Privacy Policy and Information Notice

This text is the information notice under Article 10 of the KVKK and the notice under Articles 13–14 of the GDPR.

1. Data controller

MirorX Teknoloji Limited Şirketi (MirorX in the app stores), MERSİS 0621131579000001. Address: Ömerağa Mah. Fethiye Cad. No:36 İç Kapı No:1, 41300 İzmit / Kocaeli. Email: support@mirorx.ai.

2. Data collected

• Account: email address or Apple/Google sign-in ID, display name, username, language, country, preferences.
• Photos: photos uploaded for Miror (a model unique to each user) and for photo generation, generated photos and requests.
• Instagram DM inbox: photos and posts sent by DM to @miror.cam, Instagram account matching (username and Instagram ID); received through Instagram (Meta).
• Biometric data: face and appearance features derived from photos, and the Miror. Processed only with explicit consent and only to generate photos; not used for identification.
• Purchases: payment is taken by Apple or Google; card details are not passed to us.
• Device and usage: device and app information, installation ID, push token, in-app actions, error reports, IP address. In Türkiye, use before sign-in is recorded with a pseudonymous installation ID.
• Support correspondence and acceptance records.

Ad measurement. We measure the results of our ads with AppsFlyer. Measurement runs only after the 18+ age confirmation and only if permission is given (on iOS, first the in-app permission screen, then App Tracking Transparency; on Android, the in-app permission screen): the advertising ID is collected, and the ad the app was installed from, along with install, sign-up, first-use and purchase events, is reported to Meta, Google or Apple, whichever ran the ad. Without permission, no ad measurement takes place (except Apple’s ID-free SKAN notice on iOS). Permission can be withdrawn at any time (in the app, Settings › Privacy; on iOS, also Settings › Privacy & Security › Tracking).

Data is collected electronically through the app, Apple, Google, RevenueCat and AppsFlyer. Precise location and contacts are not collected; no ads are shown in the app.

3. Purposes and legal bases

• Account, purchases, Miror and photo generation: performance of a contract (KVKK 5/2-c; GDPR 6(1)(b)); for biometric data, explicit consent (KVKK 6/3-a; GDPR 9(2)(a)).
• Accounting records: legal obligation (KVKK 5/2-ç; GDPR 6(1)(c)).
• Support, security, troubleshooting, development and pre-sign-in measurement in Türkiye: legitimate interest (KVKK 5/2-f; GDPR 6(1)(f)).
• Ad measurement and campaign notifications: explicit consent (KVKK 5/1; GDPR 6(1)(a); ePrivacy Directive Art. 5(3)).

Photos and biometric data are not used to train our own AI models; personal data is not sold.

4. Transfers

Photos and biometric data are not shared with third parties; they are processed only by service providers acting on our behalf:

• Higgsfield, OpenAI, Google Cloud (US and other countries): Miror, photo generation and checks
• Supabase, Google Cloud, Sentry (EU): servers, storage, error reports
• RevenueCat, Expo, Apple, Google, Resend (US): purchase records, notifications, email
• AppsFlyer (EU, US), Meta, Google and Apple (US, EU and other countries): ad measurement, only with permission (except Apple’s ID-free SKAN notice on iOS)

Higgsfield’s terms state that it may also use the content it receives to develop its own AI models; photos are sent to Higgsfield only with explicit consent given for this. Data is disclosed to authorities only where the law requires it.

Transfers abroad are made with the safeguards in Article 9 of the KVKK and, under the GDPR, under the EU–US Data Privacy Framework or Standard Contractual Clauses.

5. Retention and deletion

• Photos, biometric data and Miror: until removed, consent is withdrawn or the account is deleted; deleted after 3 years without use.
• Generated photos and other account data: while the account is open.
• Error and server logs: up to 90 days. Pre-sign-in records in Türkiye: 395 days. Ad measurement records: up to 24 months. Content sent by Instagram DM: 30 days.
• Purchase and acceptance records: 10 years, as required by law.

Account deletion: Settings → Account → Delete account, or cam.mirorx.ai/delete-account. The account can be restored within 30 days; after that, the data is deleted. Copies held by service providers are deleted within the periods set in their terms. Subscriptions are cancelled in the App Store or Google Play.

6. Security

Data is protected with encryption and access controls.

7. Age limit

MirorCam is for people aged 13 and over. Miror, photo generation, purchases and ad measurement are available only after the 18+ age confirmation; photos of people under 18 are not processed and are deleted if detected.

8. Your rights

You can exercise your rights under Article 11 of the KVKK and the GDPR (information, access, rectification, erasure, objection, restriction, portability) and withdraw your consents at any time (Settings → Privacy). Requests can be sent to support@mirorx.ai or to the address in section 1 and are answered free of charge within 30 days at the latest. You have the right to lodge a complaint with the Turkish Personal Data Protection Authority or your local data protection authority.

United States: Biometric data is collected only with consent, is not used for anything other than photo generation, is not sold, and is destroyed within the periods in section 5.

9. Changes

Material changes are announced in the app before they take effect; where necessary, acceptance is requested again.