⚠️ Legal Disclaimer Notice

This Privacy Policy is a starting draft provided for operational clarity for an early-stage SaaS product. It must be formally reviewed and tailored by a qualified Nigerian legal professional before being relied upon for strict legal compliance.

Privacy Policy

Last updated: October 2026

1. Overview & Role as Data Processor

Mira ("we," "our," or "us") operates a multi-tenant AI customer service platform designed for businesses in Nigeria and internationally. Our platform assists subscribing businesses in communicating with their customers via WhatsApp, web chat widgets, and other supported integration channels.

Under the Nigeria Data Protection Act (NDPA) and the Nigeria Data Protection Regulation (NDPR):

  • Subscribing Businesses act as Data Controllers, determining the purposes and means of communicating with their end customers.
  • Mira acts as a Data Processor, processing end-customer data strictly on behalf of and according to the instructions of the subscribing business.

2. Information We Process

Depending on how a business configures Mira, we collect and process the following information:

  • Customer Communications & Messages: The text, inquiries, and chat logs exchanged between end-customers and the AI assistant or business agents.
  • Contact Identifiers: Phone numbers (for WhatsApp messages), email addresses, or anonymous visitor session identifiers (for web chat widgets).
  • Order & Inquiry Data: Details regarding product inquiries, appointment bookings, price checks, or order requests submitted through the chat interface.
  • Feedback & Review Data: Thumbs-up or thumbs-down ratings on AI replies, an optional reason a customer gives for a thumbs-down, and review notes that a business's own staff add about a reply.
  • Business Account Information: Account credentials, business profiles, knowledge base uploads (FAQs, product catalogs, service lists), and billing contact details for subscribing business owners.

3. How Data Is Used

We process data solely to provide and improve our service, including:

  • Generating automated, context-aware AI replies to customer questions.
  • Routing messages to business owners when human intervention or follow-up is requested.
  • Maintaining audit logs, usage analytics, and conversation histories for subscribing businesses.
  • Ensuring platform security, preventing abuse, and troubleshooting technical issues.

We do not sell end-customer data or business knowledge bases to third parties.

4. Data Retention & Storage

Data is stored securely using cloud infrastructure provider Supabase, employing row-level security (RLS) policies to ensure complete multi-tenant data isolation between subscribing businesses.

Separately from conversation history, when a WhatsApp or email message arrives we keep a temporary processing record of it (the message content and the sender's identifier) so it can be handled reliably and so duplicate deliveries are ignored. These processing records are deleted automatically 30 days after the message was received, whether or not the business's account is still active.

We retain conversation history and customer interactions for as long as the subscribing business maintains an active account with Mira. If a business cancels its subscription or requests account deletion, data is retained for a brief grace period (up to 30 days) before permanent deletion from active databases, unless longer retention is required by applicable law.

5. Service Providers & Data Sharing

We use the following categories of third-party providers to run Mira. Each processes data on our behalf, under its own terms, only as needed to provide its part of the service:

  • Database & file storage: Supabase.
  • Application hosting: Vercel.
  • AI language models: Google (Gemini) and Groq. The content of a conversation, together with the business's knowledge base, is sent to these providers so they can generate replies.
  • Messaging: Meta (WhatsApp Business Platform) delivers WhatsApp messages, and Resend sends and receives email.
  • Payments: Paystack processes subscription payments for subscribing businesses.

Some of these providers process data outside Nigeria; for example, our database is hosted in Ireland. We do not sell end-customer data.

6. NDPR Rights & Data Protection Principles

We adhere to key NDPR data protection principles including lawfulness, transparency, purpose limitation, and data minimization. End-customers wishing to access, correct, or request deletion of personal information stored within a business's Mira assistant should direct their requests to the relevant subscribing business (the Data Controller). Mira will assist the business in fulfilling valid data subject requests.

7. Contact Information

If you have questions regarding this Privacy Policy or Mira's data processing practices, please contact us through your business dashboard or by emailing [email protected].