Privacy Policy
What we collect, who else sees it, and how to switch it off.
Last updated 6 October 2026
This policy covers the Mira website at mirasocial.co, the Mira application at app.mirasocial.co, the client portal at client.mirasocial.co, and the emails we send. Mira is a workspace that marketing agencies use to plan, approve and publish content for their clients, and that clients use to review that work. It is operated by Agence Créative Maison Santé, a corporation incorporated under the laws of Quebec, Canada. In this policy, Mira, we, us and our mean that corporation.
The policy lists what we store, why, who else can see it, how long it stays and how to have it removed. It is written in plain language on purpose. If anything is unclear, email hello@mirasocial.co. Deletion steps are on the Data deletion page.
1. Who we are and how to reach us
Agence Créative Maison Santé operates Mira. Our person in charge of the protection of personal information can be reached at hello@mirasocial.co. Write there for any question, access request, correction, withdrawal of consent or deletion request. We answer within 30 days.
Two roles apply. For your account, your sign-in, billing and how Mira itself works, we decide why and how the information is used. For the content, media, comments and client contact details that an agency puts into its workspaces, the agency decides what goes in and who sees it, and we process that information on the agency's instructions. If you are a client of an agency and want to know what that agency has stored about you, ask the agency first; we will help them answer.
2. The Mira website
The public pages at mirasocial.co have no signup forms, no chat widget, no analytics scripts, no advertising pixels and no cookies. Our host, Vercel, processes visitor IP addresses in its server logs, as every host does, to serve the pages and protect them from abuse. If you email us, we receive what you send and your address, and we use it only to reply.
Everything else in this policy is about the application and the client portal, where accounts, workspaces and connected platform data live.
3. What we collect in the application
We collect what the product needs to work and nothing for advertising or resale. There are no third-party analytics or tracking tools in the application either.
| Category | What it includes and where it comes from |
|---|---|
| Account information | Name, email address, avatar, role, time zone and the agency or client workspaces you belong to. You or the person who invited you provide it. |
| Sign-in information | One-time sign-in codes and links we email you, the session cookie that keeps you signed in, and the time and IP address of sign-ins. We do not store passwords. |
| Agency and workspace information | Agency and client names, logos, brand colours, brand profiles, team members, client users, permissions and settings. |
| Content and media | Post titles, captions, notes, labels, publish dates, images and videos, media versions, annotations, comments, approval decisions, tasks and the history of all of these. Agencies and their clients create it. |
| Connected platform data | When you connect Instagram, Facebook, TikTok, LinkedIn, Pinterest, Klaviyo, Mailchimp or an advertising account: the account or page identifier, handle, display name and avatar; the access tokens the platform issues; the identifiers of posts we publish for you; and the performance figures the platform reports, such as reach, impressions, likes, comments, saves, shares, follower counts, opens and clicks. The next section has the detail. |
| Billing information | Plan, subscription status, invoices and the Stripe customer identifier. Card numbers go straight to Stripe and never reach our servers. |
| Technical information | Server logs and in-app error reports containing IP address, browser and device type, the page you were on and the error. We use them to keep the service running and secure. |
| Communications | Emails we send you (sign-in codes, invitations, approval requests, notifications) and anything you send us. |
4. Connected social, advertising and email platforms
Mira can connect to Meta (Facebook Pages and Instagram professional accounts), TikTok, LinkedIn, Pinterest, Meta Ads, TikTok Ads, Pinterest Ads, Klaviyo and Mailchimp. A connection is always started by an agency user who holds the right to manage that account, through the platform's own consent screen. We hold only the permissions you grant on that screen, and you can take them back at any time, in Mira or in the platform's own settings.
We use platform data for these purposes and no others:
- To show you which accounts are connected and let you choose where a post publishes.
- To publish or schedule the content you approve, at the time you choose, to the accounts you choose, and to record the resulting post identifier so the post can be matched to its performance.
- To fetch the performance figures of your accounts and of the posts published through the service, so the Reports pages and client reports can show them.
- To tell you when a connection needs attention, for example when a token has expired or a permission was removed.
We do not:
- Sell platform data, share it with advertisers or data brokers, or use it to build audience profiles or advertising segments.
- Use platform data to train machine-learning or artificial-intelligence models.
- Use platform data for anything unrelated to the features you asked for, or combine it with information about people outside your own accounts' audiences.
- Pass platform data to anyone other than the providers listed in this policy, who process it only on our instructions.
- Read private messages, contacts or friend lists. We do not request those permissions.
Access tokens are encrypted before they are stored, kept in a table that only our server code can reach, never sent to a browser and never written to logs. When you remove an account in Mira, or revoke Mira inside the platform, we delete the tokens straight away and stop every data pull for that account. Performance figures already shown in your reports stay in your workspace until you delete the content or the workspace, because they are part of your own reporting record; you can ask us to delete them sooner at any time.
Our use of information received from Meta complies with the Meta Platform Terms and Developer Policies. Our use of information received from TikTok complies with the TikTok Developer Terms of Service. Our use of information received from LinkedIn, Pinterest, Klaviyo and Mailchimp complies with each platform's developer and API terms. Where a platform instructs us to delete data, we do so within the time the platform sets.
5. How we use it
- To run the service: sign you in, show your workspaces, store and display content, run approvals, publish to connected accounts and build reports.
- To send the emails and in-app notifications the service depends on: sign-in codes, invitations, approval requests, comments, status changes and publishing results. Non-essential notifications can be turned off in your settings.
- To bill agencies through Stripe and keep the records that tax and accounting law require.
- To keep the service secure: detect abuse, investigate errors and incidents, and enforce our Terms of Service.
- To answer your questions and support requests.
- To comply with the law and respond to lawful requests from public authorities.
