You may also lodge a complaint with your supervisory authority (in Spain, the AEPD).
6. Processors and sub-processors
We use the following providers. Some may process data outside the EEA; such transfers rely on EU Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework.
| Provider | Service | Data processed |
|---|---|---|
| Google Ireland Ltd. — Firebase Authentication | Sign-in | Email, user ID, sign-in provider |
| Google — Cloud Firestore & Cloud Functions (europe-west1) | Database and backend | Account, profile, transactions, analysis metadata |
| Google — Cloud Storage for Firebase | Image storage | Temporary analysis photos, result images while cloud history is granted, avatar |
| Google — Firebase Cloud Messaging | Push notifications | Device token |
| Google — Firebase Remote Config & App Check | Configuration and anti-abuse | Technical device/app identifiers |
| Google — Firebase Analytics | Usage analytics (consent-gated) | Aggregated usage events, instance identifiers |
| Google Sign-In / Apple Sign-In | Sign-in providers | Email and name of the account you choose |
| Functional Software, Inc. (Sentry) | Error and performance reporting | Error traces, device model, app version |
| RevenueCat, Inc. | In-app purchase management | User ID, purchase history (no card data) |
| Google — Gemini API | AI analysis and image generation | The analysis photo and the style data needed to generate the result |
| OpenAI, L.L.C. | AI analysis and image generation | The analysis photo and the style data needed to generate the result |
| fal.ai | Image model inference | The analysis photo needed to generate the result |
| Apple / Google Play | Payment processing | Handled directly by the platforms; we never receive card data |
Photos sent to AI providers are used solely to generate your result and are not used to train their models under each provider's enterprise API terms.
7. International transfers
Our primary servers are in the EU (europe-west1). Where a
provider processes data in the U.S. (Sentry, RevenueCat, OpenAI, fal.ai,
certain Google services), the transfer relies on the GDPR Chapter V
mechanisms listed above.
8. Security
We apply encryption in transit (TLS), per-user access rules on the database and storage, app attestation (Firebase App Check), one-way hashes for the abuse-prevention record and data minimization: analysis photos live at most 1 hour and local history is stored on your device.
9. Changes to this policy
Changes will be published here with an updated date in the header. Material changes will be announced in the app.