Privacy Policy

Who we are

Miross is a helpdesk for marketplace sellers, available at miross.io and app.miross.io and run by MIROSS LABS, S.L. (NIF B05706981), Calle Isabel Colbrand 6, Piso 2, 28050 Madrid, Spain. For anything about privacy, write to privacy@miross.io.

There are two kinds of personal data in Miross, and we play a different role for each. For your account and our website, Miross decides how the data is used (we are the controller). For the conversations you handle in Miross, you decide and we only process them on your instructions (you are the controller, we are the processor). The Data Processing Agreement covers that second case.

Data we collect about you

• Account: your name, email address and a password, which we store only as an Argon2id hash. If you turn on two-step verification, also its secret key, stored encrypted, and your recovery codes, stored only as hashes.
• Workspace: its name, members, roles, settings, rules and templates.
• Security records: sign-ins, sessions with IP address and browser, and an audit log of sends, actions and setting changes.
• Billing: your plan and subscription status. Payment details are held by Stripe, not by us.
• Waitlist: the email address you give us and, if you add it, what you sell and where. We use it once, to invite you.
• Usage of AI features: counts of tokens per workspace, for metering. Not the content.

Data you bring into Miross

When you connect a marketplace, mailbox or chat account, Miross imports the conversations from it: messages, attachments and the names and contact details of your customers. For the order panel, it also holds the order a conversation is about: order number, items, prices, status, delivery city and country, and tracking. Credentials for those accounts are encrypted with AES-256-GCM before they are stored and are never shown again.

The live chat widget you can add to your shop is a channel too: you are the controller of what visitors send, and Miross is your processor. For each visitor, Miross stores the name and email they give, a token for their browser and their IP address, both only as hashes (the IP address is used only for rate limits), the messages and files they send, and the time of their last visit. Emails to visitors, such as an answer they missed or a transcript they asked for, go through Resend, sent as “<your shop> via Miross” with your support address as reply-to.

This data belongs to you. We use it to show you your inbox and to carry out what you ask (send a reply, translate, run a rule). We do not sell it, mine it for advertising, or use it to train AI models.

Why we process it, and the legal basis

• To provide the service you signed up for: performance of our contract with you.
• To keep accounts safe, prevent abuse and keep an audit trail: our legitimate interest in a secure service.
• To invoice you and keep accounting records: legal obligation.
• To email you when the waitlist opens: your consent, which you can withdraw at any time.

AI features

AI is on by default for every workspace. Translation, summaries, drafts, suggested actions, Formalize, voice-note transcription and image and document reading send a language model what they need: the stripped text of the messages involved (quoted history removed), the voice note or image itself, and for a PDF or Word document only the text we extract on our own server. Requests go through OpenRouter’s EU endpoint and are decrypted and processed only inside the EU, by model providers operating there; those providers are required to keep no data (zero data retention, in-memory caching aside), and prompts are never used for training. Each workspace has a single switch that turns all of this off; with it off, no message content leaves our servers for AI processing and agents still see the originals.

Mike, the assistant your team talks to inside Miross, has a switch of his own: a workspace that existed before he was released has him off until an admin turns him on, a workspace created since has him from its first day, and an admin can turn him off for the workspace or for one person. When someone asks him something, a language model receives the question, the text of the files attached to the chat (an image is sent as it is) and what he looks up in the workspace to answer: cases and their messages, orders, returns, products, prices and sales figures. Unless an admin turns on “Customer details” in his settings, nothing he looks up names a customer: no name, email, phone or street, only the order number, postcode, city, country and what was bought. A customer’s own messages reach him without the email addresses and the phone numbers with a country code written in them, and without the name and phone on that customer’s record; a customer may still say who they are in their own words. His requests take the same route as the features above: OpenRouter’s EU endpoint, model providers operating in the EU, zero data retention and no training.

AI never replies on its own: nothing an AI feature writes is sent to your customer until a person in your team has reviewed it and pressed send. Rules you set up send only the text you wrote for them.

Mike does not reply to your customers. What he changes in your workspace he either prepares for a person to confirm or does at once, as his settings say for each kind of action, and what he does by himself is listed in his activity. An email from his own address leaves when a person confirms it; only one to your team or to an address an admin has listed, or a carrier claim to the address an admin has set for claims, can go without that.

Who else handles the data

We use a small number of providers, each bound by a data processing agreement:

