Privacy policy

Last updated 16 October 2026

This privacy policy informs you under Art. 13 and 14 GDPR which personal data Cloo GmbH processes when you visit our website mirafive.io, use MIRA FIVE at app.mirafive.io or write to us. Section 15 explains what applies when you visit the website of one of our customers that uses MIRA FIVE.

1. Controller and contact

The controller responsible for the processing is:

Cloo GmbH
Reumtengrüner Str. 32B
08209 Auerbach
Germany

Represented by the managing directors Yannick Seeger and Paul Otto.

Phone: +49 3744 3515904

Data protection: info@cloo-gmbh.de

Product and support: hello@mirafive.io

Please send questions about data protection and requests concerning your rights to info@cloo-gmbh.de, to hello@mirafive.io or by post to the address above. Further details are in the imprint.

2. Overview: controller or processor

We are the controller within the meaning of Art. 4(7) GDPR for

visits to our website mirafive.io,
accounts, organisations, payments and connections in MIRA FIVE (account data),
the conversations with Mira, our agent in the app, and the data we keep about them (section 10),
emails you send us, and
the logs we use to protect our systems.

The data that our customers’ websites, apps and servers send to MIRA FIVE (customer data), on the other hand, we process as a processor under Art. 28 GDPR. The controller is then the customer, that is, the operator of the website or app concerned. Section 15 has the details.

MIRA FIVE is offered to businesses. Where this policy names Art. 6(1)(b) GDPR and you are not a party to the contract yourself but act for a customer, for example as an employee, we base the processing on our legitimate interest, and the customer’s, in performing the contract with the customer (Art. 6(1)(f) GDPR).

We run the service on servers of Hetzner Online GmbH in Germany: a cloud server in Nuremberg for the app, the API, the collector, the worker and the database, and a dedicated server in Falkenstein for our own tools (section 13). Cloudflare sits in front of our hosts (sections 3 and 13). The answers of Mira are written by Claude models that Amazon Web Services runs for us in data centres in the EU (section 10). We do not sell personal data.

3. Visiting our website

The website mirafive.io runs as static files on Cloudflare Workers. Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, delivers the pages and provides our DNS. Cloudflare operates servers in many locations worldwide. Your request is answered by the location nearest to you. Cloudflare acts as our processor under the Cloudflare Data Processing Addendum, which forms part of its terms for our account.

To deliver a page to you, Cloudflare processes the connection data your browser transmits with every request: your IP address, the requested address, date and time, the referring page, and details of your browser and operating system. Cloudflare can write this data to logs. The purpose is to deliver the pages and to protect them against overload and attacks. The legal basis is our legitimate interest in a fast, stable and secure website (Art. 6(1)(f) GDPR). Without this data we cannot deliver the pages to you.

The website sets no cookies and stores nothing on your device. We serve fonts and all other files ourselves. The website makes no request to any third party. It contains no content or services from other providers.

4. Analytics on our website

The website mirafive.io uses no analytics. It loads no measurement script, and it stores nothing on your device. We do not measure which pages you open on our website. The only processing is the delivery of the pages by Cloudflare, as section 3 describes.

If we start to measure visits to this website, we will ask for your consent first where the law requires it, and we will update this policy before.

5. Registration and account

For an account with MIRA FIVE at app.mirafive.io we process:

your name and email address,
the confirmation status of your email address,
if you sign in with Google, the picture address that Google sends us,
the sign-in method you use and, for a passkey, its public key, the device type, whether it is backed up, its transports and its authenticator identifier (AAGUID),
the record that an owner accepted the data processing agreement for an organisation: version, person, kind of caller (app, chat, API key or OAuth connection) and time.

MIRA FIVE has no passwords. You sign in in one of three ways:

Google. You sign in through Google’s sign-in procedure. Google receives the sign-in event as an independent provider under its own terms. We receive your name, your email address, your picture address and the information that Google verified the address. We store Google’s access tokens encrypted.
Email code. We send a six-digit code to your address. It is valid for five minutes and we store it only as a hash. Limits protect against abuse: for example one code per address per minute and a small number per hour and day. We store the counters as keyed hashes of the address or IP address (section 13).
Passkey. You can add a passkey in the settings. Your device keeps the private key. We store the public key and the details listed above.

