MIRROR AI

Mirror AI ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, store, and protect your information when you use our Mirror AI mobile application and related services (collectively, the "Service"). TrTech is responsible for the processing of Personal Information in the Mirror AI app. TrTech is based in Rishon LeZion, Israel and you can contact us via aihairstyle32@gmail.com.

Mirror AI is an artificial intelligence-powered photo editing application that uses advanced machine learning algorithms to transform your photos with AI-driven hairstyle effects. We understand that when you use our Service, you are entrusting us with your personal information and visual content, and we take this responsibility seriously.

This Privacy Policy applies to all users of the Mirror AI application, whether you access it through mobile devices or other platforms. By using our Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with any part of this Privacy Policy, please do not use our Service.

We encourage you to read this Privacy Policy carefully and contact us if you have any questions or concerns about our privacy practices. We are committed to transparency in our data handling practices and will always strive to protect your privacy while providing you with the best possible user experience.

We may update this Privacy Policy according to changes in our service functions and measures concerning the protection of Personal Information. If we make changes to this Privacy Policy, we will update it through our App. Thus, you are advised to review this page periodically for any changes.

1. Information We Collect

1.1 Personal Information

We collect minimal personal information from you. We use a device-based identification system that does not require traditional account creation. We collect your device identifier to provide you with a personalized experience and track your subscription status and credits.

If you choose to sign up using third-party services such as Google, Facebook, or Apple, we may receive additional information from these platforms, depending on your privacy settings with those services.

1.2 Visual Content and Face Data

Mirror AI does NOT retain face data. Your facial images have ZERO (0) seconds of retention in our systems.

When you upload photos with facial images to Mirror AI, here's what happens:

• On Your Device: Photos exist only in device memory during your active session
• During Transmission: Images are encrypted via HTTPS and sent directly to Google Gemini API (NOT stored on our servers)
• In Our Systems: We do not store, save, or retain facial images at any time
• After Processing: Generated images exist only in your app session and are deleted when you close the app or navigate away

Generated images exist temporarily in your app session only. To keep a generated image, you must manually save it to your device using the share button. When you close the app, all generated images are permanently deleted from memory.

Third-Party Processing: Google Gemini API

Who We Share Face Data With: We share your facial images with Google LLC through their Gemini 2.5 Flash Image API.

Why We Share: Google Gemini API performs the AI-powered hairstyle transformation, which is the core functionality of our app. This processing cannot be done on your device alone due to the computational requirements of advanced AI models.

Google's Data Retention Practices:

• Processing: Google processes images in-memory and deletes them immediately after generating your hairstyle transformation (typically 3-20 seconds)
• Abuse Monitoring: Google retains a copy of submitted images for up to 55 days solely for abuse detection, policy enforcement, and security threat monitoring
• Training: Google does NOT use your images to train or improve their AI models
• Why 55 Days: This is the minimum time Google requires to effectively monitor for abuse, violations of Google's Acceptable Use Policy, illegal content, and security threats

Google's Privacy Documentation:

• Google Gemini API Usage Policies
• Google Cloud Vertex AI Data Governance

Detailed Face Data Retention Timeline

1.3 Device and Technical Information

We automatically collect certain technical information about your device and how you interact with our Service. This includes your device type, operating system version, unique device identifiers, IP address, screen resolution, and mobile network information. We also collect information about your app usage patterns, including which features you use most frequently, session duration, crash reports, and performance metrics.

This technical information helps us understand how our Service is being used, identify and fix technical issues, improve performance, and ensure compatibility across different devices and platforms. We use this data to optimize our AI algorithms, reduce processing times, and enhance the overall user experience.

1.4 Usage and Analytics Data

We collect detailed information about how you interact with our Service, including the features you use, the time you spend in the app, the types of hairstyle effects you apply, and your content creation patterns. This usage data helps us understand user preferences, improve our AI models, and develop new features that better serve our community.

We track user engagement metrics such as session frequency, feature adoption rates, and user retention patterns. This information is crucial for maintaining and improving our Service quality, identifying popular trends, and ensuring that our AI algorithms continue to evolve to meet user needs.

2. How We Use Your Information

We may process your Personal Information for the following purposes:

• To provide services for you in connection with Mirror AI Terms of Service.
• To fulfill requests for products, services, functionality, support, and information for internal operations, including troubleshooting, data analysis, testing, research, statistical, and survey purposes and to solicit your feedback.
• To provide customized contents and services for you.
• To better understand and analyze how our users use Mirror AI.
• To improve and develop our services and conduct product development.
• To measure and understand the effectiveness of advertisements.
• For digital marketing purposes and to promote Mirror AI.
• To improve information security of Mirror AI.
• To prevent fraud or other illegal activities.

