Privacy Policy
Version 1.1 · Updated 19 October 2026 · Effective 16 October 2026
This policy explains how MiraDay handles personal data. Our Personal Information Notice, also referred to as the Processing Notice or Candidate Privacy Notice, provides the detailed notice for professional profiles in F2D.
At a glance
Who we are. Forward AI Labs, Inc. (“MiraDay”, “we”) provides MiraDay, a global talent intelligence platform at miraday.ai built for in-house recruiting teams and search firms, with a focus on critical hiring for leadership, executive and technical roles.
How we process data. We administer accounts, operate F2D (Fast to Data), our recruiting data infrastructure bringing together professional profiles, company information and job information, and process customer data on their instructions. Our role depends on the activity (Section 1.2).
Professional data contributions. Eligible professional fields newly added or updated in a customer’s Workspace enter F2D and may be shared with other customers for recruiting (Section 2.4). Connected-account data and excluded content are not contributed.
Your rights. Use the Privacy Center, the Privacy Request page or privacy@miraday.ai to ask about your data, exercise applicable rights and manage marketing choices (Section 5).
Find what applies to you
MiraDay users and customer contacts. This policy covers your account, use of the Services and interactions with us. Sections 1.4 and 2.1 explain Workspace separation and organizational access. Customers reviewing our processing or security can also consult the Data Processing Addendum (DPA).
Candidates and other professionals. For our F2D processing, read Sections 2.3 and 2.4 and the Personal Information Notice. For data handled on an employer’s or recruiter’s instructions, their notice applies; Section 2.2 explains how we assist. Both may apply to different copies of your data, including if you also use MiraDay.
Website visitors. Sections 2.5 and 5 and the Cookie Policy explain website data and choices.
1. About MiraDay and this policy
1.1 MiraDay and our roles. Forward AI Labs, Inc. provides MiraDay. We act as a controller for our independent purposes and as a processor when handling personal data on a customer’s documented instructions under the DPA.
For privacy questions or requests, use privacy@miraday.ai or our privacy pages above. Full contact details are in Section 11; processing locations are in Section 9.
1.2 Our role depends on the activity. The customer is the individual for a Personal Workspace or the organization for an Organization Workspace. Our main roles are:
Activity
Our role
Relevant information
Account administration, billing, our own support administration, website operation, marketing and service analytics
Controller for our independent purposes
Sections 2.1, 2.5 and 3
Independent F2D collection, eligible contributions, profile maintenance, matching/ranking and delivery
Independent controller; receiving customers independently control their received copies
Sections 2.3, 2.4 and 3; Data Sharing Addendum (DSA); Personal Information Notice
Customer-instructed processing of personal data in content, Outputs and related service records, including hosting F2D copies saved in a Workspace
Processor under the DPA
Section 2.2; DPA
Connected accounts
Controller for distinct account administration; processor for instructed content and related records
Section 2.6
Extension captures
Processor for captures into a customer Channel; controller for direct collection for our independent F2D purposes
Section 2.7
Roles depend on the purpose and activity, not database location or a record’s label. Contribution does not change our processor role for the original Workspace copy or make the whole Workspace controller processing. Security and usage records processed on customer instructions also remain covered by the DPA.
1.3 Key terms. These terms follow the Terms of Service:
F2D / F2D Data. F2D (Fast to Data) is our recruiting data infrastructure, bringing together professional profiles, company information and job information. F2D Data is information actually made available to a customer through it, subject to applicable access, source, field and use restrictions. This policy concerns Personal Data processed in those activities, including Personal Data in related company or job records, rather than information that is not Personal Data.
Account / Plan. Your login identity / subscription tier.
Workspace / Channel. A customer’s working environment / a project conversation and task context within that Workspace.
Customer / Authorized User. The individual or organization responsible for a Workspace / an individual permitted to use the Services for that customer. The same person may have different roles in different Workspaces.
Customer Content / Outputs / Workspace Data. Information uploaded, imported, entered, synced or captured by customers / results generated by the Services / candidate data in customer content held in Contacts, Channels or Files. Personal data in content, Outputs and related instructed records is covered by the DPA.
