MiroMind

GDPR overview

The privacy policy of 27 February 2026 states that where the Services are offered in the European Economic Area, MiroMind is subject to the GDPR. It cites performance of the contract, legitimate interest and legal obligation as legal bases, and lists rights of access, erasure, rectification, portability, restriction and objection, withdrawal of consent and complaint to a national authority; requests go through the account or legal@MiroMind.ai. A Data Processing Addendum dated 1 May 2026 is published: the customer is controller, MiroMind is processor, and it covers EU and UK GDPR, the CCPA and Singapore's PDPA, incorporates the European Commission's standard contractual clauses, sets breach notification at 48 to 72 hours and provides for deletion or return of data at contract end. Two gaps: no Article 27 EU representative is designated, and no data protection officer is named.

Who owns the data?

Under section IV.4 of the terms, you retain all rights to your Inputs, and MiroMind grants you whatever rights it may hold in the Outputs generated from them. Outputs are not guaranteed to be unique, and your rights do not extend to identical Outputs produced for other users. The API Service Agreement is blunter: as between the parties, the Customer owns all Input and Output. Two caveats matter. Section IV.3 treats any User Content as non-confidential unless a written agreement says otherwise, and any Feedback you send is covered by a worldwide, royalty-free, sublicensable and transferable licence granted to MiroMind.

Reuse rights

Because MiroMind assigns you its rights in the Outputs, you can reuse what the tool produces without asking further permission, within the limits the terms set: no scraping, no automated extraction, no model distillation, no training of competing models, and, under the API Service Agreement, no publication of benchmark results without written consent. On MiroMind's side, the privacy policy of 27 February 2026 describes direct collection (name, email, phone, system identifiers, Inputs and Outputs, feedback, support correspondence) and automatic collection (device, operating system, browser, carrier, approximate location from IP, device and advertising identifiers, timestamps, browsing paths, error logs). These serve delivery of the service, account management, payments, support, security and fraud prevention, legal compliance and research and development. De-identified Inputs and Outputs may be used for model training on a legitimate-interest basis, with a right to object by emailing legal@MiroMind.ai that does not affect access to core features, while content sent through the API is excluded from foundation-model training. Data may be shared with affiliated entities, hosting, audit, research, payment and support providers, authorities, and an acquirer in a merger.

Data retention & training

Hosting summary

MiroMind names no hosting country and no hosting region anywhere on its site. The closest statement is section V.2 of the privacy policy: 'We generally provide the Services from Singapore.' That sentence describes where the service is delivered from, not where data is stored. Section V.1 warns that data may be transferred and processed outside your own jurisdiction, including by an affiliated company abroad, and section V.3 announces appropriate safeguards and legally valid transfer mechanisms; the Data Processing Addendum provides for the European Commission's standard contractual clauses for transfers to third countries. Cookies are administered from the United States according to the table in the privacy policy. On security, MiroMind announces encryption in transit and at rest, an information security programme, anti-malware protection and access controls, while the DPA mentions physical or logical isolation and kill-switch mechanisms meant to prevent unauthorised cross-border access. The domain resolves to 31.43.161.6 in Amsterdam on Amazon's AS16509, but that is an anycast CDN node and proves nothing about where data is held.