The purpose is to provide your account and the service. The legal basis is Art. 6(1)(b) GDPR (contract and pre-contractual steps; for a customer’s employees see section 2). We base the abuse limits on our legitimate interest in protecting accounts against takeover and misuse (Art. 6(1)(f) GDPR). Name and email address are required for an account; without them we cannot set one up.

We store your account data for as long as your account exists. You can delete your account in the settings. We then send a link to your email address, valid for one hour, and you confirm the deletion with it. The deletion is refused while you are the only owner of an organisation that has other members or a paid plan. On deletion we remove your account, your sign-in methods and sessions, your personal organisation and every organisation of which you are the only member, and the private chats you had in other organisations. Analytics data of an organisation that is deleted is removed in batches; section 15 states the periods. Data can remain in backups for a limited time (section 13). We do not delete the Stripe customer record of a deleted organisation; Stripe keeps its records as the law requires (section 8). Statutory retention obligations (section 8) remain unaffected.

While you are signed in, we store your session in our database: a token (the cookie holds it), the time it expires, the organisation you work in, and your IP address and browser identification (user agent) as they were sent when the session started. The session lasts 30 days. Each day of use renews it. We delete expired sessions daily. We use the IP address and browser identification to show you your sessions and to investigate abuse.

The app sets the following cookies. The names are those of our sign-in software; in production they start with __Secure-.

Cookie	Purpose	Storage period
`better-auth.session_token`	links your browser to your session; sent only over HTTPS and not readable by scripts	30 days, renewed by use
`better-auth.session_data`	a signed copy of the session data for speed; the system re-reads your membership from the database on every request	60 seconds
`better-auth.otp_ticket`	set when you ask for a sign-in code, so the screen can tell you if the email did not arrive; holds your address in lower case	10 minutes
short-lived sign-in cookies	carry the state of a Google sign-in or the challenge of a passkey sign-in	only for the sign-in procedure
`mf-org`	remembers the last project you opened; holds your user id and project id	one year
`better-auth.last_used_login_method`	remembers how you signed in last time (for example `google` or `email`), so the sign-in page can suggest it; no other data	30 days

The app also stores two settings in your browser’s local storage: mf-theme (light or dark colour theme) and mf-motion (your choice to reduce motion). They contain no personal data and are never sent to us.

These cookies and entries are strictly necessary for us to provide the service you asked for. The legal basis for storing and reading them is § 25(2) no. 2 TDDDG, and for the further processing Art. 6(1)(b) GDPR (see section 2). The app sets no cookies for analytics or advertising. The app has no analytics script. It loads no script, font or image from third parties.

7. Organisations, members and invitations

Every account receives a personal organisation. You can create further organisations and invite other people. For this we process the organisation’s name, memberships and roles (owner, admin, member) and, for invitations, the invited person’s email address, the intended role and who sent the invitation. Projects, websites, apps and servers that you add belong to the organisation.

The invited person receives an email with a link. The invitation is valid for seven days and is deleted afterwards. An invitation needs a confirmed email address. If you are invited, we have your email address from the person who invites you.

The legal basis is Art. 6(1)(b) GDPR for managing the organisation (see section 2). We base invitations to people who do not yet have an account on our legitimate interest, and the customer’s, in adding colleagues to a shared organisation (Art. 6(1)(f) GDPR).

We store memberships for as long as they exist. If the owner deletes an organisation, we remove its data. This is possible only when the organisation is on the free plan, so a running paid plan must end first. Section 15 states the periods for analytics data.

8. Payments

The owner of an organisation books a paid plan through Stripe Managed Payments. In this service, Sold through Link, LLC, an affiliate of Stripe, is the merchant of record for the payment. It handles the checkout, charges the payment method, calculates, collects and pays value added tax and other sales taxes, and issues receipts and invoices in its own name. The card statement shows LINK.COM* followed by our descriptor. You enter your payment details, such as card details, directly with Stripe; we do not receive them. Cloo GmbH remains the provider of MIRA FIVE. Your purchase is also subject to the Sold through Link terms.

For each organisation we create a customer record at Stripe. We transmit to Stripe the organisation’s name, the email address of an owner and the organisation’s identifier. For usage above the allowance, we transmit usage counts as meter events (events, imported rows and AI credits). They contain no data about individual visitors. We receive from Stripe the status of the subscription and payments, amounts and Stripe’s own identifiers. We store plan, status, usage and these identifiers. Receipts and invoices come from Stripe and Sold through Link by email and are available in the Stripe customer portal.

