Privacy Policy
Effective: 13 August 2026
Last updated: 17 October 2026
Applies to: the Mira app and mirafaceapp.com
Controller: CPLEX Management AG
Mira analyses facial measurements and photographs of your face. That is sensitive information, and this policy explains exactly what happens to it — what we collect, who processes it, where it is stored, how long it is kept, and how to have it erased.
1. Who we are
Mira ("Mira", "we", "us") is operated by CPLEX Management AG, a company registered in Baar, Canton of Zug, Switzerland. We are the data controller for the personal data described in this policy.
Contact: hello@miraanalysis.com
This policy covers the Mira iOS application and the website at mirafaceapp.com. It is written to meet the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR).
2. Age requirement
Mira is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you believe someone under 16 has created an account or uploaded photographs, email us and we will delete the account and its contents without delay.
3. What we collect
| Category | What it is | Where it comes from |
|---|---|---|
| Account | Email address, display name, password credential or Apple sign-in identifier | You, at sign-up |
| Face data | Derived facial measurements, skin readings and scores, plus five photos per full-report scan. Daily scans save no photos. See §4 | You, during a TrueDepth camera scan using ARKit |
| Questionnaire | Your answers about goals, routine, sleep, skin and grooming | You, during onboarding |
| Analysis output | Your reports, scores, detected traits, daily plans and daily scan history | Generated from your submissions |
| Subscription | Subscription status, plan, renewal and cancellation events | Apple, via RevenueCat. We never receive your card details |
| Device and usage | Device model, OS version, app version, language, screens viewed, actions taken, crash diagnostics | Automatically, in the app |
| Advertising identifiers | Apple's identifier for advertisers and related attribution signals — only if you allow tracking | Your device, after the tracking prompt |
| Notifications | Push token for your device | Apple Push Notification service |
| Support | Anything you write to us by email | You |
4. Face Data (TrueDepth camera and ARKit)
4.1 What we collect
When you scan your face, Mira uses Apple's TrueDepth camera through the ARKit framework. On your iPhone, Mira reads the 3D geometry of your face (the ARKit face mesh), the position of your head, facial expression values (ARKit blend shapes), the camera image and the light level. Mira does not read depth maps. On your device, this is turned into facial measurements (for example facial symmetry, eye spacing, jaw-to-cheek ratio, facial thirds and lip ratio), skin readings (for example redness, evenness, texture and under-eye) and feature scores. When you request a full report, Mira also saves five still photos of your face taken during the scan (front, left and right). Daily scans do not save any photos. We do not use face data to identify you, to authenticate you, or to recognise you across apps or devices.
4.2 How we use it
Face data is used only to provide Mira's features to you: to guide the scan, to show your face as a 3D model in the app, to calculate your measurements and scores, to write your personal report and daily plan, and to show your progress over time. The raw face data (face mesh, head position, blend shapes) and your 3D face model stay on your iPhone. They are never uploaded to our servers, and they are excluded from device backups. The live 3D face on the Today screen is drawn on your device in real time and is not saved.
4.3 What we store and where
We store only your derived measurements, skin readings and scores, plus the photos from full-report scans, in your private Mira account. This data is stored with our hosting provider Supabase in the European Union (Ireland), is encrypted in transit and at rest, and is accessible only to your account. Nothing is uploaded before you subscribe and agree to AI processing.
4.4 Sharing
When you request a full report, and only after you agree on the in-app consent screen, we send your measurements, your questionnaire answers and two of your scan photos over an encrypted connection directly to our AI provider, Anthropic (Claude), which writes your report. Anthropic processes this data only to generate your report and does not use it to train its models. We do not share face data with anyone else. We never sell face data, never use it for advertising or marketing, and never send face data, measurements or photos to our analytics, crash-reporting or advertising partners.
4.5 Retention and deletion
We keep your measurements, scores and full-report photos for as long as your account exists, so you can track your progress. The raw face data and 3D model on your iPhone remain there until you delete the app. You can delete your account at any time in the app (You → Delete account). This immediately and permanently deletes your measurements, scores, scan photos, reports and account from our servers.
5. Other third-party processors
We share personal data only with service providers who process it on our behalf under written agreements. We do not sell personal data.
