legal

Data Processing Agreement

Last updated: 12 October 2026

This agreement covers the shopper information that MERITT DEV LIMITED processes for your store when you use Mira. It forms part of our [Terms of Service](/terms). You accept it when you install or start using Mira, so there is nothing separate to sign.

1. Who does what

  • You, the store, decide to offer Mira to your shoppers. For shopper information you are the controller.
  • We, MERITT DEV LIMITED, process shopper information only to provide Mira to your store. For that information we are your processor.
  • Store information, such as your store details, staff sign-in and billing, is not covered here. We are its controller, and our Privacy Policy explains how we handle it.

This agreement applies wherever data protection law requires a processing agreement, including the UK GDPR, the EU GDPR, the Saudi Personal Data Protection Law and the UAE Personal Data Protection Law. If it conflicts with the Terms of Service on data protection, this agreement wins.

2. What we process

  • Purpose: to run try-on, the stylist, add to cart, the dashboard and Shopify privacy requests for your store.
  • Who it is about: shoppers who use Mira on your store.
  • What information: try-on photos and the processing data made from them, such as image masks; try-on results; saved looks; stylist messages and voice transcripts; voice, while a call is live; visitor, session and try-on IDs; the customer ID your store gives us, if any; product actions; and technical data such as device, browser and IP address.
  • Sensitive information: a photo shows a person's face and body and can reveal sensitive details. We use photos only to render that shopper's try-ons and to check the upload is safe to process.
  • How long: for as long as we provide Mira to your store, and then until deletion under section 10.

3. Your instructions

We process shopper information only on your documented instructions. Those are the Terms of Service, this agreement, the settings you choose in Mira and any other instruction you give us in writing. If we think an instruction breaks data protection law, we tell you. If the law requires us to process information in another way, we tell you first unless the law forbids it.

We do not sell shopper information, we do not use it for advertising, and we do not use shopper photos to train AI models.

4. Our staff

Only authorised Mira staff can access shopper information, and only to run the service, support your store or investigate problems. Everyone with access is bound by confidentiality.

5. Security

We protect shopper information with measures suited to the risk, including:

  • Encrypted connections for all traffic, and encrypted store access tokens.
  • Private storage for photos and try-on images, which are never public and are shown only through short-lived links.
  • Access controls that keep each store's data separate and limit staff access.
  • Automatic deletion of photos, masks and try-on images 12 hours after they are created.
  • Consent from the shopper before their first photo is uploaded, and an automatic safety check on every upload.

6. Our service providers

You allow us to use service providers (sub-processors) to run Mira, such as our AI provider, cloud storage, hosting and network providers. The types of provider we use are listed in our Privacy Policy. Email hello@meritt.dev for the current list of named providers.

  • Each provider is bound by written terms that protect shopper information at least as well as this agreement.
  • We remain responsible to you for how our providers handle shopper information.
  • We tell you at least 30 days before we add or replace a provider. If you object for a reasonable data protection reason, we will try to resolve it with you. If we cannot, you can stop using Mira, and we will not charge you for the time after you stop.

7. International transfers

Photos and try-on images are stored in Frankfurt, Germany (EU). Some providers process information in other countries, including the United States. Where the law requires it, we protect these transfers with the UK International Data Transfer Agreement, the EU Standard Contractual Clauses or another lawful safeguard.

8. Helping you meet your duties

  • Shopper requests: Mira handles Shopify's customer data request and customer redact webhooks for you. For other requests to access, correct or delete information, email us and we will help you respond. If a shopper contacts us directly, we tell you or help them reach you.
  • Risk assessments: we give you the information you reasonably need for a data protection impact assessment, or to consult a data protection authority, about your use of Mira.

9. Data breaches

If we become aware of a breach that affects shopper information we process for you, we tell you without undue delay, and within 72 hours. We share what we know: what happened, the information and shoppers affected, the likely effect and what we are doing about it. We add details as we learn them, and we help you meet any duty to notify an authority or your shoppers.

10. Deletion and return

  • Photos, masks and try-on images are deleted 12 hours after they are created, whether or not you still use Mira.
  • On Shopify, Mira stops for your store when you uninstall it, and your remaining data, including shopper information, is erased when Shopify sends its shop erasure request, 48 hours after uninstall.
  • On other platforms, Mira works until the end of your paid period, and your remaining data, including shopper information, is erased within 30 days of the subscription ending.
  • If you want a copy of shopper information before it is erased, email hello@meritt.dev from your store's contact address before you stop.
  • We keep usage and billing totals without shopper identity, and anything the law requires us to keep. Backups and our providers may hold copies for a limited time under their own schedules, protected as this agreement requires.

11. Showing that we comply

We give you the information you reasonably need to show that we meet this agreement, including answers to reasonable written security and privacy questions. If that is not enough, you or an independent auditor bound by confidentiality may audit our compliance once a year, with at least 30 days' notice, at your cost. Audits can also happen after a breach or when a data protection authority requires one.

12. Your responsibilities

  • You have a lawful basis to offer Mira to your shoppers, and your store's privacy policy tells them you use Mira for try-on and styling.
  • You do not edit, remove or get around the consent step shoppers see before uploading a photo.
  • Your instructions to us comply with data protection law.

13. Liability and changes

The liability terms in our Terms of Service apply to this agreement. This agreement lasts for as long as we process shopper information for your store. We may update it, and we give notice of material changes through the app or by email.

14. Contact

Questions about this agreement, or requests under it: hello@meritt.dev.