1. Who We Are
This Privacy Policy explains how Pokka Services Oy ("Mirame," "we," "our," or "us"), based in Rovaniemi, Finland, collects, uses, discloses, and protects personal data when you use the Mirame mobile application, the mirame.dev website, and related services (collectively, the "Service").
Pokka Services Oy is the data controller responsible for your personal data under the EU General Data Protection Regulation ("GDPR") and applicable Finnish data protection law.
This Policy should be read together with our Terms of Use, which it is incorporated into by reference.
2. Data We Collect
2.1 Account Information. When you create an account: your name, email address, password (stored in hashed form), and any profile details you choose to add.
2.2 Visual Content and Biometric Data. Photos or images you upload of yourself to generate virtual try-on renders, fit scores, and styling recommendations ("Visual Content"). Visual Content may include images of your face and body, from which our AI systems derive measurements, proportions, and other characteristics used to render outfits and predict sizing. This constitutes biometric data under Article 9 GDPR (and under U.S. state biometric privacy laws such as the Illinois Biometric Information Privacy Act, for users in those jurisdictions), and we treat it as a special category of personal data requiring your explicit consent - see Section 4.
2.3 Wardrobe and Preference Data. Items you add to your digital wardrobe/virtual closet (photos, tags, brand, category, size, color), style preferences, saved outfits, favorited items, and budget settings.
2.4 Third-Party Retailer Data. Product URLs you paste into the app, and the garment data (images, size guide, price) we fetch from that URL on your behalf.
2.5 Subscription and Payment Data. We do not directly process your payment card details - purchases are handled by Apple's App Store (and, when available, Google Play). We receive limited transaction confirmation data (e.g., subscription tier, status, renewal date) from these platforms, governed by their respective privacy policies.
2.6 Usage and Device Data. App interactions, feature usage, crash logs, device type, operating system, and general (non-precise) location inferred from IP address, collected via our analytics provider (see Section 7).
2.7 Communications. Information you provide when you contact support (e.g., support.mirameapp@gmail.com), including the content of your message and any attachments.
3. How We Use Your Data
We use your data to:
- Create and maintain your account;
- Generate AI Outputs (virtual try-on renders, fit scores, size predictions, outfit recommendations) from your Visual Content and wardrobe data;
- Import and display garment data from third-party retailer links you provide;
- Process and manage your Subscription;
- Provide customer support;
- Maintain, secure, and improve the Service, including diagnosing technical issues;
- Understand feature usage through aggregated analytics (see Section 7); and
- Comply with legal obligations and enforce our Terms of Use.
We do not use your identifiable Visual Content for advertising or marketing purposes, and we do not train general-purpose AI models on your identifiable Visual Content, unless you separately and affirmatively opt in to such use.
4. Legal Basis for Processing (GDPR)
We process your personal data under the following legal bases:
| Data | Legal Basis |
|---|---|
| Account creation, Subscription management | Performance of a contract (Art. 6(1)(b) GDPR) |
| Visual Content / biometric data | Explicit consent (Art. 9(2)(a) GDPR) |
| Usage analytics | Legitimate interest in improving the Service (Art. 6(1)(f) GDPR) |
| Security, fraud prevention, legal compliance | Legal obligation / legitimate interest (Art. 6(1)(c), 6(1)(f) GDPR) |
4.1 Explicit Consent for Biometric Data. Because Visual Content constitutes biometric data, we obtain your explicit, informed, opt-in consent before processing it - presented at the point of upload, separate from your general acceptance of these Terms. You may withdraw this consent at any time by deleting your Visual Content and/or your account (Section 8). Withdrawing consent will prevent the Service's core AI features from functioning, since they require Visual Content to operate.
5. Sharing Your Data
We do not sell your personal data. We share data only as follows:
5.1 Service Providers (Sub-Processors).
- Supabase - our database, authentication, and file storage infrastructure provider, which hosts your account data and Visual Content, in the EU region.
- AI processing providers - the underlying AI model provider(s) used to generate try-on renders, fit scores, and styling outputs, under data processing agreements that prohibit using your content to train their models.
- Analytics provider - used to understand feature usage and app performance in aggregate/pseudonymized form.
- Apple (App Store) and Google (Play Store, when applicable) - for billing, subscription management, and app distribution, governed by their own privacy policies.
A current list of sub-processors, including each provider's name and hosting region, is available on request at support.mirameapp@gmail.com.
We enter into data processing agreements with each sub-processor consistent with Article 28 GDPR, requiring them to process your data only on our instructions and to apply appropriate security measures.
5.2 Legal Disclosures. We may disclose data if required by law, legal process, or governmental request, or to protect the rights, property, or safety of Mirame, our users, or others.
5.3 Business Transfers. If Mirame is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction, subject to this Policy or a policy offering at least equivalent protection.
