Privacy Policy

MirrorMire operates the AMaze™ AI-native proactive cyber resilience platform. Our registered trading name is MirrorMire; our platform is accessible at mirrormire.ai.

This policy applies to:

• Visitors to our website (mirrormire.ai) and marketing pages.
• Prospective customers who contact us, attend demonstrations, or request trials.
• Customers and their authorised users who access the AMaze™ platform.
• Partners, resellers, and suppliers whose personnel interact with MirrorMire.

This policy does not apply to data that our customers process within their own deployments of the AMaze™ platform. Customers are the Data Controllers for that data; MirrorMire acts as Data Processor under a separate Data Processing Agreement (DPA).

3.1 Website visitors

When you visit mirrormire.ai we collect:

• Technical data: IP address, browser type, operating system, pages visited, referral URL, and session duration, via server logs and analytics cookies.
• Cookie preferences: your opt-in or opt-out choices, stored locally.

Legal basis: Legitimate interests (analytics, security) and consent (non-essential cookies).

3.2 Prospects and enquiries

When you contact us, request a demo, or sign up for a trial we collect:

• Identity data: name, job title, company name.
• Contact data: business email address, phone number.
• Engagement data: messages sent to us, demo attendance, content downloads.

Legal basis: Legitimate interests (responding to enquiries, progressing sales relationships); contract (where a trial agreement is in place).

3.3 Platform users (customer personnel)

When authorised users access the AMaze™ platform we collect:

• Account data: username, business email, role, and hashed password or SSO token.
• Usage data: feature interactions, dashboard views, query logs, and session timestamps.
• Audit logs: actions taken within the platform (configuration changes, report exports) for security and compliance purposes.

Legal basis: Contract (performance of the subscription agreement); legal obligation (security audit logging).

3.4 Platform telemetry

The AMaze™ platform generates anonymised telemetry (feature usage counts, error rates, latency metrics) to support reliability and product improvement. This telemetry does not include personal data from customer networks and cannot be linked to individual users.

Legal basis: Legitimate interests (product reliability and improvement).

3.5 Data we do not collect

MirrorMire does not collect special category data (health, biometric, racial or ethnic origin, political opinion, or similar). We do not collect payment card data — payments are processed by a PCI-DSS-certified third-party processor. We do not knowingly collect data from individuals under the age of 18.

Our website uses the following categories of cookies:

You may withdraw consent for analytics cookies at any time via the cookie banner or by emailing privacy@mirrormire.ai. Withdrawing consent does not affect processing carried out before withdrawal.

We use the data described in Section 3 for the following purposes:

• Providing and managing access to the AMaze™ platform and related services.
• Responding to sales enquiries, processing trial requests, and onboarding new customers.
• Sending service communications (product updates, security alerts, downtime notices).
• Sending marketing communications where you have opted in or where we have a legitimate interest as a business contact — with an unsubscribe option in every message.
• Improving platform reliability, diagnosing errors, and developing new features, using anonymised telemetry.
• Complying with legal obligations, including responding to lawful requests from regulators and law enforcement.
• Protecting the security of our systems and detecting fraudulent or malicious activity.

We do not sell personal data. We do not share personal data with advertising networks or data brokers. We share data only in the following circumstances:

6.1 Sub-processors

We engage trusted sub-processors to help deliver our services. These are services MirrorMire itself contracts with and uses to operate the AMaze™ platform — including cloud infrastructure providers, identity providers (Azure AD / Entra ID), collaboration tools (Microsoft 365 and OneDrive), source control (GitHub), issue tracking (Jira), and email delivery services. MirrorMire holds Data Processing Agreements with all of these providers. All sub-processors are bound by data processing agreements and are assessed for security compliance before engagement. A current list of sub-processors is available on request from privacy@mirrormire.ai.

Customer-configured third-party integrations — such as threat enrichment services (AbuseIPDB, IPQualityScore, VirusTotal), SIEM/SOAR platforms (Splunk, Microsoft Sentinel), notification services (SendGrid, Slack, Teams, PagerDuty), and AI/LLM providers (OpenAI, Anthropic, Azure OpenAI, Google Vertex AI) — are not MirrorMire sub-processors. Customers engage those services directly under their own contractual arrangements. MirrorMire provides the integration connector only and does not hold, manage, or have access to the customer’s credentials or accounts with those services.

6.2 Professional advisors

We may share data with our lawyers, auditors, and insurers where necessary and under obligations of confidentiality.

6.3 Legal and regulatory requirements

We may disclose data where required by law, court order, or regulatory authority, or where necessary to protect our legal rights or the safety of others.

6.4 Business transfers

In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity. We will notify affected individuals in advance where required by law.

MirrorMire operates primarily from the USA and India and serves customers globally. Where personal data is transferred outside the European Economic Area (EEA) or United Kingdom, we ensure an adequate level of protection is in place through one or more of the following mechanisms:

• Adequacy decision by the European Commission or UK Secretary of State.
• Standard Contractual Clauses (SCCs) approved by the European Commission.
• UK International Data Transfer Agreement (IDTA) where applicable.

Customers may request a copy of applicable transfer mechanisms by contacting dpo@mirrormire.ai.

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law. Our standard retention periods are:

Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymised.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access control (RBAC) limiting access to authorised personnel only.
• Multi-factor authentication (MFA) for all administrative access.
• Annual penetration testing by an independent third party.
• Independent SOC 2 Type II audit (report available to customers under NDA).
• Incident response procedures with defined notification timelines.

No system is completely secure. In the event of a personal data breach that is likely to result in high risk to individuals, we will notify affected individuals and relevant supervisory authorities in accordance with applicable law.

Depending on your jurisdiction, you may have the following rights in relation to your personal data:

To exercise any of these rights, email privacy@mirrormire.ai with the subject line “Privacy Rights Request”. We will respond within 30 days (or the timeframe required by applicable law). We may ask you to verify your identity before fulfilling a request.

Our platform and services are intended for business use only and are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact privacy@mirrormire.ai and we will promptly delete it.

Our website may contain links to third-party websites, documentation, or resources. We are not responsible for the privacy practices of those third parties and encourage you to review their privacy policies before sharing any personal data with them.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the effective date at the top of this document.
• Notify platform users by in-app notice or email at least 14 days before the change takes effect.
• Post the updated policy at mirrormire.ai/privacy.

Your continued use of our services after the effective date constitutes acceptance of the updated policy. If you do not agree with any changes, you may close your account or stop using our services.

If you have any questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please contact us:

We aim to acknowledge all enquiries within 5 business days and resolve them within 30 days. For complex requests or complaints, we will keep you informed of progress.