Stripe and Sold through Link process the payment data that they collect as independent controllers for their own purposes, such as payment processing, tax, fraud prevention and their legal obligations. They are not our processors. Our Stripe contracting entity is Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, Ireland. Details are in Stripe’s privacy policy. For transfers to the USA, see section 16.

The legal basis is Art. 6(1)(b) GDPR. We keep records that the law requires us to keep (Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB), for as long as commercial and tax law require, up to ten years. We delete the usage records in the app after 400 days. Without this data we cannot bill a paid plan.

9. Emails from the app

MIRA FIVE sends only emails that belong to the service, no newsletters and no advertising:

sign-in codes,
invitations to an organisation,
the link to confirm an account deletion,
notices about payments and plans, such as a failed renewal or the end of a plan, and notices to owners when usage reaches the allowance or the spend limit,
a weekly digest of the analytics of your projects, alerts about problems with tracking and alerts about large changes in your traffic.

You can switch off the optional emails (digest and alerts) with the link in each message or in the settings.

We send them from no-reply@mirafive.io through Sinch Mailjet SAS, 43 rue de Dunkerque, 75010 Paris, France (“Mailjet”), our processor. We switch off open and click tracking. Mailjet processes the data in the EU. Mailjet receives your email address, your name where applicable, and the content of the message. The digest and the alerts contain customer data in the form of totals, such as visitors, page views and revenue per week, and short sentences that can name a referring website or a page path (shortened to 48 characters). Mailjet is therefore a sub-processor for these emails.

The legal basis is Art. 6(1)(b) GDPR where the emails serve the performance of the contract (see section 2), and otherwise our legitimate interest in a secure and working service (Art. 6(1)(f) GDPR).

10. The AI chat (Mira)

In the app you talk to Mira, an AI agent. Mira answers your questions about your analytics, can change settings after you confirm them, and writes the text of its answers with a large language model. The model does not write the numbers of a chart or table: they come from the data we store.

When you send a message, the following reaches the model:

your messages and the instructions that tell Mira how to work,
a short note about your project: the project name, up to five website domains, the names of apps and servers, and the date,
the results of the questions Mira asks our system. They are compact totals, rankings, ids and labels, not raw event rows. Page paths, titles, referring websites, campaign names, event names, search terms and account names that come from tracked data are marked as data so that the model never reads them as instructions,
if you ask about people, the information about those people that your organisation stored: user ids, traits (email addresses and phone numbers as keyed hashes by default), first and last visit, revenue and a short list of recent visits,
the names and email addresses of the members of your organisation, if you ask about them,
ad figures and search terms from connected platforms (section 11), if you ask about them.

The following never reaches the model: Stripe keys, access tokens of connected platforms, the download link of a data export, and the raw rows we import from platforms.

The answers are generated by Claude models, made by Anthropic, that Amazon Web Services EMEA SARL (“AWS”) runs for us in Amazon Bedrock in AWS data centres in the EU. We use the region Europe (Frankfurt); AWS can route a request between its regions in the EU. AWS is our processor, and for customer data our sub-processor (section 16). Processing for the AI stays in the EU, so there is no transfer to a third country for it.

We configure Amazon Bedrock for zero data retention: AWS writes no prompt and no answer to durable storage. Anthropic, the maker of the models, has no access to the prompts and answers and does not receive them, because Amazon Bedrock runs the models in accounts that only AWS operates. The data is not used to train any model.

The legal basis for the chat is Art. 6(1)(b) GDPR (see section 2). We do not train AI models with your data, and we do not use the personal data of one customer for another.

We store the conversation, the results the model read and the usage of each call (tokens, cost, prompt version) in our database. A conversation stays until the person who wrote it deletes it, or until the organisation or the project is deleted. Private chats are also deleted when the person leaves the organisation. There is no fixed maximum period for chat messages. The system deletes the stream of a run 15 minutes after the run, and finished runs after 30 days. We delete closed requests for confirmation after 30 days. We add up the usage into monthly totals after 90 days.

Mira cannot change data on its own. A change needs your click on a confirmation card, and it runs with your role. We take no decision about you solely by automated means (section 19).

