Data Processing Agreement

Scope and roles

This agreement is part of the Terms of Service and applies automatically to every workspace. You (the customer) are the controller of the personal data in the conversations you bring into Miross. Miross, that is MIROSS LABS, S.L. (NIF B05706981), Calle Isabel Colbrand 6, Piso 2, 28050 Madrid, Spain, is your processor.

What is processed

• Subject matter and duration: providing the helpdesk service, for as long as your workspace exists.
• Nature and purpose: importing, storing, displaying, searching, translating and sending customer-service messages, and carrying out the actions you request.
• Data subjects: your customers and other people who write to you, including visitors who use the live chat widget on your shop, and your team members.
• Types of data: names, email addresses, phone numbers and handles, postal addresses where they appear in messages, order details (order number, items, prices, status, delivery city and country, tracking), message content and attachments; for live chat visitors, also a browser token and IP address, both stored only as hashes, and the time of their last visit.
• Special categories: Miross is not designed for them; do not use it to collect them.

Our obligations

• We process the data only on your documented instructions, which are these terms and what you do in the product, unless the law requires otherwise; in that case we tell you first where we are allowed to.
• Everyone who can access the data is bound by confidentiality.
• We apply the security measures described below.
• We help you answer requests from data subjects, and with impact assessments and consultations with authorities, as far as our role allows.
• We tell you if we believe an instruction breaks data protection law.

Security measures

• Strict separation between workspaces, enforced on every request and verified by automated tests before each release.
• Encryption in transit (TLS) and encryption of connection credentials at rest (AES-256-GCM). Passwords stored as Argon2id hashes; session tokens stored hashed.
• Two-step verification (TOTP, with one-time recovery codes) for every account; Scale workspaces can require it of all members.
• Role-based access inside a workspace and an append-only audit log.
• Protection against request forgery and against the service being used to reach internal networks.
• Nightly database backups kept for 30 days, a daily server image kept for 7 days, and tested restores.
• Health monitoring of the application, the background worker and every connection.

Subprocessors

You give general authorisation for the subprocessors below. We will announce a new one at least 30 days ahead on this page and by email to workspace admins; you may object on reasonable data protection grounds, and if we cannot resolve it you may end the service. We impose the same data protection obligations on each and remain responsible for them.

This list last changed on 29 September 2026: Microsoft Azure (EU) joins the model providers reached through OpenRouter, for case summaries. The change before, on 28 September 2026, had Resend also carry the email of the bol.com and TikTok Shop channels and emails to live chat visitors.

• Hetzner Online (Germany): servers, database and backups, in Nuremberg. Miross’s own copy of your data is stored here.
• Resend (USA): email for the relay channels (Amazon, bol.com and TikTok Shop), emails to live chat visitors (answers they missed, transcripts) and account email (invitations, password resets, alerts), under the Standard Contractual Clauses and the EU–US Data Privacy Framework. Resend keeps message content, logs and webhook payloads in the USA for up to 30 days.
• Unipile (France, hosted on Scaleway): keeps the connection to the mailboxes and chat accounts you link. WhatsApp and LinkedIn messages and media, voice notes included, are stored at Unipile until the connected account is deleted; for IMAP and Microsoft mailboxes, only metadata; for Gmail, nothing. Unipile’s own subprocessor list includes optional proxy providers in the USA and Singapore. Deleting a connection or the workspace also deletes the account at Unipile.
• OpenRouter, Inc. (New York, USA), processing in the EU: routes AI requests (translation, summaries, drafts, suggestions, Formalize, voice-note transcription, image and document reading, and Mike, the assistant) through its EU endpoint, eu.openrouter.ai, where they are decrypted and processed only inside the EU. It receives only the stripped text of the messages involved (for voice notes and images, the file; for a PDF or Word document, only the text we extract on our own server), and only while AI is on: it is on by default, and one switch per workspace turns it off. For Mike it receives the question, the text of the files attached to the chat and what he looks up in the workspace to answer, and only while Mike is switched on. Transfer mechanism: Standard Contractual Clauses (Module 2) under OpenRouter’s public DPA. OpenRouter’s billing records, account and authentication data, security logs and abuse-monitoring metadata may stay outside the EU; they concern Miross’s account with OpenRouter, not message content.
• Model providers reached through OpenRouter, all operating in the EU: Mistral AI (France), Amazon Web Services (Ireland), Google Cloud (EU) and Microsoft Azure (EU, for case summaries and Mike). They are required to keep zero data (in-memory caching aside) and never train on prompts.
• Stripe (Ireland / USA): subscriptions and invoices. Card details go to Stripe and never reach Miross.

International transfers

Data is stored in Germany, and AI requests are decrypted and processed only inside the EU. Where a subprocessor receives personal data outside the European Economic Area, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework) or on the Standard Contractual Clauses: Resend, which handles email for the relay channels (Amazon, bol.com and TikTok Shop), emails to live chat visitors and account email in the USA, under both; OpenRouter, for the records of Miross’s account, under the Standard Contractual Clauses (Module 2) of its public DPA.

Personal data breaches

If we become aware of a breach affecting your data, we notify the workspace admins without undue delay and in any case within 72 hours, with what we know about its nature, the data and people concerned, the likely consequences and what we are doing about it.

Return and deletion

You can export your workspace at any time. When you delete it, or the agreement ends, we erase its data after a 7-day grace period. Backups containing it roll off within 30 days of that, and within 37 days at worst.

After that we keep only what the law obliges us to keep, plus our security audit log: it records who did what and when, with IP addresses but never message content, and its entries are kept for 25 months, no longer linked to the workspace, then deleted.

Some records go sooner, while the workspace exists: the record of each email relayed through the Amazon, bol.com or TikTok Shop channel (sender, subject and delivery status) is deleted 90 days after it arrives, once processed; a live chat visitor’s record 90 days after their last visit, while their conversations follow the usual case retention; and AI usage counts (tokens, never content) after 25 months.

Audits

On request we provide the information needed to show we comply with this agreement. Where that is not enough, you may carry out an audit once a year, with 30 days’ notice, during working hours, at your cost and without access to other customers’ data. Requests: privacy@miross.io.

Liability and precedence

The liability terms of the Terms of Service apply to this agreement. If this agreement and the Terms conflict on data protection, this agreement prevails.