1.4 Personal and Organization Workspaces. Your Personal Workspace belongs to you as the individual customer; an Organization Workspace belongs to the organizational customer. Their data and Channels are separate. Joining, switching or leaving an organization does not transfer personal content, give the organization access to your Personal Workspace, close your account or cancel your personal subscription. Data and Credits are not used across Workspaces.
Within the organization’s authorized scope, an Organization Administrator may manage membership and see your name, email, role, seat status and available organizational activity records. They cannot access your Personal Workspace or password, reset or delete your whole account, or disconnect its connections or Extension. Removing membership does not delete your account or prevent continued personal use. Subscription and access rules are in the Terms; return and deletion are explained in Section 7.
Email connections and the Extension follow your account, while data brought into MiraDay enters the relevant Channel’s Workspace. Section 2.6 explains switching, disconnection and existing tasks. Both Workspace types are subject to Section 2.4’s contribution rules.
2. Personal data we collect and its sources
2.1 Users: your account and how you use MiraDay. When you create an account or use the Services, we collect:
Account and identity data. Your name, work email, password hash, job title, company, profile photo, time zone and language, provided by you. An Organization Administrator may provide your name and email when inviting you.
Organization data. Workspace name, invitations, membership, roles, permissions and seat allocations, provided by the Organization Administrator or generated through organizational use.
Billing data. Plan, Workspace-specific Credits balances and usage records, invoices, billing contact, card type and last four digits, from you and Stripe. Full card numbers go directly to Stripe and are never stored by us.
Usage and product data. Feature-use events, pages viewed, clicks, session duration and error reports generated by your use. Searches, prompts, tasks and related records are processed on customer instructions where applicable.
Content and Outputs. Documents and files, including job descriptions and reports; Channel messages, notes, evaluation criteria and outreach drafts; saved searches, templates, Customer-created Skills and workflow instructions; voice input, uploaded audio and transcriptions where used; and task inputs and generated results. These come from you or are generated by the Services. Personal data in instructed content, Outputs and related records is covered by Section 2.2.
Communications. Support tickets, chats with our team, survey responses and AI-output feedback you provide.
Technical data. IP address, device, operating system, browser, approximate location derived from IP and cookie identifiers from your device. See the Cookie Policy.
Diagnostics may include identifiers, feature events, errors, performance data and necessary authorized task content; unnecessary credentials and unrelated content are excluded.
You are not required by law to provide personal data. We need a name and work email to create an account, and billing details for a paid Plan; without the required information we cannot provide the relevant Services. Other information is optional. Organizational access to your information is explained in Section 1.4.
2.2 Personal data processed on a customer’s behalf. Customers upload, import, enter or collect data about candidates, Authorized Users, hiring contacts, referees and others. This may include CVs, applications, interview notes and feedback, emails and attachments, Extension captures, audio and transcriptions, and task content and Outputs described in Section 2.1. We process this data on the relevant customer’s documented instructions under the DPA, including when hosting F2D data it has saved in its Workspace.
The employer or recruiter who contacted you or received your application is the controller of its processing and is responsible for its notice and recruiting decisions. If you are unsure which customer holds your data, ask us and we will identify them where law permits. Contact that customer about its processing; requests sent to us are forwarded without undue delay, with the assistance required by the DPA. We do not decide the response for the customer unless authorized or required by law.
Eligible contribution is a separate activity under Section 2.4 and the DSA. It does not remove DPA protection from the original Workspace content. Return and deletion follow Section 7; AI processing follows Section 3.2.
2.3 Candidates in F2D. This section covers our independent processing of professional profiles, regardless of whether they come from public sources, data providers, customer contributions or the Extension. F2D also brings together company and job information. This section and the Personal Information Notice cover professional profiles and Personal Data in related company or job records; information that is not Personal Data falls outside their scope. The Personal Information Notice provides the detailed notice for that personal information.
Professional profile data. Profiles may contain the following professional field categories, subject to applicable source and field restrictions. Not every profile contains every field.
Category
Professional profile fields
Professional identity and profile links
Name and public professional profile identifiers or URLs
Employment history
Current and past job titles, employers, departments and employment dates
Education and qualifications
Education, professional qualifications and certifications
Skills and expertise
Professional skills, languages and areas of expertise
Professional location and public works
City- or region-level professional location and links to publicly available professional publications, works or portfolios
Business contact details
Lawfully obtained work email addresses and work telephone numbers used in the person’s professional capacity
We use appropriate technical measures to classify work contact details; unresolved personal/business classifications are not eligible for contribution or delivery.