11. Connections to Google, Meta, Microsoft and Stripe (Search Console, Google Ads, Meta Ads, Microsoft Advertising, Bing Webmaster Tools, revenue import)

You can connect an organisation to Google Search Console, Google Ads, Meta Ads, Microsoft Advertising and Bing Webmaster Tools. Only owners and admins can connect. You set up each connection through the provider’s sign-in procedure (OAuth; at Meta, Facebook Login for Business). MIRA FIVE only reads data. It changes nothing in an ad account. For retrieving data we ask only for these permissions:

Service	Permission	What we retrieve
Google Search Console	webmasters.readonly (read only)	search analytics by date, query, page, country and device; sites and sitemaps. They contain no details of individual people searching, but they contain the search terms that people typed.
Google Ads	adwords (Google offers no read-only permission; we only read)	metrics by campaign, ad group and keyword and, for ad clicks, the click identifier with its campaign. Matching them to visits happens on our servers.
Meta Ads	ads_read (read only)	the ad accounts the login reaches, with their name and status; for each campaign, ad set and ad its name, status and objective, and its daily impressions, reach, clicks, spend, conversions and conversion values. They contain no details of individual people.
Microsoft Advertising	msads.manage (Microsoft offers no read-only permission; we only read)	campaign and ad group reports: impressions, clicks, spend, conversions and revenue. They contain no details of individual people.
Bing Webmaster Tools	webmaster.read (read only)	the sites of the Bing Webmaster Tools account and whether they are verified; for the chosen site, clicks, impressions and positions of queries and pages, and crawl statistics. They contain no details of individual people searching, but they contain search terms. We do not keep the codes Bing uses to verify a site.

The lists name the main fields. A connection can retrieve further fields of the same kind. Connections are available where the app offers them; some wait for review by the platform.

For each connection we store the provider’s access tokens, encrypted with AES-256-GCM, and the name of the account used to set it up: at Google the name and email address of the Google account, at Meta the name Meta returns for the token, usually that of the business’s system user, without an email address. Bing Webmaster Tools tells us nothing about the person who signs in, so we name that connection after the verified sites it reaches. We receive these details from the provider. We send no data about visitors to Google, Meta or Microsoft.

We keep the rows exactly as the platform sent them, and the figures we compute from them, so that we can compute them again when we improve a calculation. We keep both for 25 months.

You can also connect your own Stripe account to import verified revenue. For this, you give MIRA FIVE a restricted Stripe key that can only read. We store it encrypted with AES-256-GCM. MIRA FIVE creates a webhook on your Stripe account and imports the last 90 days of charges, then updates. For each charge we store its identifiers, time, currency, amount, refunded and disputed amounts and how we linked it to a visit. We store no names, addresses or card data. We link a payment to a visit through a reference that your website passes to Stripe (only with consent of the visitor), or through a keyed hash of the payer’s email address, when your website sends that address to us. We never store the email address of the payer itself. We keep the data for 25 months.

The purpose is to analyse data from these services in MIRA FIVE. The legal basis is Art. 6(1)(b) GDPR for performing the contract with the customer; if you set up the connection as an employee of a customer, it is our legitimate interest, and the customer’s, in performing the contract (Art. 6(1)(f) GDPR). The imported data is customer data; for it we act as a processor (section 15).

If you disconnect, we delete the tokens, the accounts and the imported data of the connection, and we revoke access at Google and Meta. Microsoft and Bing Webmaster Tools offer no way for us to revoke access; there, deleting the tokens ends our access. When a project is deleted, we delete the tokens but cannot revoke the grants at the providers. You can also withdraw access at any time: at Google in your Google account at myaccount.google.com/permissions, at Meta in the settings of your business portfolio.

Handling of data from Google APIs

MIRA FIVE’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This applies to the data we receive from Google Ads and Google Search Console. In particular:

We use data from Google APIs only to show you your own reports and to answer your questions in the chat.
We do not use it for advertising, including retargeting, personalised or interest-based advertising, and we do not sell it.
We never use it to create, train or improve an artificial intelligence or machine-learning model. When you ask Mira a question about this data, it reaches Mira’s AI provider, Amazon Web Services in the EU (section 10), only to answer that question. Zero data retention applies, and the data is not stored with any model.
We pass it on only where this is necessary to provide the features you use: to our hosting and backup providers (section 16) and to Mira’s AI provider as just described. We also pass it on when you retrieve it yourself through the API or MCP, or when the law requires it.
People read it only with your consent, where this is necessary for security or for investigating abuse, or when the law requires it.

