Privacy Policy

1. Who we are and how to reach us

Agence Créative Maison Santé operates Mira. Our person in charge of the protection of personal information can be reached at hello@mirasocial.co. Write there for any question, access request, correction, withdrawal of consent or deletion request. We answer within 30 days.

Two roles apply. For your account, your sign-in, billing and how Mira itself works, we decide why and how the information is used. For the content, media, comments and client contact details that an agency puts into its workspaces, the agency decides what goes in and who sees it, and we process that information on the agency's instructions. If you are a client of an agency and want to know what that agency has stored about you, ask the agency first; we will help them answer.

2. The Mira website

The public pages at mirasocial.co can load three measurement tools, each only as your cookie choice allows: Google Analytics and Microsoft Clarity, which show us how people find and use the site, and the Meta Pixel, which measures which of our ads bring people to the site. In Quebec, the European Economic Area, the United Kingdom and Switzerland, and wherever we cannot tell your location, none of them load until you choose them in the cookie notice. Elsewhere they are on until you switch them off in Cookie settings, at the foot of every page. A browser that sends the Global Privacy Control signal is treated as a no to all of them, everywhere. The Cookies section lists what each one stores.

If you enter your email address on our early access page, the site takes you to sign up with that address filled in. Where you allowed advertising measurement, it also tells Meta that someone asked to sign up, with a one-way hashed copy of the address (never the address itself) so Meta can match the visit to an ad. Our host, Vercel, processes visitor IP addresses in its server logs, as every host does, to serve the pages and protect them from abuse. If you email us, we receive what you send and your address, and we use it only to reply.

Everything else in this policy is about the application and the client portal, where accounts, workspaces and connected platform data live.

3. What we collect in the application

We collect what the product needs to work and nothing for resale. Two optional measurements are the only exceptions, and both depend on your choice:

• Usage analytics. Microsoft Clarity records how agency users move through the application (pages, clicks and scrolling), with the text and images on the page masked except navigation, buttons and headings. In consent regions it runs only if you say yes, at sign-up or later; elsewhere it runs until you switch it off. Change it in Settings, Profile, Privacy. It never runs on client-facing pages or for client users.
• Advertising measurement. If you visited our website with advertising measurement allowed before you signed up, the application tells Meta when you finish creating your account and when a free Pro offer starts on your agency, so we can see which ads bring agencies to us. It sends a hashed copy of your email address and of your account identifier, your IP address and browser type, and the Meta identifiers our website stored in your browser. It never sends your name, your agency, your clients or anything in your workspaces, and it never sends anything from the client portal or about client users.

4. Connected social, advertising and email platforms

Mira can connect to Meta (Facebook Pages and Instagram professional accounts), TikTok, LinkedIn, Pinterest, Meta Ads, TikTok Ads, Pinterest Ads, Klaviyo and Mailchimp. A connection is always started by an agency user who holds the right to manage that account, through the platform's own consent screen. We hold only the permissions you grant on that screen, and you can take them back at any time, in Mira or in the platform's own settings.

We use platform data for these purposes and no others:

• To show you which accounts are connected and let you choose where a post publishes.
• To publish or schedule the content you approve, at the time you choose, to the accounts you choose, and to record the resulting post identifier so the post can be matched to its performance.
• To fetch the performance figures of your accounts and of the posts published through the service, so the Reports pages and client reports can show them.
• To tell you when a connection needs attention, for example when a token has expired or a permission was removed.

We do not:

• Sell platform data, share it with advertisers or data brokers, or use it to build audience profiles or advertising segments.
• Use platform data to train machine-learning or artificial-intelligence models.
• Use platform data for anything unrelated to the features you asked for, or combine it with information about people outside your own accounts' audiences.
• Pass platform data to anyone other than the providers listed in this policy, who process it only on our instructions.
• Read private messages, contacts or friend lists. We do not request those permissions.

Access tokens are encrypted before they are stored, kept in a table that only our server code can reach, never sent to a browser and never written to logs. When you remove an account in Mira, or revoke Mira inside the platform, we delete the tokens straight away and stop every data pull for that account. Performance figures already shown in your reports stay in your workspace until you delete the content or the workspace, because they are part of your own reporting record; you can ask us to delete them sooner at any time.

Our use of information received from Meta complies with the Meta Platform Terms and Developer Policies. Our use of information received from TikTok complies with the TikTok Developer Terms of Service. Our use of information received from LinkedIn, Pinterest, Klaviyo and Mailchimp complies with each platform's developer and API terms. Where a platform instructs us to delete data, we do so within the time the platform sets.

5. How we use it

• To run the service: sign you in, show your workspaces, store and display content, run approvals, publish to connected accounts and build reports.
• To send the emails and in-app notifications the service depends on: sign-in codes, invitations, approval requests, comments, status changes and publishing results. Non-essential notifications can be turned off in your settings.
• To bill agencies through Stripe and keep the records that tax and accounting law require.
• To keep the service secure: detect abuse, investigate errors and incidents, and enforce our Terms of Service.
• To answer your questions and support requests.
• To understand how people find and use our website and application, and which of our ads bring people to us, through the analytics and advertising measurement described above and only as your choices allow.
• To comply with the law and respond to lawful requests from public authorities.

We never use the content of your workspaces, your clients' information or connected platform data for advertising. We do not use personal information for profiling, or for decisions made solely by automated means that have legal or similarly significant effects on you.