• Hetzner Online (Germany): servers, database and backups, in Nuremberg. Miross’s own copy of your data is stored here.
• Resend (USA): email for the relay channels (Amazon, bol.com and TikTok Shop), emails to live chat visitors (answers they missed, transcripts) and account email (invitations, password resets, alerts), under the Standard Contractual Clauses and the EU–US Data Privacy Framework. Resend keeps message content, logs and webhook payloads in the USA for up to 30 days.
• Unipile (France, hosted on Scaleway): keeps the connection to the mailboxes and chat accounts you link. WhatsApp and LinkedIn messages and media, voice notes included, are stored at Unipile until the connected account is deleted; for IMAP and Microsoft mailboxes, only metadata; for Gmail, nothing. Unipile’s own subprocessor list includes optional proxy providers in the USA and Singapore. Deleting a connection or the workspace also deletes the account at Unipile.
• OpenRouter, Inc. (New York, USA), processing in the EU: routes AI requests (translation, summaries, drafts, suggestions, Formalize, voice-note transcription, image and document reading, and Mike, the assistant) through its EU endpoint, eu.openrouter.ai, where they are decrypted and processed only inside the EU. It receives only the stripped text of the messages involved (for voice notes and images, the file; for a PDF or Word document, only the text we extract on our own server), and only while AI is on: it is on by default, and one switch per workspace turns it off. For Mike it receives the question, the text of the files attached to the chat and what he looks up in the workspace to answer, and only while Mike is switched on. Transfer mechanism: Standard Contractual Clauses (Module 2) under OpenRouter’s public DPA. OpenRouter’s billing records, account and authentication data, security logs and abuse-monitoring metadata may stay outside the EU; they concern Miross’s account with OpenRouter, not message content.
• Model providers reached through OpenRouter, all operating in the EU: Mistral AI (France), Amazon Web Services (Ireland), Google Cloud (EU) and Microsoft Azure (EU, for case summaries and Mike). They are required to keep zero data (in-memory caching aside) and never train on prompts.
• Stripe (Ireland / USA): subscriptions and invoices. Card details go to Stripe and never reach Miross.

Marketplaces such as Amazon or Leroy Merlin are not our providers: they are accounts you already hold, and Miross talks to them on your behalf. The same goes for the stores and tools you connect, such as Shopify, WooCommerce, Sendcloud or Holded.

Where data is stored and transfers outside the EU

The database, attachments and backups are in Germany, and AI requests are decrypted and processed only inside the EU. Some providers above are based in the United States or keep some data there: Resend, for email of the relay channels (Amazon, bol.com and TikTok Shop), emails to live chat visitors and account email; Stripe, for billing; OpenRouter, for the records of Miross’s account (not message content); and Unipile’s optional proxy providers are in the USA and Singapore. Where personal data reaches them, the transfer relies on the European Commission’s Standard Contractual Clauses and, for providers certified under it, the EU–US Data Privacy Framework: Resend under both, OpenRouter under the Standard Contractual Clauses (Module 2) of its public DPA.

How long we keep it

• Workspace data: for as long as the workspace exists. When an admin deletes a workspace, access stops at once and everything in it is permanently erased after a 7-day grace period.
• Relay mail records: for each email that reaches you through a relay channel (Amazon, bol.com or TikTok Shop) we keep a record of its sender, subject and delivery status, deleted 90 days after the email arrives, once it has been processed. A buyer’s message stays in its conversation; mail from the marketplace itself, such as an address confirmation, never becomes a conversation, and its text is fetched from Resend only when an admin opens it from the channel’s settings.
• Live chat visitors: a visitor’s record (name, email, hashed browser token and IP address, last visit) is deleted 90 days after their last visit; their conversations are kept like any other case.
• Backups: nightly backups of the database and stored files roll off after 30 days. Our hosting provider also keeps a daily image of the whole server for 7 days, also in Germany, so in the worst case erased data can remain in backups for up to 37 days.
• Your account: until you delete it, which you can do yourself in the app. Your two-step verification secret and recovery codes are deleted as soon as you turn it off or delete the account.
• Security records: a session ends after 7 days without use, after 30 days at most, or when you sign out. The history of sign-ins (with IP address and browser) and the audit log are kept for 25 months, then deleted. Deleting your account deletes its sign-in history at once; audit log entries outlive a deleted account or workspace, no longer linked to it, until their 25 months are up.
• AI usage counts: 25 months, or until the workspace is deleted, if that comes first.
• Mike: a chat with its messages, cards, files and emails is deleted 12 months after its last message, or sooner if the workspace erases resolved conversations sooner; a chat whose planned task is still switched on is kept. What he looked up to answer is kept until his next answer in that chat, 24 hours at most. The text of an email he sent is kept for 180 days. Planned tasks and what he was asked to remember stay until someone deletes them.
• Invoices and accounting records: as long as tax law requires.
• Waitlist entries: kept until we remove them by hand; nothing deletes them automatically. You can ask us to remove yours at any time by writing to privacy@miross.io.

Cookies

The app sets one cookie: your session. It is strictly necessary, HttpOnly and never used for tracking. This website sets no cookies at all: visits are counted with Umami, an open-source analytics tool we host ourselves on our server in Germany. It stores the page visited, the referrer, the browser and country, and nothing that identifies you, no IP address, no cookie, no fingerprint, and it honours your browser’s Do-Not-Track setting. That is why there is no cookie banner. The live chat widget on a seller’s shop sets no cookies and uses no trackers either: it keeps only a visitor token in the browser’s local storage.

Your rights

You can ask us for access to your data, to correct it, delete it, restrict or object to its use, or to receive it in a portable format. Workspace admins can export or delete a whole workspace themselves from the settings. Write to privacy@miross.io and we will answer within one month. If you think we have handled your data wrongly you can complain to your data protection authority; in Spain that is the AEPD (aepd.es).

If you are a customer of a seller who uses Miross, or have chatted with a shop through its Miross widget, the seller is responsible for your data. Contact them first; we will help them respond.

Security

Every record belongs to one workspace and every request is checked against membership; automated tests fail our release if one workspace can see another’s data. Connections are encrypted in transit, credentials at rest. The Security page has the detail.

Changes

If we change this policy in a way that matters, we will tell account holders by email before it takes effect. The date at the top always shows the current version.