2.1 Service Provision and Enhancement

The primary purpose of collecting your information is to provide, maintain, and improve the Mirror AI Service. We use your device information to authenticate your identity and provide customer support when needed. Your visual content is processed by our AI algorithms to deliver the hairstyle transformation features that define our Service.

We continuously work to improve our AI models and algorithms using aggregated and anonymized usage data. This helps us develop more accurate and creative effects, reduce processing times, and introduce new features that align with user preferences and emerging trends in AI-powered photo editing.

2.2 Personalization and Recommendations

We use the information we collect to personalize your Mirror AI experience. This includes recommending hairstyle effects based on your usage history, suggesting new features that might interest you, and customizing the user interface to match your preferences. Our AI algorithms learn from your interactions to provide increasingly relevant and engaging content.

2.3 Communication and Marketing

We use your contact information (if provided) to send you important updates about our Service, including security notifications, policy changes, and technical updates. With your consent, we may also send you marketing communications about new features, special offers, and other Mirror AI-related content that we believe may interest you.

All marketing communications include clear unsubscribe options, and you can manage your communication preferences through your account settings. We respect your choices and will never send you unwanted communications.

2.4 Security and Fraud Prevention

We use the information we collect to protect our Service and our users from security threats, fraud, and abuse. This includes monitoring for suspicious activity, implementing security measures to protect user accounts, and investigating potential violations of our Terms of Service.

Our security measures include automated systems that analyze usage patterns to detect unusual activity, as well as manual review processes for reported content or behavior. We take a proactive approach to security to ensure that Mirror AI remains a safe and trustworthy platform for all users.

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA) and the United Kingdom, we process your personal data based on the following legal grounds:

• Contract Performance: We process your personal information to fulfill our contractual obligations to provide the Mirror AI Service. This includes account creation, service delivery, customer support, and billing processes.
• Legitimate Interests: We process certain data based on our legitimate business interests, including service improvement, security measures, analytics, and fraud prevention. We always balance these interests against your privacy rights and provide opt-out mechanisms where appropriate.
• Consent: For certain processing activities, particularly those involving facial image analysis and marketing communications, we rely on your explicit consent. You can withdraw this consent at any time through your account settings.
• Legal Compliance: We may process your information to comply with applicable laws, regulations, and legal obligations, including responding to lawful requests from authorities and protecting our legal rights.

4. Data Sharing and Disclosure

4.1 Service Providers and Partners

We work with specific third-party service providers to deliver our Service:

What We DON'T Do:

• We don't sell your data to third parties under any circumstances
• We don't share face data with advertisers or marketing companies
• We don't use face data for targeted advertising
• We don't build facial recognition databases

Our service providers are carefully vetted and required to maintain the same high standards of data protection that we uphold. They are prohibited from using your information for any purpose other than providing services to Mirror AI, and they must implement appropriate security measures to protect your data.

4.2 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity. We will provide notice of any such transfer and ensure that the receiving party agrees to protect your information in accordance with this Privacy Policy. You will have the opportunity to delete your account and data before any such transfer if you choose.

4.3 Legal Requirements

We may disclose your information when required by law, such as in response to a court order, subpoena, or other legal process. We may also share information when we believe it is necessary to protect our rights, property, or safety, or the rights, property, or safety of our users or the public.

Before disclosing information for legal reasons, we carefully review each request to ensure it is valid and necessary. We will notify you of such disclosures when legally permitted to do so.

4.4 Aggregated and Anonymized Data

We may share aggregated, anonymized, or de-identified information that cannot be used to identify you personally. This might include industry reports, research studies, or general usage statistics that help advance the field of AI-powered photo editing while protecting individual privacy.

5. Data Security

5.1 Technical Safeguards

We implement comprehensive technical security measures to protect your information from unauthorized access, disclosure, alteration, or destruction. This includes industry-standard encryption for data in transit and at rest, secure server infrastructure, regular security audits, and advanced access controls.

Our AI processing infrastructure is designed with privacy and security as core principles. Visual content is encrypted during upload, processing, and temporary storage, and we use secure, isolated computing environments to ensure that your data remains protected throughout the AI enhancement process.

5.2 Access Controls

Access to your personal information is strictly limited to authorized personnel who need it to perform their job functions. All employees and contractors with access to user data undergo background checks and receive comprehensive privacy and security training. We implement role-based access controls and regularly review and audit access permissions.

