Back to Mira

Privacy Policy

Insight AI Systems Limited (“we”, “us”) operates Mira at chattomira.com. This policy explains what personal data we collect, why we collect it, and how we protect it. It is aligned with the New Zealand Privacy Act 2020 and the EU General Data Protection Regulation (GDPR).

Who we are

Insight AI Systems Limited, NZBN 9429050329304, West Melton, New Zealand. Privacy contact: Alan Booth, alan@chattomira.com.

What we collect

  • Account data — name, email, organisation, role.
  • Billing data — handled by Stripe; we store Stripe customer IDs and invoice metadata, never card numbers.
  • Investigation inputs — the names, companies, and identifiers you ask Mira to research.
  • Investigation outputs — the reports our agents produce.
  • Voice transcripts — text transcripts of your conversations with Mira and your PA, used to deliver the service and for quality review.
  • Operational logs — sign-in events, payment events, integration syncs, error logs.
  • Cookies — see our Cookie Notice.

Why we collect it (lawful bases)

  • To provide the service (contract): account, billing, investigation inputs and outputs, voice transcripts.
  • Legitimate interests: operational logs, fraud prevention, service improvement.
  • Legal obligation: tax records, regulator requests.
  • Consent: any optional communications you opt into.

Who we share it with

We use the following processors. Each is bound by a written data-processing agreement.

  • Supabase — managed database, auth, file storage.
  • Stripe — payment processing.
  • Vapi — voice transport for Mira and your PA.
  • Resend — transactional email delivery.
  • Anthropic, Google, OpenAI — AI models that power our specialist agents. Inputs are processed but not used to train their models.
  • HubSpot — CRM push, only for tenants who connect it.
  • Aikido — automated security scanning of our codebase (does not access customer data).

We do not sell personal data. We do not share it with advertising networks.

International transfers

Some of our processors are based outside New Zealand. Where they are in the EU/EEA we rely on adequacy or Standard Contractual Clauses; where they are in the United States we rely on the EU-US Data Privacy Framework or equivalent safeguards.

How long we keep it

  • Account data — for the life of the account, then 12 months after closure.
  • Investigation inputs and outputs — for the life of the account, plus your retention preference (default 24 months).
  • Voice transcripts — 90 days unless you ask us to delete sooner.
  • Billing records — 7 years (NZ tax law).
  • Operational logs — 12 months.

Your rights

You have the right to:

  • Access the personal data we hold about you.
  • Correct it if it’s wrong.
  • Request deletion (subject to legal retention obligations).
  • Receive a copy in a portable format.
  • Object to processing based on legitimate interests.
  • Withdraw consent for any optional processing.
  • Complain to the NZ Privacy Commissioner (privacy.org.nz) or your local data-protection authority.

To exercise any of these rights, email alan@chattomira.com. We respond within 20 working days.

Security

We protect personal data with Row-Level Security on every table, encryption in transit and at rest, append-only audit logging, and continuous code scanning. See our Security page for the full programme.

Changes to this policy

We may update this policy as we add features. Material changes will be announced by email to account holders at least 14 days before they take effect.

Last updated 1 August 2026.