Sources and use. F2D draws on public professional sources, authorized data providers, eligible customer contributions and Extension collection. Each route has its own source permissions, field limits and notice and rights safeguards, explained in the Personal Information Notice.
We process F2D as an independent controller for the purposes in Section 3 and share permitted profiles with customers for recruiting under the DSA. Accuracy and retention follow Section 7; rights follow Section 5. We do not admit special category, criminal offence or children’s data into F2D or use the Services to infer sensitive or protected characteristics. Customer-controlled content is handled on lawful instructions under the DPA.
Candidate notice. We are responsible for the notice required for our F2D processing, primarily by email where a lawful delivery channel is available, with details in the Personal Information Notice. We will record notices, delivery and any exception relied on. Where Article 14 applies, required information is provided within a reasonable period no later than one month after obtaining the data, at the latest on first communication or first disclosure, as applicable. Holding back delivery does not remove an earlier notice deadline; writing data into F2D does not restart it.
Where individual notice is impossible or involves disproportionate effort, an applicable exception requires a documented assessment and safeguards, including publicly available information and rights channels. No email address, scale or cost alone is a blanket exception. We will not deliver a record without the required notice or a legally applicable documented exception. Effective objections, restrictions and suppression continue to block the processing they cover.
2.4 Customer data contributions.
Eligible professional fields from customer Workspaces contribute to F2D. This section explains contribution eligibility, our independent use and the parties’ roles; the Terms and DSA set out the applicable contribution and sharing obligations.
2.4.1 Data eligible for contribution. Contribution is limited to eligible structured, recruitment-relevant values in the professional field categories described in Section 2.3 and DSA Annex 1. We exclude:
Whole CVs, attachments, files, screenshots and page captures; interview recordings and transcripts.
Customer notes, private labels, assessments, scores and interview feedback; messages, prompts, task instructions and hiring decisions.
Compensation, credentials, passwords and confidential customer business information.
Personal email and telephone details, home or precise addresses, photographs, dates of birth and age.
Special category, criminal offence or children’s data, and fields revealing or inferring those categories.
Connected-account content, extracted fields and other derivatives, even if a field appears on the whitelist.
Public availability does not override exclusions, source restrictions or rights. Independent acquisition of the same value from an eligible public/licensed source must be separately recorded. The field and source rules must remain consistent with the Personal Information Notice.
2.4.2 Use and roles. Contribution applies to eligible fields newly added or updated in ordinary use after the applicable terms take effect, in both Personal and Organization Workspaces. There is no separate contribution switch, and unchanged historical records are not authorized for bulk contribution.
We use eligible contributions to verify and maintain F2D and provide permitted profiles to other customers for recruiting. The customer must have a lawful basis and source permissions for its disclosure. We act as an independent controller for our F2D receipt and use under the DSA; this does not move or erase the original Workspace content or remove its DPA protection. Our own legal duties apply from the point an independent purpose begins, even before a field is written into F2D. A customer agreement is not the candidate’s consent.
We will apply source and field restrictions, quality checks and effective suppression before admission and delivery. Records matching an effective suppression are withheld; unresolved eligibility or conflicting restrictions must be resolved before admission. Model use follows Section 3.2.
Contributed data follows the candidate-notice requirements in Section 2.3 and the rights and affected-copy arrangements in Section 5.
2.5 Website visitors, cookies and similar technologies. We collect technical and usage data, including IP address, browser, device, referring page, pages viewed and time on page. Cookies and similar technologies, including web beacons or pixel tags where used, may store or access information on your device. Forms collect the information you submit.
Where law requires consent, we obtain it before using the relevant technology. You can accept or reject optional technologies, select categories where offered, and later change or withdraw your choice through the applicable website controls. Withdrawal does not affect earlier lawful processing. Non-essential session replay is subject to applicable consent requirements; we will prevent it from recording passwords or payment-field inputs. The Cookie Policy explains technologies, purposes, expiry and choices, separately from the interaction-metadata analytics in Section 3.2.
