legal

Privacy Policy

Last updated: 12 October 2026

This policy explains how Mira handles information about the stores that install it and the shoppers who use it. It covers the Mira Shopify app, Mira on custom storefronts and mobile apps, the try-on and stylist that shoppers use, and this website.

1. Who we are

Mira is operated by MERITT DEV LIMITED, a company registered in England and Wales (company number 16581026), at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. In this policy "we" and "us" mean MERITT DEV LIMITED. Contact us about privacy at hello@meritt.dev.

For information about a store and its staff, we decide how that information is used, so we are its controller. For information about shoppers, the store chooses to offer Mira and we process shopper information to provide Mira to that store. The store has its own privacy policy for its website, accounts, orders and payments, and that policy also applies.

2. Information about stores (merchant data)

  • Store details: shop domain or website, store name, the contact email Shopify gives us or that you give the Mira team, plan and billing status, settings and appearance choices.
  • Access to your store: the access token Shopify issues when you install, or the access keys we set up with you for a custom storefront or app. We store them encrypted and use them only to run Mira for your store.
  • Catalogue: products, variants, images, collections and stock levels, read with the access you approve at install.
  • Orders, for attribution only: order ID, line items, amounts, currency and the hidden Mira session marker on items added through Mira. We do not keep customer names, email addresses, phone numbers or postal addresses from orders.
  • Staff sign-in: inside Shopify you sign in with your Shopify session. If the Mira team gives you access outside Shopify, a sign-in provider handles it.

3. Information about shoppers

  • Try-on photo: the photo a shopper chooses to upload. It can show their face, body, clothing and background. We also create processing data from it, such as an image mask.
  • Try-on results: the images Mira generates showing the shopper wearing a product.
  • Saved looks: a link to a try-on result and the product it shows, when a shopper saves a look. The image itself still follows the deletion time below.
  • Stylist conversations: messages, styling requests, the products shown and the replies Mira writes.
  • Voice conversations: when a shopper talks to the stylist, their voice goes to our AI provider so Mira can hear and answer. Mira keeps a text transcript of the conversation, not the audio. The browser asks for microphone permission first.
  • Activity: a random visitor ID kept in the browser, session and try-on IDs, timestamps, and product actions such as starting a try-on or adding to cart. A store may also give us its own customer ID so a shopper keeps their history when signed in.
  • Technical data: our hosting and network providers process device, browser and IP information to serve requests and keep the service secure.

4. Photos and consent

Mira asks the shopper for consent before the first photo is uploaded. A photo is used only to render that shopper's try-ons, which includes an automatic check that the upload is safe to process. We do not use shopper photos for advertising, we do not sell them, and we do not use them to train AI models.

Uploaded photos and the try-on images made from them are deleted 12 hours after they are created. Shoppers cannot opt to keep them longer. Try-on results are previews to help a shopper decide. They are not measurements and do not guarantee fit.

5. Why we use information, and our legal bases

  • To provide Mira to the store and its shoppers: try-on, stylist, cart, dashboard and billing. Legal basis: performance of our contract with the store, and the store's legitimate interest in offering the feature.
  • To process a shopper's photo: consent, which the shopper gives before uploading and can withdraw by not using try-on or by asking for deletion.
  • To process a shopper's voice: consent, which the shopper gives by choosing to talk to the stylist and allowing the microphone. They can withdraw it by ending the call or asking for deletion.
  • To keep Mira secure, prevent abuse, diagnose failures and support stores. Legal basis: our legitimate interests.
  • To meet legal obligations, such as tax, accounting and responding to lawful requests. Legal basis: compliance with a legal obligation.

6. Who processes information for us

We use trusted service providers to run Mira. Each processes information only to provide its service to us.

  • AI provider: stylist replies, live voice, try-on images and photo safety checks. Only the photos, messages, voice and product details needed to answer a request are sent, and they are not used to train AI.
  • Cloud storage: photos and try-on images, stored in Frankfurt, Germany.
  • Hosting and network: the servers that run Mira and this website, and protection against attacks.
  • Sign-in: access for the Mira team and staff outside Shopify.
  • Payments: billing for stores that do not pay through Shopify.
  • Shopify: the platform the app runs on, and billing for Shopify stores.
  • A list of our current providers is available on request at hello@meritt.dev.

Authorised Mira staff can access operational records and try-on results to run the service and investigate problems. We may disclose information when the law requires it or to protect the service and its users. We do not sell personal information.

7. International transfers

Some providers process information outside your country, including in the United States and the European Union. Where the law requires it, we rely on safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

8. How long we keep information

  • Shopper photos, masks and try-on images: deleted 12 hours after they are created. Saved looks lose their image at the same time.
  • Stylist conversations and voice transcripts: kept so the shopper can come back to them, until they are deleted on request or the store's data is erased (48 hours after the store stops using Mira, or on a Shopify shop erasure request).
  • Order attribution records: kept while the store uses Mira, so the dashboard can report attributed sales.
  • Store data when a store stops using Mira: Mira stops for the store straight away and removes its catalogue. The remaining store data is erased 48 hours later, or when Shopify sends a shop erasure request. This applies on uninstall from Shopify, and when a store on another platform cancels.
  • Usage and billing totals: kept without shopper identity for accounting.

Our providers and backups may keep copies for a limited time under their own retention schedules.

9. Shopify privacy requests

Mira responds to Shopify's mandatory privacy webhooks. When a store forwards a customer data request, we prepare an export of the Mira data linked to that customer for the store to deliver. When a store sends a customer redact request, we delete that customer's linked data, as listed in Data deletion and export below. When Shopify sends a shop redact request after uninstall, we erase the store's data.

10. Data deletion and export

If you are a shopper

  1. The quickest route is to ask the store where you used Mira. Shopify stores can send the request through Shopify, which reaches us automatically; other stores forward it to us.
  2. You can also email hello@meritt.dev. Tell us the store's name or website and roughly when you used Mira. If you were signed in to the store, say so.
  3. We may ask you to confirm details that only you would know, so we do not delete or hand over someone else's data.

If you are a store

  1. Uninstalling Mira, or cancelling if you are not on Shopify, stops it at once and erases your store data 48 hours later.
  2. To delete data sooner, or to get an export, email hello@meritt.dev from your store's contact address.

What is deleted, and what stays

Deletion removes the linked photos, masks, try-on results, stylist conversations and voice transcripts, sessions, saved looks and activity events. Order records lose their link to the shopper. We keep cost and usage totals without identity, and anything we must keep by law. We tell you about any exception when we reply.

We reply to verified requests within 30 days.

11. Your rights

Depending on where you live, you can ask to access, correct, delete, restrict or move your information, and object to how we use it. Email hello@meritt.dev. You can also complain to your data protection authority, such as the UK Information Commissioner's Office, the Saudi Data and AI Authority (SDAIA) or the UAE Data Office.

12. Cookies and browser storage

On store pages, Mira keeps a random visitor ID and a token in the browser's local storage so returning shoppers can continue. The token expires after 30 days. Clearing browser storage disconnects the browser from its Mira history but does not delete records we hold. This website does not use advertising cookies.

13. Security

We use access controls, encrypted connections, encrypted store tokens and short-lived image links. Photos are stored privately and are never public. No system is perfectly secure, so tell us at once if you think something is wrong.

14. Children

Mira is for people aged 18 and over. Shoppers confirm this before uploading a photo. If you think someone under 18 has uploaded a photo, email hello@meritt.dev and we will remove it.

15. Changes

We update this policy when our practices change and show the date at the top. For material changes we also tell stores through the app or by email.