Miro

GDPR overview

Compliance is documented rather than merely claimed. A GDPR badge in the footer links to Miro's trust portal, a Customer Data Processing Addendum is published online and the subprocessor list is available as a public document. The declared controller is RealtimeBoard, Inc. dba Miro, ATTN: Privacy Team, in San Francisco; the Article 27 representative in the EU is RealtimeBoard BV in Amsterdam. Transfers outside the EEA rely on the European Commission's standard contractual clauses under Article 46(2)(c) and on certification to the EU-US Data Privacy Framework, its UK extension and the Swiss-US DPF. The privacy policy lists rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent, and commits to cooperating with the competent supervisory authority, the UK ICO and the Swiss FDPIC, with binding arbitration as a last resort and FTC investigatory authority acknowledged. Privacy requests go to privacy@miro.com or through the Help Center form. Minimum age: 16.

Who owns the data?

The Terms of Service state that, between the parties, the customer retains all intellectual property and other rights in Customer Content and Customer Materials provided to Miro. The AI Terms extend this to generative features: you retain your ownership rights in Input and you own the Output, with Miro assigning any rights it may hold in that Output. Two reservations apply. Outputs are not exclusive, and Miro warns they may be similar or identical to those provided to other customers. Where a third party powers an AI feature, Miro only undertakes to inform you of any restriction on Output ownership. Deleted content may also survive in routine backups, under the same confidentiality obligations.

Reuse rights

What you create in Miro stays yours to reuse without asking permission: since Input and Output remain the customer's, boards, diagrams, documents and AI-generated content can be exported, published or fed into your own processes freely. The limits are contractual rather than technical, the AI Terms prohibiting the use of Outputs to train competing AI models or to drive automated decisions without human review. In the other direction, Miro states twice on its own pages that your data is not used to train Miro AI models. The AI Terms of 17 July 2024 are more nuanced: under an enterprise Master Cloud Agreement, Miro seeks prior consent, withdrawable at any time, before using Input and Output to improve its AI features, including training and fine-tuning; on free, starter and business plans it undertakes instead to provide "reasonable means to object to such use". Where consent is given or no objection is raised, the licence granted is non-exclusive, perpetual, irrevocable, worldwide and royalty-free, with direct identifiers removed. Personal data may be transferred to the United States under standard contractual clauses and the Data Privacy Framework.

Data retention & training

Hosting summary

Miro offers data residency in four zones, the European Union, the United States, Australia and Japan, as an Enterprise plan option; the Japan residency programme was announced on 8 July 2026. Outside that option, the privacy policy states that data may be transferred to and processed in the United States and in other countries. Those transfers rely on the European Commission's standard contractual clauses and on Data Privacy Framework certification, covering the EU-US framework, its UK extension and the Swiss-US framework. Encryption is TLS 1.2 or above in transit and AES-256 at rest, on every plan and at no extra cost. The subprocessor list is published, and the Help Center documents where AI processing takes place. One caution when reading technical signals: the IP address the domain resolves to (143.204.55.17, Zurich, AS16509 Amazon) is a CloudFront edge node. It shows how the website is delivered, not where customer data is stored, and the two should not be confused.