2.6 Connected accounts (Google, Microsoft). You may authorize a Google Workspace or Microsoft 365 connection for task-related email functions. We handle connected-account data as follows:
Access and use. Access is limited to the permissions shown when you authorize the connection and the tools you enable. We may prepare, send or forward messages and read or summarize task-related messages, threads and attachments. Use is limited to providing and improving the user-facing features you connected the account for.
Storage and sharing. Saved content is Customer Personal Data in the relevant Channel’s Workspace, with the safeguards in Section 9. Content, extracted fields and other derivatives are excluded from F2D contribution. There is no advertising use; disclosure is limited to the authorized functions, applicable provider requirements or legal obligations.
Model training. Connected-account data is never used to train, fine-tune or improve our own or third-party AI or machine-learning models, whether raw, aggregated, anonymized or derived. Third-party AI providers may not retain it for training.
Human access. Human access is permitted only where you have first affirmatively agreed to the viewing of specific messages, files or other data, or where access is necessary for security or abuse investigation or to comply with law.
Disconnection and existing tasks. You can disconnect through available connection controls or revoke third-party authorization; we stop the corresponding access after revocation. Switching Workspaces or ending membership does not itself disconnect an account-level connection or stop an existing task, including an Extension task, in its original Channel. That task’s data and Credits remain in its original Workspace, subject to lawful access restrictions, deletion instructions and rights safeguards. Previously saved content follows customer instructions, provider restrictions and Section 7; disconnection does not itself erase another customer’s Workspace.
Where a third-party website or connected service controls its own processing, its privacy notice applies to that processing. The Terms explain connected-service roles; providers we engage remain subject to our applicable DPA and privacy obligations.
MiraDay’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
2.7 The MiraDay browser extension. The Extension follows your account and works while you are signed in on pages where you activate it. It reads page content and may capture a screenshot to extract a profile, fill a form or perform your requested task. It does not collect general browsing history and stops when you sign out or disable it.
All Extension activity is logged, including accessed pages, actions and timestamps, for review and investigation of errors or abuse. Sensitive actions require your confirmation. The Stop button beside the conversation input stops the current conversation turn and its tasks, including Extension tasks; it does not reverse completed actions or disconnect connections.
Captures into a customer Channel are processed on that customer’s instructions under the DPA. Direct collection for our independent F2D purposes is controller processing and follows Section 2.4’s source, field, notice and rights safeguards. Later contribution from a customer capture is limited to eligible structured fields; whole screenshots and page captures are excluded. Use on Restricted Sites is prohibited under the Terms; a current list may be requested from support@miraday.ai. Temporary captures, saved content and logs follow Section 7. Extension permission and installation disclosures will be kept consistent with this section.
3. How we use your information and our legal bases
3.1 Purposes and legal bases. The table covers MiraDay’s independent controller purposes. Customers determine the lawful basis for their instructed processing under the DPA. Agreement to our Terms is not a candidate’s consent.
Purpose and data
Legal basis and relevant interests
Account, subscription and support administration: account/contact details, Workspace-specific billing and usage records, invoices and correspondence
Contract with the individual where necessary (Art 6(1)(b)); legitimate interests in supplying and administering organizational services for people who are not the contracting customer (Art 6(1)(f)); legal obligation for required tax/accounting records (Art 6(1)(c))
F2D collection, verification, maintenance and delivery, including eligible contributions, and talent, company, labour-market and compensation research supporting Recruiting Purposes: relevant professional fields and source/delivery records
Legitimate interests (Art 6(1)(f)) in enabling relevant recruiting opportunities and maintaining accurate professional profiles, with source, field, notice and rights safeguards
Independent F2D matching, ranking and profiling: lawfully held professional information
Legitimate interests (Art 6(1)(f)) in presenting relevant information for human recruiting review, subject to Section 3.2
Candidate notices, rights handling and suppression: necessary identifiers, contacts, restrictions and accountability records
Applicable legal obligations (Art 6(1)(c)); legitimate interests where necessary to support lawful transparency, rights implementation and prevention of prohibited reintroduction
Evaluation and improvement of our matching/ranking models: independently acquired public/licensed F2D fields only
Legitimate interests (Art 6(1)(f)) in assessing recruiting relevance, accuracy and bias, within source permissions and Section 3.2’s data-use limits
Security, fraud/abuse prevention and enforcement: necessary technical, account and security information
Legitimate interests (Art 6(1)(f)) in protecting the Services and people; applicable legal obligations. Customer-instructed records remain under the DPA
Service analytics and feature improvement: interaction metadata without customer/connected content, and appropriate aggregated or de-identified usage statistics
Legitimate interests (Art 6(1)(f)) in maintaining and improving the Services; consent where non-essential cookies or similar technologies require it
MiraDay marketing: business contacts, forms and relevant interaction data
Legitimate interests where permitted; consent where applicable electronic-marketing or privacy law requires it. Unsubscribe and objection rights apply
Legal compliance and claims: relevant, necessary information
Legal obligation (Art 6(1)(c)); legitimate interests (Art 6(1)(f)) in establishing, exercising or defending lawful claims
For legitimate-interest processing, we assess purpose, necessity and the balance with individuals’ interests. Safeguards include limited data and access, source and field restrictions, accuracy and retention review, notice and rights handling, and appropriate security. Required compatibility assessments and DPIAs must be completed before the processing they concern. Customer-instructed outreach is distinct from our marketing and F2D notices; the customer determines its lawful basis and electronic-communications compliance. Consent can be withdrawn as explained in Section 5.