12. API and AI agents (MCP)

Through the REST API and the MCP server, you and programs you choose, such as an AI assistant, can retrieve data from MIRA FIVE.

API keys belong to the organisation. Only owners and admins can create them, in the app. We store them only as a hash or fingerprint, until you delete them or the organisation is deleted. A key can have an expiry date. We delete expired keys. A key for MCP has either read access (the default) or write access.
You connect AI clients through OAuth. Access tokens are valid for one hour, refresh tokens for 30 days, and a refresh token is replaced each time you use it. We delete expired tokens daily, and grants and clients that nobody has used for 30 days.
We record every call through the API or MCP in the audit log (section 13): who called, which function, the name of the key or connection, the outcome and the duration. We do not log the content of requests or results.
Request limits apply per person and per key.

The legal basis is Art. 6(1)(b) GDPR (see section 2) and, for the audit log, our legitimate interest in the security of the service and in evidencing access (Art. 6(1)(f) GDPR).

Data you retrieve through the API or MCP leaves MIRA FIVE on your instruction. It consists of analytics that MIRA FIVE has computed, not of raw data of the Google or Meta platforms. If you use an AI client, the data goes to that client’s provider. You or the customer choose this provider; it is not our service provider, and the responsibility for this disclosure lies with the customer. We do not train AI models with your data.

13. Security, logs and error monitoring

Access log and Cloudflare

Cloudflare’s tunnel and security rules sit in front of app.mirafive.io, api.mirafive.io, collect.mirafive.io and cdn.mirafive.io. Cloudflare ends the encrypted connection, so it sees all requests to these hosts, including IP addresses, cookies, API keys and the content of chat messages. Cloudflare rules block senders that send many rejected requests or requests of a kind these hosts do not accept. Cloudflare acts as our processor under the Cloudflare Data Processing Addendum (section 16).

The programs of MIRA FIVE write no access log and never write an IP address to a log. The log line of the API holds only a request id, the method, the route, the status code and the duration. The reverse proxy on our server can write access logs (IP address, time, request, status code). They stay in the container logs, which are rotated by size and kept for a few days at most. System logs that contain IP addresses, such as SSH sign-ins and blocked firewall packets, are kept for up to five weeks. We use such logs only to detect and fend off attacks. Better Auth stores the IP address and browser identification of a session in the session row until the session expires (section 6).

Server security

Data at rest on the servers is protected by the physical and access controls of the data centre; backups are encrypted before they leave the server. We do not encrypt the disks of the servers at the operating-system level. The servers accept SSH only with keys, on a non-standard port, with no password sign-in and no direct root sign-in from the internet. A firewall denies all incoming traffic except the web ports and SSH, and an intrusion-prevention system (CrowdSec) blocks attacking IP addresses. Security updates of the operating system install automatically every day. Container images are pinned to versions and scanned for known vulnerabilities every week. Administration interfaces sit behind Cloudflare Access, where only the managing directors can sign in.

Request limits

To limit abuse, we count requests per sender. For sign-in, we store counters as keyed hashes of the IP address or email address. We keep a counter only until its time window ends, at most about a day, and delete Better Auth’s counters after two days. On the collection host we count events per visitor per hour from the daily visitor value (section 15) and keep this counter for two hours.

Audit log

We record security-relevant events in an audit log: each call through the app, the API and MCP, with the person, the function, the outcome and the duration, and with the name of the client for AI clients. We never record the input or the result. We keep these entries for 90 days. Every access by our staff is recorded separately and kept for 365 days. We keep reports that agents or Mira send us about problems, with personal-looking text removed, for 365 days.

Access by our staff

Our staff cannot sign in as a user. Two founders use an internal area to support customers and to fend off abuse. It reads data across organisations, such as name, email address, organisations, plan and number of events. Every read and every change is recorded in the audit log with the person who did it. Only the managing directors have personal administrative access to the production systems. Automated systems, such as deployment and database migrations, use their own keys with restricted rights. The managing directors grant and remove access through our configuration management.

Error monitoring and monitoring

We capture errors in the programs of MIRA FIVE with Sentry. Sentry is our own software on our own server, a dedicated server of Hetzner Online GmbH in Falkenstein, Germany. It is not a service provider. The programs remove user data, cookies, headers, request bodies and query strings before they send a report. Error messages can still contain free text. We keep error reports for 14 days.

