mirrr.Back to home

Privacy Policy

Last updated: 10 July 2026

This policy explains what mirrr collects, why, how long we keep it, and the choices you have. We have written it in plain language because you should be able to understand what happens to your photos.

mirrr is operated by Mekar Solutions, B-G09 PERDANA VIEW, NO:21 JALAN PJU8/1, DAMANSARA PERDANA, 47820 PETALING JAYA. For any privacy question or request, contact support@mirrr.xyz.

Facial data: the important part

To produce your report, we ask for two selfies. Those photos, and the analysis derived from them, are facial data, which Malaysia's Personal Data Protection Act 2010 (PDPA) treats as sensitive personal data. We ask for your explicit consent before you take them, and you can withdraw that consent at any time.

Specifically:

  • Your photos are stored in a private storage bucket. They are never publicly accessible. When the app displays your own photo to you, it uses a short-lived signed link.
  • To generate your report, your photos are sent to a third-party AI provider that runs the vision model. They process the images to return the analysis and do not use them to train their models.
  • We do not sell your photos or your personal information, and we do not share them for anyone's marketing.
  • We do not use facial recognition to identify you, match you against any database, or determine who you are. The analysis describes appearance; it does not establish identity.

What we collect

If you start the test but never pay

  • Your two selfies and the report generated from them
  • Your quiz answers (goals, habits, self-assessment)
  • A random session identifier stored in your browser
  • Your consent record for facial-data processing

This data is not linked to any account, because no account exists yet. If you do not complete a purchase, we automatically and permanently delete all of it, including the photo files, within 30 days.

If you subscribe

  • Your email address (from your payment method or entered by you)
  • Everything above, now attached to your account
  • Your subscription status and billing period
  • Any later scans, reports, tasks, routines, and chat messages you create in the app

We never see or store your full card number. Payments are processed by Stripe, which handles card data directly under its own security standards.

Who processes your data

  • Supabase — database, authentication, and private file storage
  • Stripe — payment processing and subscription billing
  • Our AI provider — runs the vision and language models that produce your report and coach replies
  • Vercel — hosting

These providers may store data outside Malaysia. By using mirrryou consent to that transfer, which is carried out under each provider's contractual data-protection commitments.

How long we keep it

  • Abandoned test data (no purchase): deleted automatically within 30 days, photos included.
  • Account data: kept while your account exists, so your reports and plan remain available to you.
  • After you delete your account: your photos and reports are deleted. We may retain limited billing records where the law requires it.

Your rights under the PDPA

You can, at any time:

  • Ask what personal data we hold about you, and get a copy
  • Ask us to correct anything inaccurate
  • Withdraw your consent to facial-data processing
  • Ask us to delete your account and your photos
  • Limit how we process your data

Email support@mirrr.xyz and we will respond within 21 days. Withdrawing consent to facial-data processing means we can no longer generate or show your reports, so it effectively ends the service.

Age

mirrr is for people aged 18 and over. We ask your age before any photo is taken and we stop the process for anyone under 18. If you believe a minor has provided us with photos, contact us and we will delete the data immediately.

Security

Photos are stored privately and served only through expiring signed links. Access to production data is limited. No system is perfectly secure, and we do not claim otherwise; if a breach affects your data, we will notify you.

Cookies and analytics

We use browser storage to remember your progress through the test and to keep you signed in. These are necessary for the service to work. If we later add advertising or analytics tracking, we will update this policy and ask for consent where required.

Changes

If we change this policy in a way that materially affects you, we will tell you before the change takes effect. Questions: support@mirrr.xyz.