3.2 AI, profiling and model use. AI features, including large language models and our matching models used through Agent Teams, interpret searches and tasks, match and rank profiles against role requirements, summarize content, produce recruiting-support research, reports and email drafts, suggest next steps and perform requested Extension tasks.
Matching compares candidate professional information with the recruiter’s job-related requirements. Results and their order may affect whether and when a profile is reviewed. MiraDay provides suggestions and supporting information for human review; the employer or recruiter is responsible for its use, meaningful oversight and hiring decisions. Suggestions do not guarantee suitability. We do not offer protected characteristics as criteria or knowingly use them, or criteria intended to stand in for them, as matching/ranking inputs. We assess and monitor the matching and ranking functionality for fairness and bias and take reasonable steps to address identified issues.
Data use and model training. Necessary AI inference to provide the Services is permitted. The source-specific limits are:
Data source
Permitted use and restrictions
Customer content, Workspace Data, relevant usage/service records and Outputs, including contributed fields after entering F2D and copies or derivatives
Service processing and eligible contribution only. Never used to train, fine-tune or improve our own or third-party AI models, including after aggregation, de-identification or anonymization. Troubleshooting, task validation and support remain limited to that customer’s service and lawful instructions; no general evaluation library or unrelated product improvement
Independently acquired public/licensed F2D fields, excluding customer contributions and their derivatives
Operation, evaluation and improvement of our own recruiting matching/ranking models within lawful source permissions. No general-purpose or foundation-model training and no model-provider training
Connected-account data and derivatives
Authorized connected features only, with the no-training and other restrictions in Section 2.6
Interaction metadata and aggregated/de-identified usage statistics, excluding customer/connected content and data derived from that content
Service analytics and feature improvement, not AI training or fine-tuning. Prompt and task text remains customer content. De-identification does not necessarily make data anonymous; Section 5 explains applicable rights
Approved AI providers process data for authorized service functions under appropriate contracts, including applicable no-training and input/output retention limits. Their role follows the activity in Section 1.2. The applicable provider list and available model, input, Output, limitation and assessment information can be accessed through the functional Documentation or on request at privacy@miraday.ai, as appropriate. We assist customers under the DPA and notify them of material matching/ranking changes as the Terms provide.
Automated-decision safeguards. Whether a decision is solely automated and has legal or similarly significant effects depends on the actual process and meaningful human involvement. Under EU GDPR Article 22, such decisions are generally restricted and require an applicable exception, such as contractual necessity, authorization by law or explicit consent, and the required safeguards. Under the amended UK GDPR Articles 22A–22D, a broader range of lawful bases may be available for significant solely automated decisions using data other than special category data, subject to the statutory conditions. Special category data has additional restrictions under both regimes. Where applicable, safeguards include information, representations, human intervention and contesting the decision. Section 5 explains requests to us and assistance for customer-controlled decisions.
4. How we share your information
We share personal data with the following categories of recipients for the purposes described below. The information shared depends on the recipient and the relevant service or activity.