We watch the health of our systems with Prometheus, Alertmanager and Grafana on our own server in Germany. The metrics hold counters and route names, no visitor data. Alerts reach the managing directors as push notifications and by email.

Backups

We back up our database continuously and with a full backup each week and a difference backup each day. The backups are encrypted on our server with AES-256 before transfer, with a key that Amazon does not hold, and stored at Amazon Web Services EMEA SARL (AWS) in the region Europe (Frankfurt), eu-central-1. AWS also encrypts the stored files, the transfer uses TLS, and the backup files are versioned and write-protected. We can restore the database to any moment of the last 7 to 14 days. After the backups expire, older versions of the backup files are removed after a further 21 days. Deleted data can therefore remain in backups for up to 35 days. There it is protected and not used until the backup is removed.

Legal basis

The legal basis for the processing in this section is our legitimate interest in protecting our systems and the data of our users and customers against attacks, abuse, errors and loss (Art. 6(1)(f) GDPR), and our obligation to ensure the security of processing (Art. 6(1)(c) in conjunction with Art. 32 GDPR).

14. Contact and support by email

When you write to us at hello@mirafive.io or info@cloo-gmbh.de, we process your email address, your name if given, and the content of your message in order to answer it.

Our mailboxes are run by Google Workspace of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor. Google LLC in the USA may process data in the process. Google LLC is certified under the EU-U.S. Data Privacy Framework; the European Commission’s standard contractual clauses also apply (section 16). The legal basis is Art. 6(1)(b) GDPR if your message concerns a contract or entering into one, and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We keep the correspondence for as long as the matter is open and statutory retention obligations for commercial and business letters require it (§ 257 HGB, § 147 AO).

If, as a customer, you send us personal data of your visitors in a support request, we process it as a processor under the data processing agreement.

15. Data of visitors to our customers’ websites

Roles and whom to contact

When you visit a website or app that uses MIRA FIVE, we process data about your visit on behalf of its operator. The operator is the controller; we are its processor under Art. 28 GDPR. We act only on its instructions and on the basis of our data processing agreement. The sub-processors we use are listed on the sub-processors page. If an agency uses MIRA FIVE for its clients, we are a further processor.

The operator decides which data is collected and on which legal basis. It informs you about this in its privacy policy and answers your requests. Please therefore contact the operator first. We support it in this; MIRA FIVE gives it tools for access, erasure and objection for individual people.

What can be collected

Your browser loads the script from cdn.mirafive.io, and collect.mirafive.io receives the data. Operators can also send data from their apps or servers through the events interface of MIRA FIVE. The same consent rules apply there. The operator chooses one of three tracking modes for each project:

Hybrid (the default): without your consent the script stores nothing on your device. With your consent for statistics it stores an anonymous id on your device.
Cookieless: the script never stores anything on your device, and never keeps an id.
Persistent: the script stores an anonymous id from the first visit on, unless you refuse or your browser sends a Global Privacy Control signal.

The operator is responsible for the legal basis of the mode it chooses.

Without consent: no cookie, nothing in local storage, no id. The collector derives a visitor value from your IP address and your browser identification: a keyed hash of both, combined with a random salt that is new for each project and each day. The salt is deleted when the day ends. The same person is thus one visitor on that day within the project, and cannot be recognised on another day. All page views of one day from the same browser are linked with each other for that day. The system never joins such data to a named person.

With consent: one random id in your browser’s local storage on the operator’s domain, no cookies. It is renewed about 13 months (395 days) after it was created. MIRA FIVE sets no session identifier; it builds visits on the server. Nothing is stored before you consent. The operator can link visits to its own user identifier and transmit details such as a name or email address with it. We store the traits of a person that an operator sends. Email addresses and phone numbers are stored only as a keyed hash unless the operator switches this off.

Depending on the settings and on your consent, the following is collected: pages opened (without parameters and fragment, with ids in the path replaced) and their titles, the host of the referring page, campaign parameters (UTM), language, time zone and screen size class, device type, browser and operating system, country, region and city, engagement time, scroll depth and web performance values, links to other websites (host only), downloads (host and path), forms submitted (id or name of the form), pages not found, events and revenue defined by the operator, and search terms on the website with personal-looking terms hidden. Properties that an operator sends with events are stored as sent, up to the limits of the system. Passwords and form fields are never read. Advertising click identifiers are stored as values only with marketing consent; otherwise only their presence is recorded. We discard requests from bots. We do not store the browser identification itself.