5.3 Data Breach Response

In the unlikely event of a data breach, we have established comprehensive incident response procedures to quickly identify, contain, and remediate any security issues. We will notify affected users and relevant authorities as required by applicable laws, typically within 72 hours of discovering a breach.

Our incident response team includes security experts, legal counsel, and communications specialists who work together to minimize any potential impact and ensure transparent communication with our users and stakeholders.

6. Data Retention

6.1 Face Data Retention

Generated images exist only in your app session memory. To keep them, save manually using the share button before closing the app. Once you close the app or navigate away, all generated images are permanently deleted and cannot be recovered.

6.2 Account Information

We retain your device-based account information (device ID, subscription status, credits) for as long as you use the Service. If you request data deletion, we will delete your personal information within 30 days, except where we are required to retain certain information for legal, regulatory, or security purposes (such as billing records for tax compliance, retained up to 7 years).

6.3 Usage Data

We retain anonymized usage and analytics data for up to two years to understand long-term trends and improve our Service. This data is aggregated and cannot be used to identify individual users.

We retain personal information for as long as needed or permitted for the purpose(s) for which it was obtained and consistent with applicable law. The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide the Services to you.
• Whether there is a legal obligation to which we are subject; or
• Whether retention is advisable in light of our legal position (for example, in light of applicable statutes of limitations, litigation or regulatory investigations).

7. Your Rights and Choices

7.1 Access and Portability

You have the right to access the personal information we hold about you and to receive a copy of this information in a structured, commonly used format. You can request this information by contacting our support team.

7.2 Correction and Updates

You can update or correct your personal information at any time through your account settings. If you need assistance with updating your information or believe that we have inaccurate data about you, please contact our support team.

7.3 Deletion and Erasure

You have the right to delete your account and request the erasure of your personal information. When you delete your account, we will remove your personal information from our active systems within 30 days. Some information may be retained in backup systems for a limited time for security and legal compliance purposes.

7.4 Consent Management

For processing activities that rely on your consent, you can withdraw that consent at any time through your account settings. Withdrawing consent may limit certain features but will not affect the lawfulness of processing based on consent before its withdrawal.

7.5 Objection and Restriction

You have the right to object to certain types of processing, particularly for marketing purposes or processing based on legitimate interests. You can also request that we restrict the processing of your information in certain circumstances.

7.6 Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another service provider where technically feasible.

8. International Data Transfers

Data collected by us may be stored in Israel or other locations. Mirror AI operates globally and may transfer your information to countries outside your home jurisdiction, including countries that may not have the same level of data protection as your home country. When we transfer data internationally, we implement appropriate safeguards to ensure your information remains protected.

For transfers from the EEA and UK, we rely on adequacy decisions, standard contractual clauses, or other approved transfer mechanisms to ensure adequate protection. We regularly review and update our international transfer practices to comply with evolving legal requirements.

9. Children's Privacy

Our Services do not address anyone under the age of 13. We do not knowingly collect children's personal information without their parents' or guardian's consent. For some users that are determined as children according to applicable data protection laws, to comply with the requirements of applicable data protection laws, we must obtain the parent's or guardian's verifiable consent before processing children's personal information.

If we learn that a user is under the age of 13, we'll take reasonable steps to delete any processed data and close the associated account. If you are a parent or guardian of our user and learn that the user's data is processed without your consent, please contact us via aihairstyle32@gmail.com and we will take reasonable steps to delete the processed data.

10. Third-Party Websites and Services

Our Services may enable access to third-party websites or services operated by third parties. This Privacy Policy does not apply to any data processed by such third-party websites and services. We have no control over the data processed by such third-party, and are not responsible for any services provided by the third-party. For how the third-party processes your data, please refer to its privacy policy.

11. Regional Privacy Rights

11.1 California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

• The right to know what personal information we collect
• The right to delete personal information
• The right to opt-out of the sale of personal information
• The right to non-discrimination for exercising these rights

We do not sell personal information as traditionally defined, but we may share information for targeted advertising purposes, which may be considered a "sale" under California law. You can opt-out of this sharing through your account settings.

To exercise your rights, please contact us at aihairstyle32@gmail.com.

11.2 European Residents (GDPR)

European residents have comprehensive rights under the General Data Protection Regulation (GDPR), including all the rights described in the "Your Rights and Choices" section above. You also have the right to lodge a complaint with your local data protection authority if you believe we have not handled your personal information appropriately.

11.3 Other Jurisdictions

We comply with applicable privacy laws in all jurisdictions where we operate and will continue to update our practices as new regulations come into effect. If you have questions about your rights under local privacy laws, please contact us for more information.

12. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

These Terms of Service are effective as of the date listed above and apply to all users of the Mirror AI Service.