Customers. We provide permitted F2D professional profile information to customers for recruiting purposes, including specific lawful recruiting engagements. Customers act as independent controllers of the information they receive, subject to the source and use restrictions in the Terms and DSA. Our hosting or processing of their saved copies on their instructions follows the DPA.
Service providers. We disclose information needed to operate the Services to providers supporting hosting, storage, task execution, connected functions, AI inference, transcription, search, file editing, diagnostics, analytics and notifications. They process data under appropriate contracts as Subprocessors for customer-instructed functions or processors for our independent activities.
Independent service providers. We share billing and transaction information with Stripe as needed to process payments and administer subscriptions. Other independent providers receive service-related information needed for their functions. Data-protection roles depend on the actual service and arrangement.
Authorized data providers. We share the minimum professional information and identifiers needed for authorized profile verification or enrichment and for correction, deletion or suppression cooperation. Suppression information is limited to what is necessary to apply the relevant restriction.
Customer-selected people and services. On authorized customer instructions, we disclose selected content, Outputs and relevant data through exports, forwarded messages or enabled integrations, subject to applicable source and use restrictions. The Terms explain third-party services and Connectors.
Your organization. We make membership and authorized organizational information, including your name, email, role, seat status and available organizational activity records, accessible to the relevant organization and its authorized Organization Administrators within Section 1.4’s limits.
Professional advisers. We disclose information necessary to obtain legal, audit, insurance or accounting advice, subject to confidentiality obligations.
Authorities and other legally authorized recipients. We disclose the minimum information needed to comply with lawful obligations or demands, establish or defend claims, or protect rights and safety where law permits. Government requests follow Section 9.3.
A buyer or successor. We disclose relevant data in connection with a lawful merger, acquisition, financing or asset sale, subject to confidentiality, continued protection, required notices and applicable transfer safeguards.
The applicable provider identities and functions are set out in the relevant provider list, including DPA Annex 3; you may request the relevant list from privacy@miraday.ai. Processing-location and retention information is separately available for the relevant activity; Subprocessor changes follow the DPA’s advance notice and objection procedure.
We may also share statistics that have been genuinely anonymized so individuals are no longer identifiable. Identifiable or merely de-identified information remains subject to applicable safeguards, including Section 3.2’s customer-data no-training restriction.
5. Your rights and choices
5.1 Your rights. Subject to applicable UK or EU law’s conditions and exceptions, you may exercise the rights below. We handle our controller processing and assist the relevant customer for its processing.
Right
What it means
Access
Ask whether we process your personal data and receive the data and required information
Rectification
Request correction of inaccurate or incomplete data, with required recipient cooperation
Erasure
Request deletion where legal conditions apply; necessary limited suppression or legal records may remain
Restriction
Request limits on processing in the circumstances provided by law
Portability
Receive eligible data you provided in a structured, machine-readable form and transfer it where statutory conditions apply, including relevant consent/contract-based automated processing. This does not apply to F2D processing based solely on legitimate interests and differs from general access or contractual export
Withdraw consent
Withdraw consent for processing based on it, without affecting earlier lawful processing
Automated-decision safeguards
Receive applicable information and safeguards, including representations, human intervention and contesting a decision, under Section 3.2
Complain
Contact us or a competent supervisory authority as explained in Section 5.5
Your right to object. You may object to our legitimate-interest processing, including relevant F2D matching and profiling. We stop affected processing unless we establish the overriding grounds or legal-claims basis permitted by law. Direct-marketing objections, including recruiting outreach treated as direct marketing, stop that processing. A sender-specific unsubscribe applies to that sender and scope; it does not automatically delete every independently held profile or stop required privacy/legal notices. Use our privacy pages, privacy@miraday.ai or the relevant unsubscribe mechanism. We record and apply effective restrictions to prevent prohibited reintroduction.
5.2 Account and communication choices. You can delete your own user account in Settings by following the confirmation steps shown in the Services. Use available controls to update account details and manage connections, or contact support@miraday.ai for assistance, including with account deletion. These actions remain subject to Section 1.4’s organizational-access limits. There is no separate setting to disable the interaction-metadata analytics in Section 3.2; applicable privacy rights remain available. We will provide and honor marketing and recruiting-outreach unsubscribe mechanisms. Cookie controls and the Cookie Policy explain website choices; the Personal Information Notice explains F2D choices.
