Privacy Policy

mirapps.com is operated by Mirapps, a business based in Israel, acting through Shahaf Miryamchick ("Mirapps", "we", "us"). Mirapps is the controller of the database where enquiries are kept (our CRM database), meaning we decide why and how the information in it is used.

For any privacy question, or to use your rights, contact us at info@mirapps.com or by phone at +972 52-728-2769.

This policy covers mirapps.com, including its Hebrew pages (such as mirapps.com/landing), Mira, the AI assistant on the site, and messages sent to our Instagram account (@mirapps_ai). Services we provide to clients are covered by a separate written agreement.

We collect what you choose to send us through the channels below, and some technical data automatically. With every enquiry we also record which form or channel it came from.

Why we use it

• to answer and handle your enquiry, to contact you about it by phone or WhatsApp, and to call you back when you ask;
• to hold the conversation or call you asked for, and to follow up on it;
• to provide services you decide to engage us for, under a separate written agreement;
• to run, secure and improve the site, and to fix problems.

We don't use your details to send you marketing messages (section 5).

Mira, the chat and voice assistant on the site, is an artificial-intelligence system, not a person. It runs on models provided by OpenAI.

• OpenAI states that it does not use data sent through its API to train its models unless the customer opts in, and that it may keep it for up to 30 days to monitor for abuse. We don't save chat conversations, apart from the short context you approve with your contact details (section 2).
• Please don't share sensitive information with Mira, such as health or financial details, ID numbers or passwords, or other people's personal information.
• Mira's answers are generated automatically and may be wrong or incomplete. They are not quotes, offers or commitments; see section 5 of our Terms of Use.
• Your contact details reach our team only after you approve them on screen.
• We don't make decisions about you that have legal or similarly significant effects based only on automated processing. Mira answers questions; a person at Mirapps handles any follow-up.

You are under no legal obligation to give us personal information; it depends entirely on your free choice and consent. The only consequence of not giving us your details is that we won't be able to reply to you or call you back. (Basic technical data, such as your IP address, is needed for any website to work.)

We don't send marketing messages. If that ever changes, we will ask for your separate, explicit consent first and update this policy.

We don't use cookies. The site saves two small items in your browser's local storage:

• mirapps:cookie-ok, which remembers that you dismissed the notice about this;
• mirapps:a11y, which remembers the settings you choose in the accessibility tool. It is saved only when you change a setting.

Neither contains personal details. You can delete them at any time in your browser's settings.

Visit statistics. We count visits with Vercel Web Analytics, which doesn't use cookies. For each page view it records the page address (including any campaign tags in the link, such as utm_ parameters), the site you came from, your browser, device type, operating system and country. To tell visitors apart it uses a hash of the request details that is calculated afresh each day, and Vercel deletes session data after 24 hours. We see only aggregated statistics, which show us which pages are useful. Vercel's statistics script also checks your browser's local storage for an identifier that it uses only when a site turns on its visitor-identification features. We haven't turned them on, so nothing is saved there.

Fonts. The site's fonts are served from our own hosting together with the rest of the site, not from a third-party font service.

The site has no advertising or social-media tracking pixels. Before we add any other measurement or advertising tool, we will update this policy and ask for your consent where the law requires it.

These service providers receive personal information so that we can run the site and handle enquiries:

• Vercel Inc.

  Role

  Hosts the site and runs the server functions behind the forms, the chat and the voice set-up; visit statistics; server logs.

  What it receives

  Every request (your IP address and browser data); form and chat content passing through; page-view statistics; enquiry details in error logs.

  Where

  USA (Washington, D.C.) for the server functions; site files are served from Vercel's global network.

• Supabase

  Role

  Our CRM database, where enquiries are stored, together with the contact records, notes and follow-up tasks for Instagram enquiries.

  What it receives

  Your enquiry details, including a copy of what you submitted; for Instagram enquiries, the details listed in section 2.

  Where

  India (Mumbai).

• Make (Celonis)

  Role

  Workflow automation: emails our team about each new enquiry, and brings Instagram enquiries from our bot into our CRM.

  What it receives

  Your enquiry details; for Instagram enquiries, the details our bot collected (section 2).

  Where

  Make, in its EU data zone (eu2).

• Google (Gmail, Google Workspace)

  Role

  Our business email, Gmail on Google Workspace: the mailbox where our team receives enquiry notifications and your emails.

  What it receives

  Your enquiry details; emails you send us.

  Where

  Google's data centres, which may be outside Israel, including in the USA.

• OpenAI (OpenAI OpCo, LLC)

  Role

  Generates Mira's replies in the chat and in voice chat.

  What it receives

  Chat: your messages, sent through our server. Voice: your voice and your IP address, sent directly from your browser.

  Where

  USA.

• ManyChat

  Role

  Runs the bot that receives and answers messages sent to our Instagram account, and passes Instagram enquiries to Make.

  What it receives

  Your Instagram messages, your Instagram name and username, and the answers and phone number you give the bot.

  Where

  Outside Israel.

• WhatsApp Business (Meta)

  Role

  The WhatsApp Business app, which we use to message you on WhatsApp, for example when we follow up an Instagram enquiry or a call-back request.

  What it receives

  Your phone number and our conversation.

  Where

  Outside Israel.

• Anthropic (Claude)

  Role

  An AI assistant our team uses to work with the records in our CRM, for example to look up a contact or plan a follow-up.

  What it receives

  The contact and enquiry records in our CRM that our team works on with it.

  Where

  USA.

Instagram is run by Meta, which processes the messages you send on Instagram under its own privacy policy.

Beyond these providers, we disclose personal information only when the law or a competent authority requires it, or with your consent.

