Privacy Policy

Last updated: May 22, 2026

Mirrion Finance ("we", "us", "our") is committed to protecting your personal information. This policy explains what data we collect, how we use it, and your rights.

1. Information We Collect

Account information: Your email address and password (stored and managed by Supabase Auth).
Profile information: Optional details you provide such as occupation, income band, and financial goals — used only to personalise your financial story.
Bank transaction data: When you connect a bank account, Plaid retrieves your transaction history on our behalf. We store date, amount, merchant name, and category. We never store your bank login credentials.
Payment information: Subscription and billing data managed by Stripe. We do not store raw card numbers.
Usage data: AI chat queries you submit (stored to show you chat history and enforce fair-use limits).

2. How We Use Your Information

To provide and personalise the Mirrion Finance service — reports, archetype, AI chat.
To process subscription payments via Stripe.
To send transactional emails (account confirmation, receipts). We do not send marketing email without your consent.
To improve the product — only in aggregate, anonymised form.

3. AI Processing

When you ask a question in AI chat, we send aggregated financial summaries and a list of your recent transactions (date, amount, merchant, category) to Google's Gemini model via Vertex AI. We do not send your raw bank descriptions, account numbers, or personally identifying information to the AI. Google processes this data subject to their Cloud Data Processing Addendum.

4. Data Sharing

We do not sell your personal data. We share it only with the following service providers, strictly for operating the service:

Plaid — bank connection and transaction retrieval
Supabase — database and authentication infrastructure
Stripe — payment processing
Google Cloud (Vertex AI) — AI chat processing

5. Data Retention

We retain your data for as long as your account is active. If you delete your account, your data is soft-deleted immediately and permanently purged within 30 days. You can request deletion at any time by emailing privacy@mirrion.finance.

6. Security

Bank access tokens are AES-256-GCM encrypted at the application layer before storage. Authentication uses httpOnly, Secure, SameSite=Lax cookies. We follow industry-standard practices, but no system is 100% secure — please use a strong, unique password.

7. Your Rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data. Contact us at privacy@mirrion.finance and we will respond within 30 days.

8. Children

Mirrion Finance is not directed at children under 13. We do not knowingly collect data from anyone under 13.

9. Changes to This Policy

We may update this policy from time to time. We'll post the updated version here with a new "Last updated" date. Continued use of the service after changes constitutes acceptance.

10. Contact

Questions? Email privacy@mirrion.finance.