This Privacy Policy explains how we collect, use and protect your personal data under Türkiye’s Personal Data Protection Law no. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR).

1. Data Controller

Data Controller: MIRRORISE
Email: partner@mirrorise.com
Address: Istanbul, Türkiye

2. Data We Collect

Account data: Name, email address, password (only its hash), language preference. If you sign in with Google or LinkedIn, we receive your name, email address and profile photo from them.
Digital twin data: Your answers to the questions, the writing samples you add, the voice profile derived from them (Voice DNA), your profession and the topics you don’t want to talk about.
Content data: Drafts, your edits, your ratings and feedback, and compliance check results.
Contact data: The name, email, optional phone and company, and message you send through the contact form.
Free post analysis: The text you paste is processed only to run the analysis and is not stored. We keep the analysis result (including the short phrases it quotes), the profession you chose and an irreversible hash of your IP address to prevent abuse. If you ask for the report by email, we also record your email address and, if you agree, your marketing preference.
Usage data: Sign-in records, activity records, IP address.
Payment data: Your plan and subscription status. Card details are processed by our payment provider, Paddle; MIRRORISE does not store card numbers or bank details.

Spoken answers: If you answer by speaking, your browser’s speech recognition turns speech into text. Some browsers, such as Chrome, send the audio to their own servers (e.g. Google) to do this. MIRRORISE does not record or store audio; it only processes the resulting text. If you prefer, type your answers instead.

Other people’s information: Please do not share information that identifies third parties, such as patients or clients, in your answers or drafts.

3. Why We Process Your Data

To create, manage and secure your account
To build your digital twin and write drafts in your voice
To check drafts against professional advertising and promotion rules
To run the free post analysis and, if you ask, email you its report
To answer support requests and send service notices
To monitor security and operation, and fix errors
To meet legal obligations

We do not use your data to train AI models and we do not sell it. Your twin is used only for your own drafts.

4. Legal Basis

Contract: Processing needed to provide the service
Consent: Marketing messages and non-essential cookies
Legitimate interest: Security and improvement of the service
Legal obligation: Tax and accounting records

5. Service Providers We Share Data With

Your data is shared only with the providers below, and only as far as needed to run the service:

AI: Anthropic (Claude API) — processes your text to build your twin, write drafts and run compliance checks. Content sent through the API is not used to train models.
Payments: Paddle (Merchant of Record) — handles payment, invoicing and tax collection under its own privacy policy (paddle.com/legal/privacy).
Hosting and database: Render (Frankfurt, Germany)
Email: Resend (account and notification emails)
Sign-in: Google and LinkedIn (if you choose to sign in with them)
Images: Cloudinary (images you upload) and Unsplash (image search terms)
Legal requirements: A court order or a request from a competent authority

6. Retention

Account, twin and content data: while your account is open. When you delete your account in settings, your twin, drafts, notes and contact details are permanently deleted at that moment; what remains are usage records without personal content and the invoice records below. For clients whose posts our team writes (Executive), the portal account is closed and the data on record is deleted on request, within 30 days at the latest
Contact form data: 1 year
Free post analysis results and the email address given for the report: 30 days. If you agreed to marketing emails, your email address is kept until you withdraw that consent
Activity and sign-in records: 1 year
Invoices and payment records: the legal retention period (10 years)

7. Security

Passwords are stored as bcrypt hashes
Data in transit is encrypted with HTTPS
Session data is kept in cookies only the server can read (httpOnly)
Sign-in attempts are rate limited and accounts lock temporarily after repeated failures
Card details never reach MIRRORISE servers; Paddle processes them

8. Your Rights (KVKK art. 11 / GDPR art. 15–22)

To learn which of your data is processed and get a copy
To have inaccurate or incomplete data corrected
To have your data deleted
To receive your data in a machine-readable format
To object to processing and ask for it to be restricted

You can use these rights through “Download My Data” and “Delete My Account” in account settings, or by writing to partner@mirrorise.com.

9. Cookies

Essential cookies: Session management (mirrorise_session, mirrorise_role)
Preference cookies: Language (NEXT_LOCALE)

We currently use no analytics or advertising cookies, so we do not ask for cookie consent. If we start using them, we will ask for your consent first.

Visit counting: We count how often our public pages are opened and which site a visitor came from, without cookies. Nothing is stored in your browser and your IP address is not kept. To tell repeat visits apart within one day, a value is derived from the IP address and browser details using a key that exists for that day only; the key is deleted the next day, so the value cannot be matched to anyone and you cannot be followed from one day to the next.

Error records: When a page or an operation fails, we record which page it happened on and the short technical error text, so that we can find and fix the problem. The record does not contain your name, your account or anything you wrote; an e-mail address inside an error text is masked. Records are deleted after 30 days.

10. International Transfers

Your data is hosted on servers in Frankfurt, Germany. Our AI provider, Anthropic, is based in the United States and our payment provider, Paddle, in the United Kingdom; transfers to them are made under data processing agreements and appropriate safeguards.

11. Changes

We update this policy when needed. We announce important changes by email.

12. Contact and Complaints

For questions and requests about your personal data: partner@mirrorise.com

For complaints under KVKK you may apply to the Personal Data Protection Authority (kvkk.gov.tr).