PRIVACY POLICY FOR THE MIRAGE SERVICE

Effective Date: 2026-09-08

Introduction

Your privacy and the security of your data, particularly your intellectual property, are our absolute priority. This Privacy Policy (hereinafter referred to as the "Policy") explains in detail what personal data and other information we collect in connection with your use of the MiRAGE Application, for what purpose we do so, how we protect it, and what rights you have in relation to its processing.

Using the Application constitutes acceptance of the principles described in this document.

§ 1 DEFINITIONS

Terms used in this Policy have the same meaning as defined in the Terms of Service for Electronically Provided Services within the MiRAGE Service, unless the context indicates otherwise.

§ 2 DATA CONTROLLER

The controller of your personal data is Rafał Gronowski, sole trader operating as Rim Interactive Rafał Gronowski, ul. Wolności 101 lok. 2, 41-500 Chorzów, Poland, NIP: 6341747358, REGON: 277483720 (hereinafter referred to as the "Controller" or "Service Provider").

In all matters concerning the processing of your personal data and the exercise of your rights, you can contact us at the following e-mail address: mirage@mirage.photos.

§ 3 SCOPE, PURPOSES, AND LEGAL BASES FOR DATA PROCESSING

We process your data only to the extent necessary for the proper provision of Services, compliance with legal obligations, and based on our legitimate interest. Below, we describe in detail what data we collect and why:

1. Data related to the User Account:

• Scope of data: E-mail address, User ID, account creation date, optionally first and last name.
• Purpose of processing:
  • Authentication and authorization of access to the Account.
  • Provision of Services and fulfillment of the Terms of Service.
  • Technical and service-related communication regarding the operation of the Application.
• Legal basis: Art. 6(1)(b) of the GDPR (necessity for the performance of a contract for the provision of electronic services).

2. Payment and Billing Data:

• Scope of data: In case of an invoice request: company name, Tax ID (NIP), registered address, name of the representative. Transaction history (purchased Credit/Preset Packs, dates, amounts).
• Important note: We never collect, process, or store your credit card data or bank account access details. The entire payment process is handled by external, certified operators (e.g., Stripe), who are separate controllers of this data.
• Purpose of processing:
  • Handling the purchase transactions of Credits and Preset Packs.
  • Fulfilling legal obligations in accounting and taxation (issuing invoices).
• Legal basis: Art. 6(1)(b) of the GDPR (performance of a contract) and Art. 6(1)(c) of the GDPR (legal obligation incumbent on the Controller).

3. Input Materials and Generated Content (Your Intellectual Property):

• Scope of data: Digital files (images, graphics, etc.) and parameters you enter into the Application (Input Materials), as well as the Generated Content created from their processing.
• Our Commitment: We treat this data with the utmost confidentiality. Your Input Materials and Generated Content are your property.
• Purpose of processing:
  • Exclusively for the performance of the Service: We process this data only upon your explicit command (i.e., when you click the generate button) to pass it to the Rendering Engine and return the finished Generated Content to you.
  • Maintaining History: We store a limited number of your recent Generated Content items (according to the limits specified in the Application, e.g., 12 images and 4 videos) within your Account to provide you with convenient access.
• Important note: Your Input Materials and Generated Content are not used to train any artificial intelligence models by us or our technology partners. They are treated as confidential data and are processed ephemerally (temporarily) within a secure computing infrastructure.
• Legal basis: Art. 6(1)(b) of the GDPR (necessity for the performance of a contract – without this data, we cannot generate an image or video for you).

4. Technical and Analytical Data (Server Logs, Cookies):

• Scope of data: IP address, browser type and version, operating system, anonymized data about activity within the Application (e.g., features used, time spent in the service).
• Purpose of processing:
  • Ensuring the security of the Application and protecting against abuse.
  • Diagnosing technical errors.
  • Optimizing the operation and performance of the Service.
  • Conducting anonymous statistics for product development.
• Legal basis: Art. 6(1)(f) of the GDPR (legitimate interest of the Controller, consisting in ensuring the efficient and secure operation of the Application).

5. Well-being and Work Ergonomics Data (optional — Atelier Module):

• Scope of data: Only if you voluntarily use features supporting work comfort and ergonomics — self-indicated information about your well-being or perceived discomfort (e.g. marked areas of tension), together with its history.
• Nature of data: Such data may constitute special category data — data concerning health (Article 9 GDPR).
• Purpose of processing: Solely the operation of the feature you have chosen (prompts, summaries, trends). We do not use it for any other purpose or for profiling.
• Voluntariness: The feature is entirely optional and activated on your initiative; you may discontinue it at any time and delete the associated data from your Account.
• Legal basis: Article 9(2)(a) GDPR — your explicit consent, given by accepting the Terms and using the feature.

6. Project portal for the studio's client (Portal LIVE):

• Who it concerns: Persons to whom a User of the Atelier Module (the studio) shares a link to the portal of their project — the studio's clients (investors). The controller of the client's data is the studio; the Service Administrator processes it on the studio's behalf (§ 12 of the Terms).
• Scope of data: The content of comments, decisions and attachments (photos, voice notes) added in the portal; technical visit data (a session cookie valid for 30 days, visit count, visit timestamps, events of opening materials); when an electronic signature is made — the IP address, browser identifier and time of signing as part of the evidence.
• Purpose of processing: Making the project available to the client, conducting the conversation about revisions and recording decisions; supporting the studio in preparing replies (the content of comments may be processed by automated tools on the studio's behalf); evidential safeguarding of the signature.
• Legal basis: Article 6(1)(b) and (f) GDPR (performance of the contract between the studio and its client and the legitimate interests of the studio and the Administrator). The client may opt out of e-mail notifications at any time via the link in the message; questions about data should be directed to the studio running the portal.