5.3 Making a request. Use the Privacy Center, Privacy Request page or privacy@miraday.ai. We verify identity proportionately and request only information needed to address reasonable doubts; authorized representatives may act for you. Customer Workspace instructions also require appropriate authority: membership alone does not authorize export or deletion of all organizational data.
For our controller processing, we respond without undue delay, ordinarily within one month. Where law permits an extension for complexity or multiple requests, up to two further months may be used with an explanation within the initial period. Requests are free unless a lawful manifestly unfounded/excessive or other applicable statutory exception permits a fee or refusal; we explain the decision and complaint rights. Requests for customer-controlled data are routed without undue delay with DPA assistance. Contractual cleanup and external-copy deadlines do not extend your statutory deadlines. Section 5.4 explains affected copies and recipient cooperation.
5.4 Rights and affected copies. We apply effective actions to affected F2D-origin fields inside MiraDay, provide required recipient notifications and cooperate with customers and upstream suppliers under the DSA. Customers must address affected external copies and onward recipients and confirm completion or a documented lawful exception. Customer-created notes and genuinely independent fields are assessed separately by their controller; an independent copy is not exempt from accuracy, notice or rights obligations. Minimum suppression records prevent prohibited reintroduction (Section 7).
5.5 Complaints. Contact us through the Privacy Request page or privacy@miraday.ai. Where UK law requires, we acknowledge receipt within 30 days, investigate, keep you informed and communicate the outcome without undue delay. Necessary complaint and follow-up records are retained under Section 7. You may complain to a competent supervisory authority at any time without first completing our process: the ICO in the UK, or the EEA authority for your habitual residence, place of work or alleged infringement (authority list).
6. Security and data breaches
We will implement and maintain measures appropriate to the processing and risk, including encryption in transit and at rest, appropriate authentication and role-based access, Workspace and Channel separation, monitoring, incident records, code/security checks, personnel confidentiality, provider safeguards and protected backup/recovery. The applicable technical and organizational measures are in DPA Annex 2 and DSA Annex 2; available security and independent-assurance information may be requested from privacy@miraday.ai.
For breaches affecting customer-instructed data, we notify the customer without undue delay after awareness and provide available information and updates under DPA Section 8; shared-data incidents follow DSA Section 10. We do not wait for a completed investigation or a regulator’s risk threshold before required party notification. For our controller processing, where required we notify the authority within 72 hours of awareness and affected individuals without undue delay when the applicable high-risk threshold is met, subject to lawful exceptions. We cooperate on containment, investigation and required responses.
7. Data retention
We retain personal data for necessary lawful purposes and use documented review and deletion criteria. Customer-instructed data follows the DPA; independent controller records follow their own lawful purposes. Leaving an organization, ending a subscription, closing an account and revoking a connection are different events. Ending one service does not automatically end another or erase its saved data.
Data
Retention and deletion
Customer Personal Data, including Workspace content, instructed tasks, Outputs, saved connected content and related records
During the relevant processing service on lawful instructions. At its end, return/deletion is at the customer’s choice within 90 calendar days, including the 30-day export window, protected backups and Subprocessor copies. Earlier lawful instructions and legal deadlines prevail (DPA Section 6)
Customer Personal Data backups
Restricted from ordinary use pending removal. During ongoing services, removed no later than 90 calendar days after a lawful deletion instruction; at the end of processing, within the same 90-day end-of-processing maximum. Earlier deadlines prevail; restored data has deletion/restriction instructions reapplied before use
Temporary Extension captures
Only while necessary for authorized extraction and task completion, then promptly removed. Deliberate saves follow customer-content rules; whole captures and screenshots are not contributed
Extension activity and other service/security logs
For documented, necessary service, security and accountability purposes, with protected access and lawful instructions. Customer-instructed records remain under the DPA; remove records when no longer necessary, subject to required legal retention
F2D profiles and sources
While necessary for lawful recruiting and sufficiently accurate. Review periodically and on credible corrections, rights actions or source changes; rectify or remove inaccurate, unlawful, unsupported or unnecessary fields
Suppression records
Minimum identifiers and restrictions needed to honor effective rights and prevent prohibited reintroduction. Restricted to suppression and necessary accountability, with protected access, review and removal when no longer needed; no profile reconstruction, recruiting or training use
