Mirror — Privacy Policy

This Privacy Policy explains how Axel Oliveras (operating as Mirror) ("Mirror", "we", "us", or "our") collects, uses, and protects your information when you use the Mirror website, web application, and related services (the "Service"). We wrote it to be readable, and to apply wherever you live.

If you have questions, contact us at privacy@use-mirror.co.

1. The short version

• You must create an account to take the quiz and view your results.
• We collect only what the Service needs: your email, display name, birth date, and your style-diagnosis results. Nothing more.
• We do not sell your personal information, and we do not use it for third-party advertising.
• We use a small number of trusted providers (such as Supabase, Stripe, Google, Anthropic, Brevo, and Cloudflare) to run the Service. We never store your payment card details.
• You can delete your account and all associated data at any time from within the Service.

2. Who we are

Mirror is an independent product built and operated by its founding team. The data controller responsible for your information, and your point of contact for any privacy request, is:

Axel Oliveras (operating as Mirror)
Broward County, Florida, United States
privacy@use-mirror.co

3. Information we collect

We collect only the following categories of personal information:

a. Account information

• Email address — to identify your account and let you sign back in.
• Display name — optional, shown in the Service.
• Date of birth — to confirm you meet the minimum age and for age-appropriate handling (we store the date; we may store only your age or an "over 13" flag where sufficient).

b. Style-diagnosis data

• Your quiz answers, computed scores, and resulting style type and report.

c. Purchase information

• A record that you purchased a specific report ("entitlement"). Payments are processed by Stripe. We receive confirmation of a completed purchase but never receive or store your full card number, CVV, or bank details.

d. Authentication data

• When you sign in with Google, we receive a secure token that confirms your identity along with your basic profile information — your name, email address, and profile picture. We do not receive your Google password.

What we do NOT collect: we do not collect your precise location, contacts, photos, health data, or advertising identifiers, and we do not build advertising profiles about you.

4. How we use your information

We use your information only to:

• Provide the Service and generate your style diagnosis and reports;
• Generate your paid report using an AI provider (Anthropic), which processes your style scores — not your name or email — to write the report;
• Create and secure your account and sign you in;
• Process and honour your purchases (unlock the report you paid for);
• Confirm you meet the minimum age;
• Respond to your requests and provide support;
• Maintain the security and integrity of the service;
• Comply with legal obligations.

We do not use your information for behavioural advertising, and we do not sell it.

5. Legal bases for processing (EEA/UK — GDPR)

Where the EU or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service, your account, and the reports you request or purchase.
• Consent — where you optionally provide information (e.g., display name) or where consent is required; you may withdraw consent at any time.
• Legal obligation — to meet age-verification and record-keeping duties.
• Legitimate interests — to keep the service secure and prevent abuse, in a way that does not override your rights.

6. How we share information (service providers)

We share the minimum necessary with providers that process data on our behalf under contract. We do not sell or rent personal information.

Each provider is bound to use your data only to provide their service to us. We may also disclose information if required by law, or to protect our rights, users, or the public.

7. International data transfers

Mirror is operated with infrastructure that may store and process data in the United States and other countries. Where we transfer personal data out of the EEA, UK, or other regions with transfer restrictions, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (or equivalent mechanisms). You may contact us for more information about these safeguards.

8. How long we keep your data

• Account and diagnosis data — kept while your account exists.
• Purchase records — kept as long as needed to honour your purchase and to meet legal/accounting obligations.
• After deletion — when you delete your account, we delete your personal data from our systems, except where we must retain limited records to comply with the law (e.g., transaction records), which we then keep only as long as required.

9. Your rights

Depending on where you live, you may have some or all of these rights:

• Access — get a copy of the personal data we hold about you.
• Correction — fix inaccurate data.
• Deletion — delete your account and data (available directly in the Service: Settings → Delete account).
• Portability — receive your data in a portable format.
• Objection / restriction — object to or restrict certain processing.
• Withdraw consent — where processing is based on consent.
• Non-discrimination — we will not treat you differently for exercising your rights.

To exercise any right, use the in-Service controls or email privacy@use-mirror.co. We respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your local data protection authority.

10. California privacy rights (CCPA/CPRA)

If you are a California resident:

• We do not "sell" or "share" your personal information as those terms are defined under the CCPA/CPRA, and we do not use it for cross-context behavioural advertising.
• The categories of personal information we collect are described in Section 3 (identifiers, age, and your diagnosis/purchase data).
• You have the right to know, delete, and correct your personal information, and to be free from discrimination for exercising these rights.

Submit a request via the Service or privacy@use-mirror.co.

11. Children's privacy

Mirror is not intended for children under 13. We require a date of birth at sign-up and block accounts for anyone under 13 (consistent with the U.S. COPPA and similar laws). If your local law sets a higher digital-consent age, that age applies to you.

If you believe a child under the applicable minimum age has provided us personal information, contact privacy@use-mirror.co and we will delete it promptly.

12. Security

We protect your information with industry-standard measures: encrypted transport (HTTPS), authentication tokens, row-level access controls so you can only reach your own data, and payment handling delegated to Stripe. No system is perfectly secure, but we work to protect your data and to notify you and regulators of incidents where required.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the new version here with an updated "Last updated" date, and, for material changes, provide a more prominent notice on the Service.

14. Contact us

Axel Oliveras (operating as Mirror)
Email: privacy@use-mirror.co
Address: Broward County, Florida, United States