Privacy Policy

What we collect and why

We only collect what the service needs. Depending on how you use it:

Your account

• Your name and email address, so you can sign in and we can contact you about your account.
• Your password, stored only as a salted hash. We cannot read it.
• Sign-in sessions: a session cookie, plus the IP address and browser type of each session, to keep your account secure.
• The content you create in the app, so we can provide the service to you.

Legal basis: performing our contract with you (providing the service you signed up for).

Your saved site

• The public pages, images and styles of the Solo site you ask us to save.
• The email address you give at checkout, to send your links.

Legal basis: performing our contract with you (providing the service you signed up for).

Payments

• Payments are processed by Stripe on its own secure checkout. Your card details go directly to Stripe; we never see or store them.
• We receive your name, email address and what you bought.

Legal basis: performing our contract with you, and our legal obligations (for example tax and accounting records).

Marketing emails

• If you sign up for updates, we send your email address and the name of this product to Resend, which we use for marketing email. You only get emails about products you signed up to, and you can unsubscribe at any time with the link in every email.

Legal basis: your consent. Withdrawing it does not affect earlier processing.

Analytics

• We count visits with two cookieless tools: Cloudflare Web Analytics and our own Mirra analytics. Neither sets cookies, uses local storage or builds a profile of you, and neither tracks you across sites. Mirra analytics records the page you view, the site or campaign link that sent you, and which channel a purchase came from. To count unique visitors it uses a one-way code made from your IP address and browser that changes every day; it never stores your IP address.

Legal basis: our legitimate interest in understanding how the service is used.

Google Tag Manager

• If you accept analytics or marketing cookies, we load Google Tag Manager, which runs the tools listed on this page. Nothing from Google loads before you accept. It uses Google Consent Mode, so each tool only gets the permissions you gave.

Legal basis: your consent.

Google Analytics 4

• If you accept analytics cookies, Google Analytics 4 records the pages you visit, how you got here, your device and browser type and your approximate location, so we can see how the service is used.

Legal basis: your consent.

Microsoft Clarity

• If you accept analytics cookies, Microsoft Clarity records how you move through pages (clicks, scrolling and heatmaps, and session replays with form text masked), so we can find and fix problems.

Legal basis: your consent.

Newsletter

• Your email address, where you signed up, and when you confirmed your subscription (double opt-in).
• You can unsubscribe at any time with the link in every email.

Legal basis: your consent. Withdrawing it does not affect earlier processing.

Contact form

• Your name, email address and message, so we can reply.
• The IP address the message was sent from, to prevent spam and abuse.

Legal basis: our legitimate interest in answering questions and keeping the form free of abuse.

Push notifications

• If you turn notifications on, your browser gives us a push subscription (an address at your browser's push service and encryption keys), linked to your account when you are signed in.
• You can turn notifications off at any time in Settings or in your browser.

Legal basis: your consent.

Technical and security logs

• When something goes wrong we log technical details such as the page, the error message and, if you are signed in, your account ID, so we can fix it.
• Short-lived counters keyed to your email or IP address limit repeated requests (rate limiting).

Legal basis: our legitimate interest in running a secure and reliable service.

Cookies

• Necessary (always on): a session cookie to keep you signed in, and a setting in your browser that remembers your light or dark theme, and the cc_cookie cookie, which remembers your cookie choice for 6 months.
• Analytics, only if you accept: the Google Analytics cookies _ga and _ga_*, kept for up to 2 years.
• Analytics, only if you accept: the Microsoft Clarity cookies _clck (up to 1 year) and _clsk (1 day).
• Marketing, only if you accept: advertising cookies set through Google Tag Manager, such as _gcl_*, kept for up to 90 days.

We ask before using any cookie that is not strictly necessary. Nothing in the analytics or marketing categories loads until you accept it, and you can change your choice at any time with the Cookie settings link at the bottom of every page. If you withdraw consent, we remove those cookies.

Who we share data with

• Cloudflare (hosting, database, content delivery and security).
• Resend (sending email, for example sign-in links and confirmations, and marketing email).
• Stripe (payments). Stripe is also an independent controller for some data, such as fraud prevention.
• Google (Tag Manager, analytics and advertising measurement, only with your consent).
• Microsoft (Clarity session analytics, only with your consent).
• The push service of your browser vendor (for example Google, Mozilla or Apple), which delivers notifications.
• Mirra Launch, which keeps contact messages in our inbox and emails them to us.

We do not sell your data. We use these service providers (processors) to run the service:

International transfers

Some providers process data outside the UK and the European Economic Area. Where they do, we rely on adequacy decisions or the standard contractual clauses (and the UK addendum) to protect it.

How long we keep data

• Account data and your content: while your account exists. When you ask us to delete your account, we delete it within 30 days, except where the law requires us to keep records.
• Unpaid previews: deleted after 14 days.
• Paid copies: hosted for 12 months from payment, then deleted unless renewed.
• Order and payment records: 6 years after the end of the financial year they belong to, as UK tax law requires.
• Marketing contact details: until you unsubscribe and ask us to delete them.
• Newsletter: until you unsubscribe.
• Contact messages: up to 2 years, then deleted.
• Technical logs: up to 30 days.

Your rights

Under the UK GDPR and the EU GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent you can withdraw it at any time. Contact us by email at hello@mirratech.co; we reply within one month.

You can also complain to a data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), in the EU the authority in your country.

Children

Lifeboat is not intended for anyone under 16, and we do not knowingly collect their data. If you think someone under 16 has given us personal data, contact us and we will delete it.

Changes to this page

We will update this page when our practices change. Last updated 9 November 2026 (Mirra standard terms version 1.0).