The IP address. We never store your IP address in the analytics database and never write it to a log. We use it in memory for the visitor value and to determine your location, and Cloudflare sees it as described in section 13. We determine the country from the network of the IP address (the first three parts of an IPv4 address, or the first 48 bits of an IPv6 address) with the free IP database of DB-IP (DB-IP Lite, licence CC BY 4.0, IP Geolocation by DB-IP). Region and city come from the location headers of Cloudflare or from the operator’s own proxy, where available. For the security logs in section 13 we are the controller ourselves.

Global Privacy Control and Do Not Track. If your browser sends a Global Privacy Control signal, the script still sends a page view, and MIRA FIVE then keeps no id and no marketing value unless the operator’s website reports that you explicitly consented. Do Not Track is not read.

Storage period. How long the data is stored depends on the type of data and on the operator’s plan:

Data	Storage period
Individual events	30 days (free plan), 90 days (Pro plan), by contract for Enterprise (90 days until set); an event is deleted when its day was totalled up
Visits	180 days
Daily totals without a reference to a person	25 months
People (one row per user id of the operator), links between browsers and people, goal conversions, attribution results and imported payments	25 months after the last event
Daily salt	until the end of its day

After these periods the data is deleted in batches. Data that a customer or a person deletes is removed from the live database within 7 days; the deletion jobs usually finish within minutes. Backups follow section 13. We do not use this data for our own purposes, do not sell it and do not train AI models with it. For billing and operation we use only aggregated counts without reference to a person, such as the number of events per organisation. Operators can use Mira to ask about their data; section 10 explains what then reaches the model.

How to object to the collection

Decline consent on the website concerned, or withdraw it there.
Turn on Global Privacy Control in your browser. MIRA FIVE then keeps no id for you.
Ask the operator to put you on its objection list. MIRA FIVE then stops linking your id within seconds, and the operator can also have your stored events erased.

16. Recipients and transfers to third countries

Personal data is received only by the following parties, each only to the extent necessary for the stated purpose:

Recipient	Task	Role	Place of processing
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany	cloud server in Nuremberg for the entire service; dedicated server in Falkenstein for our own tools (error monitoring, monitoring, Git server, deploy control)	processor	Germany
Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA	DNS, tunnel and security rules for all hosts; delivery of mirafive.io; storage of the public tracking scripts at cdn.mirafive.io (R2); location headers	processor	worldwide edge network; transfer to the USA possible
Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg	encrypted database backups; files such as data exports and logos; AI models (Amazon Bedrock) that answer the requests of the AI chat	processor	EU (Frankfurt, eu-central-1; AI requests can be routed between AWS regions in the EU); access from the USA for support and operations cannot be ruled out
Sinch Mailjet SAS, 43 rue de Dunkerque, 75010 Paris, France	sending the app’s emails	processor	EU
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland	email mailboxes (Google Workspace), for support mail	processor	EU; transfer to the USA possible
Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, Ireland, and Sold through Link, LLC	payment processing and sale of paid plans as merchant of record	independent controllers	Ireland and USA
Google, provider of Google sign-in, Google Search Console and Google Ads	sign-in with Google; if you set up a connection: retrieval of data with your access token	provider of the connected service, under its own terms with the user or customer	transfer to the USA possible
Meta, provider of Meta Ads	only if you set up a connection: retrieval of data with your access token	provider of the connected service, under its own terms with the customer	transfer to the USA possible
Microsoft, provider of Microsoft Advertising and Bing Webmaster Tools	only if you set up a connection: retrieval of data with your access token	provider of the connected service, under its own terms with the customer	transfer to the USA possible

Our processors act only on our instructions on the basis of a contract under Art. 28 GDPR. Beyond this, we disclose personal data only where we are legally obliged to, for example on the order of an authority or a court.