We do not use personal information for advertising, for profiling, or for decisions made solely by automated means that have legal or similarly significant effects on you.
6. Consent and legal bases
In Quebec and the rest of Canada we collect, use and share personal information with your knowledge and consent, as the Act respecting the protection of personal information in the private sector and the Personal Information Protection and Electronic Documents Act require. You give that consent when you create an account, accept an invitation or connect a platform, and you can withdraw it at any time by email or by removing the connection. Where the law allows us to proceed without consent, for example to deliver the service you asked for or to meet a legal obligation, we do only what that purpose needs.
Where the General Data Protection Regulation or the UK GDPR applies, our bases are: performance of a contract for everything needed to run the service; legitimate interests for security, abuse prevention, reliability and service communications, where your rights do not override them; consent for connecting a platform account and for optional notifications; and legal obligation for billing records and lawful requests.
7. Who else sees it
We share personal information only with the providers below, who process it for us under contracts that limit them to our instructions, and with the platforms you choose to connect. We never sell it.
| Provider | Purpose and location |
|---|---|
| Supabase | Database, authentication and file metadata. Hosted on Amazon Web Services in Oregon, United States. |
| Vercel | Application and website hosting, server logs. United States. |
| Cloudflare R2 | Storage of uploaded images and videos. Cloudflare's distributed storage network. |
| Inngest | Background jobs: scheduled publishing, metric syncs, notification delivery. United States. |
| Resend | Transactional email delivery. United States. |
| Stripe | Subscription billing and payment processing. Stripe holds card details under its own privacy policy. |
| Connected platforms | Meta, TikTok, LinkedIn, Pinterest, Klaviyo, Mailchimp and the others you connect. We send them the content you ask us to publish and receive the account and performance data described above, under each platform's own terms and privacy policy. |
Inside your agency, other members see what their permissions allow. Client users see only the content their agency has put in front of them for review, and never see tasks, billing, platform credentials or internal comments.
We may also disclose information when the law requires it, to protect the rights, safety or property of Mira, our users or the public, or as part of a merger, acquisition, financing or sale of assets, in which case this policy keeps applying to your information until you are told otherwise.
8. Where information is processed
Our servers and most of our providers are in the United States, so personal information collected in Quebec, elsewhere in Canada, the European Economic Area, the United Kingdom or anywhere else is transferred to and processed in the United States. Before using a provider outside Quebec we assess the protection it offers, and we bind each one by contract to safeguards equivalent to those in this policy. Where the law requires, we also rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or an equivalent mechanism.
9. How long we keep it
| Information | Retention |
|---|---|
| Account information | While your account exists, then deleted within 30 days of a deletion request or of the agency closing. |
| Content, media, comments and approvals | Until the agency deletes them or closes the workspace. Approval history stays as long as the content exists, because it is the record of who approved what. |
| Deleted assets | Held in Trash for 30 days so they can be restored, then permanently removed from storage. |
| Platform access tokens | Deleted immediately when the account is removed or access is revoked. |
| Platform performance figures | Kept with the content and workspace they belong to, and deleted with them or on request. |
| Notifications | Read notifications are removed after 30 days and unread ones after 90 days. |
| Billing records | 7 years, as tax and accounting law requires. |
| Server logs and error reports | No longer than 30 days, unless needed for an ongoing security investigation. |
| Backups | Encrypted database backups are overwritten within 30 days, so deleted information leaves backups within that window. |
When information is no longer needed for the purpose it was collected for, we delete it or make it anonymous.
10. Your rights and choices
Wherever you live, you can ask us what personal information we hold about you, have it corrected, have it deleted, receive a copy of the information you gave us in a structured and commonly used format, restrict or object to how we use it, and withdraw a consent you gave. Much of this is self-serve: edit your profile and notification preferences in Settings, remove a platform in Settings, and delete content and assets in the workspace. For everything else, email hello@mirasocial.co from the address on your account and we will act within 30 days. We may ask a question or two to confirm it is really you.
If you are in Quebec, you may also ask us to stop spreading information about you or to de-index it where the law provides, and you may complain to the Commission d'accès à l'information du Québec. Elsewhere in Canada you may complain to the Office of the Privacy Commissioner of Canada. In the EEA or the UK you may complain to your local data protection authority. If you are a California resident, the California Consumer Privacy Act gives you the rights above, and we confirm that we do not sell personal information and do not share it for cross-context behavioural advertising.
Step-by-step instructions, including for information received from Meta or TikTok, are on the Data deletion page.
12. Security and confidentiality incidents
All traffic is encrypted in transit and all stored information is encrypted at rest. Platform access tokens are additionally encrypted with a key held only by our server environment, in a table with no access path from the browser or from any API response. Every record is scoped to its agency and protected by row-level security in the database, so one agency can never read another agency's information. Sign-in uses one-time emailed codes rather than passwords. Access to production systems is limited to the people who operate the service and is logged.
No online service is completely secure. We keep a register of confidentiality incidents. If an incident creates a risk of serious injury to you, we will notify you and the Commission d'accès à l'information du Québec or the other authority the law names, without undue delay and within the time the law requires.
13. Children
Mira is a business tool and is not directed to children. You must be at least 18 years old, or the age of majority where you live, to create an account. We do not knowingly collect information from anyone under 14, and we never collect it from a minor without the consent of a parent or guardian. If you believe a child has given us personal information, email us and we will delete it.
14. Changes to this policy
When we change this policy we update the date at the top. If a change materially reduces your rights or changes how we use platform data, we will tell agency administrators by email or in the product before it takes effect.
15. Contact
Agence Créative Maison Santé, operator of Mira. Person in charge of the protection of personal information: hello@mirasocial.co. Use the same address for privacy questions, access and correction requests, and deletion requests. Une version française de cette politique est disponible sur demande à la même adresse.