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | Database, file storage, authentication | Account data, derived measurements, skin readings, scores, full-report photos, questionnaire, reports |
| Anthropic (Claude) | Report generation (see §4.4) | Facial measurements, questionnaire answers and two scan photos — only after consent |
| Apple | Distribution, sign-in, payments, push delivery | Purchase and subscription data, push tokens |
| RevenueCat | Subscription management | Account identifier, subscription status |
| PostHog | Product analytics | Account identifier, app events, device data — no face data |
| Sentry | Crash and error monitoring | Diagnostic data — no face data, measurements or photos |
| Brevo | Account and service email | Email address |
| Meta, TikTok | Advertising measurement | Advertising identifier and install or purchase signals — only with your consent |
We may also disclose data where legally required, to enforce our terms, or to protect the rights and safety of our users. If our business is transferred, personal data may transfer with it, and this policy continues to apply until you are told otherwise.
Older app versions (1.x) also used Google (Gemini) to create illustrative renders; this is no longer part of Mira 2.0.
6. Why we are allowed to use your data
| Purpose | Legal basis (GDPR) |
|---|---|
| Processing your facial measurements and scan photos | Your explicit consent — Art. 9(2)(a), given on the consent screen described in §4.4 |
| Creating and running your account, delivering reports and scans you have paid for | Performance of a contract — Art. 6(1)(b) |
| Push notifications about your report | Contract — Art. 6(1)(b), plus your device permission |
| Product analytics, crash reporting, fraud prevention and security | Legitimate interests — Art. 6(1)(f) |
| Advertising measurement and attribution | Your consent — Art. 6(1)(a), via Apple's tracking prompt |
| Accounting, tax and legal claims | Legal obligation — Art. 6(1)(c) |
7. Analytics and advertising
We use product analytics to see where the app confuses people — which screens are reached, which steps are abandoned. This is tied to a random account identifier, never to your email address, and never to your face data.
If you allow tracking when iOS asks, we and our advertising partners may measure whether an advert led to an install or a subscription. If you decline, no advertising identifier is collected and no advertising SDK is initialised. Change this any time in iOS Settings → Privacy & Security → Tracking.
We do not use your facial measurements, photographs, reports or scores for any advertising purpose, whether or not you allow tracking.
8. International transfers
We are based in Switzerland. Some providers are in the United States or other countries outside Switzerland and the European Economic Area. Where data is transferred, we rely on appropriate safeguards — the European Commission's Standard Contractual Clauses, the Swiss adequacy framework, or equivalent contractual protections. You can request a copy of the safeguards that apply.
9. Retention of other data
Face data retention is covered in §4.5. For everything else:
| Data | Retention |
|---|---|
| Account and questionnaire | While your account exists; immediately deleted on account deletion |
| Analytics and crash data | Up to 12 months, then deleted or aggregated beyond identification |
| Billing and tax records | As required by Swiss law, normally 10 years. These contain no photographs |
| Encrypted backups of other data | Purged on a rolling schedule, within 30 days of deletion. Face data, measurements, scores, scan photos and reports are excluded; their deletion is immediate as described in §4.5. |
10. Security
- Data is encrypted in transit and at rest.
- Storage is private per user; files are served only through short-lived signed links.
- Database access is enforced row by row, so an account can only reach its own records.
- Server credentials are held in a secrets manager and are never present in the app on your phone.
- Diagnostic logs exclude face data, measurements and photos, and are scrubbed of email addresses, photograph paths and report contents.
No system is perfectly secure. If a breach affects your personal data we will notify you and the competent authorities as required by law.
11. Your rights
Under the GDPR and the FADP you may:
- Access the personal data we hold about you
- Correct data that is inaccurate or incomplete
- Delete your data — immediately in the app (You → Delete account), or by asking us
- Restrict or object to certain processing
- Withdraw consent at any time, including consent to face-data processing and to tracking
- Receive a copy of your data in a portable, machine-readable format
- Not be subject to a decision based solely on automated processing producing legal or similarly significant effects
Email hello@miraanalysis.com to exercise any of these. We respond within 30 days, and may ask you to confirm control of your account email first.
Complaints. Tell us first and we will try to put it right. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), or, in the EEA or UK, to your local supervisory authority.
12. What Mira is not
Not medical advice. Mira is a cosmetic and appearance analysis tool. It is not a medical device, it does not diagnose or treat any condition, and nothing in a report substitutes for a doctor, dermatologist or other qualified professional.
Scores are relative to you. A harmony score expresses progress toward your own realistic potential. It is not a universal rating, a ranking against other people, or a measure of your worth.
13. Changes to this policy
We update this policy when the app changes. The effective date at the top always shows the current version. If a change materially affects how we handle your face data, we will tell you in the app or by email before it takes effect, and where the law requires it we will ask for your consent again.
14. Contact
CPLEX Management AG
Baar, Canton of Zug, Switzerland
hello@miraanalysis.com
Questions about this policy, requests about your data, and reports of a suspected minor account all go to the same address, and a person reads them.