Mirapps is based in Israel. Our providers store or process personal information in these places:

• USA: Vercel (server functions, logs and statistics), OpenAI (Mira) and Anthropic (the AI assistant our team uses with our CRM);
• Google (Gmail, Google Workspace): Google's data centres, which may be outside Israel, including in the USA;
• India: Supabase (our CRM database, hosted in Mumbai);
• Make: our workflow automations run in Make's EU data zone (eu2);
• Other locations outside Israel: Vercel serves the site's files from its global network, ManyChat runs our Instagram bot, and WhatsApp Business (Meta) carries the messages we exchange with you on WhatsApp.

Under Israel's Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001:

• for details you send us through the call-back form or the intro-call form on our Hebrew page, or approve on Mira's approval card, we rely on the consent you give there after reading the notice shown with it, which names the countries and links to this policy;
• for what you type to Mira or say in voice chat, which goes to OpenAI in the USA so Mira can reply, we rely on your consent: the chat window says this before you send your first message, and the voice-chat notice says it before you press "Start voice chat";
• for technical information that reaches our providers automatically (for example your IP address when a page loads, or when your browser connects to OpenAI for voice chat), for Instagram enquiries, for emails you send us and for messages we exchange with you on WhatsApp, we rely on the terms on which each provider processes the information for us.

For visitors in the EEA or the UK: the European Commission recognises Israel as providing an adequate level of protection (Decision 2011/61/EU, confirmed in the Commission's review of 15 January 2024), and the UK recognises Israel as adequate too. For US providers certified under the EU-U.S. Data Privacy Framework (and, for the UK, its UK Extension), transfers rely on the Commission's adequacy decision for that Framework of 10 July 2023. For providers in India, and US providers that are not certified under the Framework, transfers rely on the European Commission's Standard Contractual Clauses (or, for the UK, the UK Addendum) in the provider's data-processing terms. You can ask us for a copy of the relevant safeguards at info@mirapps.com.

We keep enquiry details (what you send us through our forms, what you approve on Mira's approval cards in the chat and in voice chat, and Instagram enquiries) for up to 24 months from our last contact with you, and then delete them, unless we have an ongoing business relationship with you or the law requires us to keep them longer. You can ask us to delete them sooner (section 11).

Copies may also exist in these places, for these periods:

• the notification emails, in our mailbox until we delete them;
• for Instagram enquiries, the contact record, notes and follow-up task in our CRM (kept for the same period as other enquiry details), and the conversation itself in Instagram and in ManyChat;
• the run history of our automations at Make, for the period our Make plan sets;
• server and error logs at Vercel, for at most 30 days (Vercel keeps them for between 1 hour and 30 days, depending on the plan);
• database backups at Supabase, for up to 30 days;
• OpenAI's abuse-monitoring logs, for up to 30 days.

• The site is served over HTTPS, so information you send is encrypted on its way to us.
• Enquiries are stored in an access-controlled database that the public can't read.
• If a security incident affects your information, we will handle it as the law requires, including any notification it requires.

No system connected to the internet can be guaranteed to be completely secure.

Under Israel's Protection of Privacy Law you can:

• see the information we hold about you (the right of access, section 13 of the law);
• ask us to correct or delete information that is incorrect, incomplete, unclear or outdated (section 14).

You can also ask us to delete your enquiry details at any time. Unless the law requires us to keep them, we will delete them from our CRM and our mailbox. Copies in our automation history, in backups and in our providers' logs (section 9) are deleted when those expire, and messages you sent on Instagram stay in Instagram under Meta's rules.

How: email info@mirapps.com or call +972 52-728-2769. We may ask you to confirm your identity before we act on a request.

When: we reply within 30 days. If we refuse a request under section 13 or 14 of the law (to see information, or to correct or delete information that is incorrect, incomplete, unclear or outdated), we will tell you why within that time, and you may appeal to the Magistrate's Court within 30 days.

Complaints: you can complain to Israel's Privacy Protection Authority. We'd be glad if you contacted us first so we can try to resolve the matter, but you don't have to before you complain.

The EU General Data Protection Regulation (GDPR) or the UK GDPR may apply to how we process your personal information. This section adds the information those laws require. Who we are and how to contact us is in section 1.

Legal bases:

• handling your enquiry or call-back request, and contact details you approve in the chat or voice chat: steps you asked us to take before a possible contract (Art. 6(1)(b) GDPR);
• providing services under an agreement with you: performance of that contract (Art. 6(1)(b));
• Mira's chat and voice replies, following up with businesses that contacted us, security, server logs and statistics: our legitimate interests in answering enquiries, running and securing the site and understanding how it is used (Art. 6(1)(f));
• keeping records the law requires us to keep: legal obligation (Art. 6(1)(c)).

Your right to object: you can object at any time, on grounds relating to your situation, to processing based on our legitimate interests.

Your other rights: access, rectification, erasure, restriction of processing and data portability. Where we rely on your consent, you can withdraw it at any time; this does not affect processing before the withdrawal. To use any of these rights, contact us as in section 11.

Complaints: you can complain to us first at info@mirapps.com, or to the data protection authority in the EEA country where you live or work, or where you believe the infringement took place (list of authorities), or in the UK to the Information Commissioner's Office (ICO).

Transfers outside the EEA and their safeguards are in section 8, retention in section 9 and automated decision-making in section 3.

The site is intended for businesses and professionals and is not directed at children.

When we update this policy, we post the new version here with a new "Last updated" date. Significant changes are highlighted at the top of this page.

Mirapps: info@mirapps.com, +972 52-728-2769.

See also our Terms of Use and Accessibility Statement. This policy is also available in Hebrew.