Independent account administration, support and complaints
While needed to maintain and close accounts, respond, investigate and document outcomes, followed only by necessary legal/accountability retention. Organization removal is separate from account closure
Billing, Credits accounting and invoices
Necessary administration and applicable tax/accounting retention, including necessary claims periods; then delete or lawfully anonymize. The DPA’s general 90-day limit does not apply to these independent records
Marketing contacts and interactions
While marketing remains lawful and necessary; active marketing stops on applicable opt-out/objection. Retain only minimum unsubscribe/suppression and compliance records needed to honor the choice
Consent, notice and rights-request records; website technologies
Minimum necessary lawful accountability records, then removal when no longer needed. Identity-verification materials are removed after verification and necessary follow-up, retaining only required minimum records. Website technology purposes and expiry/storage rules follow the Cookie Policy and your choices
Generated summaries and tags follow the underlying data’s source, accuracy, retention and rights restrictions; they do not become eligible contributions merely because they are generated. One-sided follow-up messages alone do not justify continued retention of independent controller records. Legally required retained copies are restricted to that purpose. Customer processor copies are not retained for unrelated recruiting, contribution or training; deletion/return confirmation and any remaining lawful copies follow the DPA.
8. Children
MiraDay is for adults and you must be at least 18 to create an account. Age and date of birth are excluded from F2D, so professional sources do not verify every person’s age. Report suspected under-18 profiles to privacy@miraday.ai; we investigate and remove confirmed data. Incidental children’s data in customer content is handled on lawful instructions under the DPA and is not eligible for contribution or model training.
9. International data transfers
9.1 Processing and access locations. Data may be stored, processed or accessed in the countries used by the relevant approved hosting, backup, model, logging, support or other provider and authorized personnel. Our application infrastructure is hosted on AWS in Northern Virginia, United States (us-east-1); applicable Langfuse Cloud US tracing and diagnostic data is hosted in Oregon, United States (us-west-2). These describe the stated components, not every provider or access location.
For information about the processing and access arrangements relevant to your data, contact privacy@miraday.ai. Any Restricted Transfer remains subject to the safeguards and completion requirements in the applicable DPA or DSA.
9.2 Transfer safeguards. We assess each transfer’s parties, roles, countries and access arrangements. Where required, we use an applicable adequacy decision or other lawful mechanism, such as the EU Standard Contractual Clauses (SCCs) and the UK Addendum, with required assessments and supplementary measures. A mechanism or provider certification is used only within its legal scope; EU and UK requirements are assessed separately.
The DPA and DSA specify safeguards for their respective processing and sharing activities. Providers and onward transfers require appropriate separate arrangements. You can request information or a copy of the safeguards through our privacy channels. Confidential information or other people’s data may be redacted without defeating your information rights.
9.3 Government access. We review demands for legality and scope, apply required notification and challenge safeguards, and disclose only the minimum lawfully required information. Applicable DPA, DSA, SCC and UK Addendum obligations govern; affected transfers are suspended where adequate protection cannot be ensured. We do not grant unrestricted direct or bulk system access.
10. Changes to this policy
We identify updated versions and dates and make previous versions and change summaries available through our privacy channels. Material changes affecting Users’ data receive email or in-Service notice at least 30 days before effect, unless law requires a different date and we give as much notice as practicable. Organizational notice does not replace notice concerning your Personal Workspace.
F2D changes are coordinated with the Personal Information Notice; version numbers may differ. Before processing for a new purpose, we reassess the legal conditions, provide required information and obtain any required consent. An existing notice exception or acceptance of amended Terms does not automatically authorize the new purpose or retrospectively authorize processing.
11. Contact us
Privacy questions, rights and complaints. privacy@miraday.ai; Privacy Center; Privacy Request.
Support and customer instructions. support@miraday.ai, including assistance with account deletion. You can delete your own user account in Settings; privacy instructions may also be sent to privacy@miraday.ai.
Company and postal address. Forward AI Labs, Inc., 710 Lakeway Drive, Suite 200, Sunnyvale, California 94085, United States.
Related documents: Terms of Service · Data Processing Addendum · Data Sharing Addendum · Personal Information Notice · Cookie Policy.