Data Processing Agreement (DPA)

1. Parties

This Data Processing Agreement ("DPA") is entered into between MIRRORISE ("Data Processor") and the natural or legal person using MIRRORISE services ("Data Controller").

2. Personal Data Processed

MIRRORISE processes the following personal data:

• Identity information (name, surname, email address)
• Digital twin data (answers, writing samples, voice profile)
• Content generation data and approval records
• Usage statistics and log records
• Payment processing information (through 3rd party provider)

3. Purpose of Data Processing

Personal data is processed solely for the following purposes: Digital twin creation, AI-powered content generation, provision of platform services, customer relationship management, and fulfillment of legal obligations.

4. Sub-processors

MIRRORISE uses the following sub-processors in service delivery:

5. Data Security Measures

• TLS/SSL encrypted data transmission
• Bcrypt (factor 12) encrypted passwords
• HMAC-SHA256 webhook verification
• IP-based rate limiting
• Timing-safe comparison for secrets
• Account lockout mechanism (5 failed attempts)

6. Data Subject Rights

Under KVKK Article 11 and GDPR Articles 15-22, data subjects have the following rights: Right of access, right to rectification, right to erasure (right to be forgotten), right to restriction of processing, right to data portability, and right to object. Requests can be submitted from Settings > Account or via partner@mirrorise.com.

7. Data Retention Period

Personal data is retained for the duration of the service. When an account is deleted, personal data is permanently deleted within 6 months at the latest. Data required to be retained due to legal obligations is kept for the periods specified in the relevant legislation.

8. Contact

For all inquiries regarding data processing: partner@mirrorise.com