5.4 Third-Party Sharing You Initiate. If you use the in-app share feature to export an AI Output to Instagram, Snapchat, or another third-party platform, that export is initiated by you and governed by that platform's own privacy policy - we have no visibility into or control over that platform's subsequent handling of the content. See also Terms of Use, Section 6.5.
6. International Data Transfers
Mirame is based in Finland (EU/EEA). Where any sub-processor (including Supabase, our AI processing provider(s), or our analytics provider) stores or processes personal data outside the EU/EEA - for example, in the United States - we rely on an appropriate safeguard, such as the European Commission's Standard Contractual Clauses (SCCs), an adequacy decision, or an equivalent lawful transfer mechanism, and we take supplementary measures where necessary. Details of specific transfer safeguards for each sub-processor are available on request at support.mirameapp@gmail.com.
7. Cookies and Analytics
We use analytics tools (no advertising trackers) to understand how the Service is used, in aggregated or pseudonymized form where possible. On our website (mirame.dev), we may use cookies or similar technologies for essential site functionality and analytics. You can control cookies through your browser settings; disabling them may affect site functionality. We do not use third-party advertising trackers or share data with ad networks.
8. Data Retention
8.1 General Principle. We retain personal data only for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.
8.2 Visual Content and Account Deletion. When you delete Visual Content or your account, we remove it from active production systems within 30 days. Residual copies may remain in encrypted backups until routine backup cycling purges them, within 90 days at the latest.
8.3 Retention After Account Closure. Following account closure, we may retain limited data (e.g., transaction records, support correspondence) for as long as required by applicable tax, accounting, or legal obligations, typically not exceeding the statutory limitation period under Finnish law.
9. Your Rights
9.1 GDPR Rights (EU/EEA Users). You have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten"), subject to Section 8;
- Restrict or object to certain processing;
- Data portability, for data you provided to us;
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal; and
- Lodge a complaint with your local data protection authority - in Finland, the Office of the Data Protection Ombudsman (tietosuoja.fi).
To exercise these rights, contact us at support.mirameapp@gmail.com. We will respond within the timeframe required by applicable law (generally one month under GDPR).
9.2 California and Other U.S. State Privacy Rights. If you are a resident of California or another U.S. state with a comprehensive privacy law, you may have rights to know what personal data we collect, request deletion, correct inaccuracies, and opt out of certain processing. We do not sell personal data or engage in behavioral advertising. To exercise these rights, contact support.mirameapp@gmail.com.
9.3 Biometric Privacy Notice (Illinois, Texas, Washington, and similar jurisdictions). If you are a resident of a U.S. state with a specific biometric privacy law, we provide this notice: we collect biometric identifiers (facial/body-derived data from your Visual Content) solely to provide the virtual try-on and styling features you request; we do not sell, lease, trade, or otherwise profit from your biometric data; we do not disclose it except to the service providers described in Section 5 as necessary to operate the Service, or as required by law; and we retain it only as described in Section 8, after which it is permanently destroyed.
10. Children's Privacy
The Service is not directed to, and we do not knowingly collect personal data from, anyone under 16 years of age, consistent with the eligibility requirement in our Terms of Use. If we learn that we have inadvertently collected personal data (including Visual Content) from a user under 16, we will delete that data promptly and terminate the associated account. If you believe a child under 16 has provided us with personal data, please contact support.mirameapp@gmail.com.
11. Automated Processing
Fit scores, size predictions, and outfit recommendations generated by our AI features are automated outputs. These are provided as suggestions to assist your own decision-making and do not produce legal or similarly significant effects about you - for example, we do not use these outputs to make automated decisions about your eligibility for any service, credit, or opportunity. You always retain full control over whether to act on any AI Output.
12. Data Security
We implement technical and organizational measures designed to protect your personal data, including encryption in transit, access controls, and secure infrastructure via our hosting provider. No system is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify affected users and relevant authorities as required by applicable law (including within 72 hours to the Finnish Data Protection Ombudsman where required under Article 33 GDPR).
13. Data Protection Contact
Questions about how we handle personal data, including requests relating to biometric data, can be sent to support.mirameapp@gmail.com and are handled by Pokka Services Oy's data protection contact. Should the appointment of a Data Protection Officer become required under Article 37 GDPR, this section will be updated with their contact details.
14. Changes to This Policy
We may update this Privacy Policy from time to time. If changes are material, we will provide reasonable notice (e.g., in-app notice or email) before they take effect, and, where required by law, seek renewed consent for any new processing of biometric data. Continued use of the Service after the effective date of a revised Policy constitutes acceptance.
15. Contact Us
Pokka Services Oy, Rovaniemi, Finland
Support Email: support.mirameapp@gmail.com
For GDPR-related inquiries, you may also contact the Finnish Office of the Data Protection Ombudsman (tietosuoja.fi) if you believe your rights have not been respected.
© 2026 Mirame. Operated by Pokka Services Oy. All rights reserved.