7. Studio files and documents (MEMiO — WRiTER SENTiO folder):

• Scope of data: Files uploaded or copied into MEMiO (PDFs, photos, recordings, notes) together with metadata (name, size, date, assigned folder); once you enable “SENTiO reads” for a folder — also the text extracted from the files and its numerical representation (embeddings) used for search and citation. Files concerning your clients are processed on your behalf (§ 12 of the Terms).
• Purpose of processing: Storing and organising the studio's materials; with reading enabled — the assistants answering questions about the files' content with a citation. Without reading enabled, the files are only stored.
• Legal basis: Article 6(1)(b) GDPR (performance of the contract); folder reading — your declaration made when first enabling that feature.
• Where and for how long: Files are stored with an object storage provider (Cloudflare R2), while metadata and the index are kept in the Application's database (Supabase); see the Sub-processors List. Deleted files go to the bin for 30 days and are then permanently erased.

§ 4 DATA RECIPIENTS (WHO DO WE ENTRUST DATA TO?)

We do not sell your personal data or share it with third parties for marketing purposes. To provide our Services at the highest level, we use the support of specialized, trusted partners to whom we entrust data processing to the necessary extent. These are:

• Authentication service providers (Clerk): To securely manage the login process and User Accounts.
• Payment operators (Stripe): To securely process transactions for the purchase of Credits and Preset Packs.
• Cloud infrastructure and database providers (Supabase, Google Cloud Platform): To securely store application data, User Accounts, and your Input Materials and Generated Content.
• AI computing power providers (OpenAI, Google Vertex AI): To perform the core operation of generating images and videos. We provide them with your Input Materials solely for processing upon your request, based on data processing agreements that prohibit them from using this data for any other purpose.
• Analytics service providers (e.g., Google Analytics): To collect anonymized statistical data.

We only cooperate with entities that guarantee a level of data protection compliant with GDPR requirements.

A full, up-to-date list of processors (sub-processors) together with their role and location is available in: Sub-processors List.

§ 5 DATA RETENTION PERIOD

We store your data only as long as necessary to fulfill the purposes for which it was collected:

• Account Data: For the entire period you have an Account in the Application, until its deletion.
• Billing Data (invoices): For the period required by tax and accounting laws (usually 5 years from the end of the calendar year in which the tax payment deadline expired).
• Input Materials and Generated Content: Files stored in your History are available until you delete them, they are automatically overwritten due to history limits, or you delete your Account.
• MEMiO files: Until you delete them (bin for 30 days) or delete your Account (up to 90 days). Data copy packages prepared at your request: link valid for 7 days.
• Technical Logs: Typically for a period not exceeding 30 days for security and diagnostic purposes.

§ 6 YOUR RIGHTS UNDER THE GDPR

In connection with our processing of your personal data, you have a number of rights:

• Right of access to data (Art. 15 GDPR): You can request information about what personal data we process.
• Right to rectification of data (Art. 16 GDPR): You can request the correction of inaccurate or incomplete data.
• Right to erasure of data ("right to be forgotten") (Art. 17 GDPR): You can request the deletion of your Account and all associated data.
• Right to restriction of processing (Art. 18 GDPR): In certain cases, you can request that we limit the operations on your data.
• Right to data portability (Art. 20 GDPR): You have the right to receive your data in a structured format and transfer it to another controller.
• Right to object (Art. 21 GDPR): You can object to the processing of your data based on our legitimate interest.
• Right to lodge a complaint with a supervisory authority: If you believe that we are processing your data unlawfully, you have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland.

To exercise these rights, please contact us at: mirage@mirage.photos. A copy of your data in a machine-readable format (JSON) — covering the data you provided to us and the data about you — is prepared upon request within 30 days and delivered via a link valid for 7 days. You can download your files and documents at any time directly from the Application.

§ 7 DATA SECURITY

We use a range of advanced technical and organizational measures to protect your data from unauthorized access, loss, or destruction. These include, among others, data transmission encryption (SSL), access control, regular backups, and cooperation with reputable infrastructure providers who ensure the highest security standards.

Payments are handled exclusively by an external operator under the PCI-DSS standard — we do not store your full payment card data. Despite due diligence, no IT system is fully immune to attacks; if you discover a vulnerability, please report it in accordance with the policy available at /.well-known/security.txt. In the event of a data breach, we act in accordance with the GDPR — including, where applicable, notifying the supervisory authority within 72 hours and informing the affected data subjects where required.

§ 8 DATA TRANSFER OUTSIDE THE EUROPEAN ECONOMIC AREA (EEA)

By using global technology providers (such as Google, OpenAI, Stripe), your data may be processed in data centers located outside the EEA. In such cases, the transfer is always based on Standard Contractual Clauses approved by the European Commission or other legal mechanisms that guarantee an adequate level of protection for your data, compliant with GDPR requirements.

§ 9 COOKIES

Detailed information on the cookies we use can be found in a separate document or the cookie banner available in the Application.

§ 10 CHANGES TO THE PRIVACY POLICY

We reserve the right to make changes to this Policy. We will inform Users of any material changes in advance via the Application or by e-mail. The current version of the Privacy Policy is always available in the MiRAGE Service.