Privacy Policy

This Privacy Policy describes how MirrorSite AI handles information when users visit the website, create an account, use the platform, create projects, submit prompts, provide URLs, use AI features, purchase credits, participate in referrals, or contact support.

The exact information processed depends on how you interact with the platform. Separate notices may apply to specific features where required.

By using MirrorSite AI, you acknowledge that you have read and understood this Privacy Policy. We encourage you to review this Policy and the Terms of Service regularly.

MirrorSite AI is a product created and operated by ATAI — Advanced Technologies and AI Enterprises. ATAI focuses on building practical AI-powered technology that transforms complex technical workflows into accessible, automated experiences.

[LEGAL ENTITY DETAILS TO BE CONFIRMED BY ATAI/LEGAL COUNSEL]

You voluntarily provide information when you:

• Create an account (email, name, password)
• Complete your profile
• Submit prompts, ideas, or application requirements
• Provide website URLs for analysis
• Create and configure projects
• Upload files or assets
• Submit support requests or feedback
• Participate in the referral program
• Purchase credits

Users may submit product ideas, prompts, application requirements, project information, website references, code, configuration, and other development-related content to MirrorSite AI.

MirrorSite may process this information to:

• Understand the requested application
• Create structured project context
• Generate project plans and specifications
• Generate application code
• Create application components
• Provide development previews
• Configure supported infrastructure
• Perform requested AI functions
• Maintain project state and history

Your prompts and project inputs may be transmitted to third-party AI infrastructure providers when necessary to provide the requested functionality. The specific providers and processing arrangements may change as the service evolves.

When you submit a website URL, the following may occur:

1. MirrorSite receives the URL you submitted.
2. The system requests and analyzes publicly accessible website information as required by the requested feature.
3. Relevant information may be processed to understand the website's structure, layout, navigation, content, and functionality.
4. Structured information may be generated from the analysis.
5. That information may be used to produce project context or application output.

Website analysis may encounter information that appears on publicly accessible webpages. Users should avoid using the platform to intentionally collect personal information from third-party websites without an appropriate legal basis or authorization.

MirrorSite AI uses mobile money payment processing (MTN and Airtel) for credit purchases. Payment information is processed as follows:

• You submit a payment confirmation screenshot for verification.
• An AI-powered analysis system extracts transaction details from the screenshot for verification purposes.
• MirrorSite receives transaction confirmation data including: transaction ID, amount, currency, payment status, payment reference, and timestamps.
• MirrorSite does not directly collect or store credit card numbers.

Credit balances, usage information, and transaction history are associated with your account in order to provide the service and enforce applicable usage limits.

If you participate in the referral program, the following information may be processed:

• Referral code and referral relationships
• Referring account and referred account identifiers
• Qualifying events and verification status
• Reward credit issuance
• Anti-fraud signals and fraud detection flags

Referral information is processed to attribute referrals, issue qualifying rewards, prevent fraud, and enforce referral program rules. We use the minimum data necessary for these purposes.

When you use MirrorSite AI, certain information may be collected automatically, including:

• IP address
• Browser type and version
• Device type and operating system
• Language and timezone settings
• Pages visited and navigation patterns
• Referrer information
• Timestamps of activity
• Session data
• Error and performance information

This information is used for security, authentication, abuse prevention, analytics, debugging, performance monitoring, and service improvement.

MirrorSite AI uses the following types of cookies:

The session cookie is essential for authentication and cannot be disabled while logged in. MirrorSite does not use marketing or advertising cookies.

MirrorSite may use information to:

MirrorSite AI uses artificial intelligence capabilities across multiple stages of the application-building process. AI processing may involve:

• Analyzing submitted prompts and ideas to understand requirements
• Interpreting website structure and content from submitted URLs
• Creating structured project context from analysis results
• Planning application architecture and components
• Generating application code and configuration
• Reasoning about dependencies and technical requirements
• Verifying payment screenshots for transaction confirmation

MirrorSite may transmit certain project inputs to third-party AI infrastructure providers when necessary to provide requested functionality. The specific providers and processing arrangements may change as the service evolves.

Information may be shared with:

Service Providers

Providers needed to operate the service, including hosting, databases, authentication, AI processing, email delivery, payments, file storage, analytics, and monitoring.

Legal and Safety Reasons

Information may be disclosed when reasonably necessary to comply with law, respond to lawful requests, enforce our Terms of Service, prevent fraud, protect users, or protect the service.

Business Transfers

If the business undergoes merger, acquisition, restructuring, or asset transfer, data may be transferred as part of the relevant transaction, subject to applicable law.

MirrorSite does not sell personal information to third parties.

MirrorSite implements security measures designed to protect information, including:

• Password hashing using bcrypt with a cost factor of 12
• Session tokens stored as SHA-256 hashes (raw tokens are never stored server-side)
• HttpOnly, secure session cookies with SameSite protection
• Authentication-based access controls on all project and account data
• Rate limiting on sensitive endpoints (registration, login, etc.)
• Structured logging with automatic secret redaction
• Server-side session management with automatic expiration

No method of transmission or storage can be guaranteed to be completely secure. While we take reasonable measures to protect information, we cannot guarantee absolute security.

We retain information for as long as reasonably necessary for the purposes described in this Policy, subject to applicable legal requirements and operational needs.

Specific retention details:

• Session tokens: Expire after 30 days and are deleted on logout.
• Account data: Retained while the account is active. Soft-deleted accounts have PII stripped but records may be retained for legitimate business purposes.
• Project data: Retained while the project exists and as needed for service operation.
• Transaction records: Retained for billing, accounting, and fraud prevention purposes.
• Server logs: Retained for operational and debugging purposes.

Specific retention periods for jurisdictions requiring formal schedules should be finalized by legal counsel.

You may request account deletion through your account settings or by contacting support. Account deletion performs a soft-delete that:

• Removes your ability to log in
• Strips personally identifiable information from your account record (email replaced, name anonymized)
• Revokes all active sessions

Some information may need to be retained where required by law, fraud prevention, security, accounting, dispute resolution, or legitimate business records.

Depending on where you live and applicable law, you may have certain rights regarding your personal information, which could include:

• Access to your personal information
• Correction of inaccurate information
• Deletion of your personal information
• Data portability
• Restriction of processing
• Objection to processing
• Withdrawal of consent
• Lodge a complaint with a supervisory authority

To exercise any of these rights, please contact MirrorSite support. We will respond to reasonable requests in accordance with applicable law.

MirrorSite is not intentionally designed to collect personal information from children in circumstances where doing so would violate applicable law. If we become aware that we have collected personal information from a child without appropriate consent, we will take steps to delete that information.

MirrorSite and its service providers may process information in countries other than the country where you live. These countries may have data protection laws that differ from the laws of your country.

By using MirrorSite AI, you acknowledge that your information may be transferred to and processed in other countries. We take reasonable measures to ensure that adequate protections are in place.

We may update this Privacy Policy as the service evolves, features are added, providers change, legal requirements change, or privacy practices change.

When we make material changes to this policy, we will update the "Last Updated" date at the top of this page and, where appropriate, notify users through reasonable means.

We encourage you to review this Policy periodically. Your continued use of MirrorSite AI after changes are posted constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or MirrorSite AI's privacy practices, please contact us through the MirrorSite AI platform or reach out to ATAI — Advanced Technologies and AI Enterprises.

[OFFICIAL PRIVACY CONTACT TO BE CONFIRMED BY ATAI]