A transfer to countries outside the EU and the EEA is possible only in these cases:

Hetzner: Hetzner Online GmbH processes the data in Germany. Its data centres are certified under ISO/IEC 27001. No transfer takes place.
Cloudflare: Cloudflare, Inc. is a US company, and its servers in many locations process requests. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). The standard contractual clauses in the Cloudflare Data Processing Addendum apply as a fallback (Art. 46(2)(c) GDPR).
AWS: our backups and files are stored in Germany, and the AI models run in the EU. We encrypt the backups before transfer with a key that AWS does not hold. AWS may access data from the USA for support and operations. For this, Amazon.com, Inc. and its US subsidiaries, including Amazon Web Services, Inc., are certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR), and the standard contractual clauses in the AWS data processing addendum apply (Art. 46(2)(c) GDPR).
AI chat: the processing stays in the EU (section 10). No transfer to a third country takes place for it.
Mailjet: the data is processed in the EU. We plan no transfer to a third country.
Stripe and Sold through Link: Stripe, LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). The standard contractual clauses in the Stripe data processing agreement also apply (Art. 46(2)(c) GDPR).
Google: with Google sign-in, Google Workspace and connected Google services, Google LLC may process data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). The European Commission’s standard contractual clauses also apply (Art. 46(2)(c) GDPR). You can obtain a copy from us on request.
Meta: with a connection to Meta Ads, Meta Platforms, Inc. may process data in the USA. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR).
Microsoft: with a connection to Microsoft Advertising or Bing Webmaster Tools, Microsoft Corporation may process data in the USA. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR).

Where there is no adequacy decision, we use the standard contractual clauses of the European Commission as a fallback for each US service provider. You can obtain a copy from us on request. DB-IP is not a recipient: we download its database and send it no personal data.

17. Storage periods

We store personal data only for as long as the respective purpose requires or the law demands. In overview:

Data	Storage period
Account data (name, email address, sign-in methods, settings)	until the account is deleted
Session in the app (including IP address and browser identification)	30 days, renewed by each day of use; expired sessions are deleted daily
Sign-in codes and deletion links	5 minutes and 1 hour; deleted one hour after they expire
Counters for sign-in limits (keyed hashes)	until the window ends, at most about a day; Better Auth counters two days
Invitations	seven days, then deleted
API keys (as a hash)	until you delete the key or the organisation is deleted; expired keys are deleted
OAuth tokens for AI clients	one hour (access) and 30 days (refresh); expired tokens are deleted daily
Tokens and account details of a connection	until the connection is removed or the organisation is deleted
Imported platform data and the rows as sent	25 months; deleted when you disconnect the connection
Chat conversations	until the person deletes them or the organisation or project is deleted; private chats also when the person leaves the organisation; no fixed maximum
Chat runs, streams and requests for confirmation	stream 15 minutes; run 30 days; closed requests deleted after 30 days; usage totals after 90 days
Usage records in the app	400 days
Receipts and accounting records	as long as commercial and tax law require, up to ten years
Emails to us	as long as the matter is open and statutory retention obligations apply
Container logs of the reverse proxy on our server (may contain IP addresses)	a few days at most
System logs of our servers that contain IP addresses	up to five weeks
Audit log of calls	90 days
Audit log of our staff, and reports of problems	365 days
Error reports	14 days
Data that you or a customer delete, in the live database	within 7 days
Backups	7 to 14 days; old file versions 21 days more, so deleted data can remain for up to 35 days

Section 15 states the storage periods of the data of our customers’ visitors.

18. Your rights

Under the GDPR you have the right to

obtain access to the data we process about you (Art. 15),
have inaccurate data corrected (Art. 16),
have your data erased (Art. 17),
have the processing restricted (Art. 18),
receive data you have provided to us in a structured, commonly used and machine-readable format, or have it transmitted to another controller (Art. 20),
withdraw a consent at any time with effect for the future (Art. 7(3)); the lawfulness of processing carried out before the withdrawal remains unaffected.

To do so, write to info@cloo-gmbh.de or by post to the address in section 1. You can also change or delete many details yourself in the app’s settings.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

Die Sächsische Datenschutz- und Transparenzbeauftragte
Devrientstraße 5
01067 Dresden
Germany

Where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You can send your objection informally to info@cloo-gmbh.de.

19. Obligation to provide data and automated decisions

You do not have to provide any personal data to use our website. The connection data from section 3 arises for technical reasons; without it we cannot deliver the pages.

An account requires a name and an email address, and a paid plan additionally requires your payment details at Stripe. Without this data we cannot conclude or perform a contract. There is no statutory obligation to provide the data.

We make no decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Mira proposes changes, and a person confirms each one.

20. Changes to this policy

We update this policy when our website, the service or the legal situation change. The date at the top of the page shows the version in force.