6. Consent and legal bases

In Quebec and the rest of Canada we collect, use and share personal information with your knowledge and consent, as the Act respecting the protection of personal information in the private sector and the Personal Information Protection and Electronic Documents Act require. You give that consent when you create an account, accept an invitation or connect a platform, and you can withdraw it at any time by email or by removing the connection. Where the law allows us to proceed without consent, for example to deliver the service you asked for or to meet a legal obligation, we do only what that purpose needs.

Where the General Data Protection Regulation or the UK GDPR applies, our bases are: performance of a contract for everything needed to run the service; legitimate interests for security, abuse prevention, reliability and service communications, where your rights do not override them; consent for connecting a platform account, for optional notifications, and for website analytics, application usage analytics and advertising measurement; and legal obligation for billing records and lawful requests.

Your choices about analytics and advertising measurement can be withdrawn at any time, with Cookie settings on the website or in Settings, Profile, Privacy in the application. A website choice lasts 12 months, after which we ask again where the law requires a choice; we also ask again sooner if we add a new purpose.

7. Who else sees it

We share personal information only with the providers below and with the platforms you choose to connect. The hosting, storage, email, billing and analytics providers process it for us under contracts that limit them to our instructions. Meta receives advertising measurement under its own Business Tools Terms and may use it to measure and improve the delivery of our ads. We never sell personal information.

Inside your agency, other members see what their permissions allow. Client users see only the content their agency has put in front of them for review, and never see tasks, billing, platform credentials or internal comments.

We may also disclose information when the law requires it, to protect the rights, safety or property of Mira, our users or the public, or as part of a merger, acquisition, financing or sale of assets, in which case this policy keeps applying to your information until you are told otherwise.

8. Where information is processed

Our servers and most of our providers are in the United States, so personal information collected in Quebec, elsewhere in Canada, the European Economic Area, the United Kingdom or anywhere else is transferred to and processed in the United States. Before using a provider outside Quebec we assess the protection it offers, and we bind each one by contract to safeguards equivalent to those in this policy. Where the law requires, we also rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or an equivalent mechanism.

9. How long we keep it

When information is no longer needed for the purpose it was collected for, we delete it or make it anonymous.

10. Your rights and choices

Wherever you live, you can ask us what personal information we hold about you, have it corrected, have it deleted, receive a copy of the information you gave us in a structured and commonly used format, restrict or object to how we use it, and withdraw a consent you gave. Much of this is self-serve: edit your profile and notification preferences in Settings, remove a platform in Settings, and delete content and assets in the workspace. For everything else, email hello@mirasocial.co from the address on your account and we will act within 30 days. We may ask a question or two to confirm it is really you.

If you are in Quebec, you may also ask us to stop spreading information about you or to de-index it where the law provides, and you may complain to the Commission d'accès à l'information du Québec. Elsewhere in Canada you may complain to the Office of the Privacy Commissioner of Canada. In the EEA or the UK you may complain to your local data protection authority. If you are a California resident, the California Consumer Privacy Act gives you the rights above. We do not sell personal information. The advertising measurement described above may count as sharing for cross-context behavioural advertising under that Act; you can opt out with Your Privacy Choices at the foot of every page of the website, which switches off Advertising, and we treat a Global Privacy Control signal as that opt-out.

Step-by-step instructions, including for information received from Meta or TikTok, are on the Data deletion page.

11. Cookies

On the website, three cookies are essential and always set: mira_geo, which says whether your location needs a choice first; mira_consent, which keeps your choice for 12 months across mirasocial.co and its subdomains; and mira_gpc, which notes a Global Privacy Control signal. The rest depend on your choice. Analytics adds Google Analytics' _ga cookies and Clarity's _clck and _clsk. Advertising adds the Meta Pixel's _fbp and, when you arrive from a Meta ad, _fbc. Saying no removes the cookies of what you turned off, and Cookie settings at the foot of every page changes your choice at any time.

The application sets strictly necessary cookies: the session cookie that keeps you signed in, a short-lived cookie that protects the platform connection flow against forgery, a cookie that remembers interface preferences such as a collapsed sidebar, one that remembers whether you last signed in with Google or by email, and, for 7 days, one that holds the offer and campaign of a signup link you followed. Clarity's cookies are added only where your usage analytics choice allows. The client portal sets only strictly necessary cookies. Clearing cookies in your browser signs you out and resets your choices, and nothing else breaks.

12. Security and confidentiality incidents

All traffic is encrypted in transit and all stored information is encrypted at rest. Platform access tokens are additionally encrypted with a key held only by our server environment, in a table with no access path from the browser or from any API response. Every record is scoped to its agency and protected by row-level security in the database, so one agency can never read another agency's information. Sign-in uses one-time emailed codes rather than passwords. Access to production systems is limited to the people who operate the service and is logged.

No online service is completely secure. We keep a register of confidentiality incidents. If an incident creates a risk of serious injury to you, we will notify you and the Commission d'accès à l'information du Québec or the other authority the law names, without undue delay and within the time the law requires.

13. Children

Mira is a business tool and is not directed to children. You must be at least 18 years old, or the age of majority where you live, to create an account. We do not knowingly collect information from anyone under 14, and we never collect it from a minor without the consent of a parent or guardian. If you believe a child has given us personal information, email us and we will delete it.

14. Changes to this policy

When we change this policy we update the date at the top. If a change materially reduces your rights or changes how we use platform data, we will tell agency administrators by email or in the product before it takes effect.

15. Contact

Agence Créative Maison Santé, operator of Mira. Person in charge of the protection of personal information: hello@mirasocial.co. Use the same address for privacy questions, access and correction requests, and deletion requests. Une version française de cette politique est disponible sur demande à la même adresse.