Privacy Policy

This Privacy Policy explains how UpLevel Technologies LLC, a California limited liability company ("M1rror", "we", "us" or "our"), collects, uses, shares and protects personal data when you visit m1rror.com, use the M1rror web application, the M1rror MCP server, the M1rror GitHub App or the M1rror Figma plugin, or otherwise interact with us (together, the "Service"). It also explains the choices and rights you have.

M1rror is a business product. If you use the Service through a workspace that your employer or another organisation set up, that organisation's own policies may also apply to you.

1. Our role: controller and processor

• Where we are the controller. We decide how and why personal data is processed for your account, sign-in and security, billing, our communications with you, our website, and the product usage data we use to run and improve the Service. For that data, UpLevel Technologies LLC is the controller (or "business" under California law).

• Where we are a processor. The content that a workspace's members put into the Service (references, comments, designs, repository code and other workspace content, including any personal data in it) is processed on behalf of the customer that owns the workspace. For that content we act as a processor (or "service provider" under California law) and follow the customer's instructions, as set out in our Terms of Service and our Data Processing Addendum. If you have a question or request about workspace content, please contact the workspace's owner; we will help them respond.

2. Personal data we collect

Account information. When you create an account: your name, email address and password. We store only a one-way hash of your password, never the password itself. If you turn on two-factor authentication, we store the secret needed to check your codes and hashed backup codes.

Sign-in and security data. For each signed-in session we record the session's IP address and browser user agent, so you can review your sessions and we can protect your account. To limit abuse, we keep short-lived counters keyed to IP addresses for sign-in, sign-up and request rate limits.

Workspace and membership information. The workspaces you belong to, your roles, invitations you send or receive (including the invitee's email address) and agent access grants you create.

Workspace content. What you and your team put into the Service: references (uploaded images, video and links, with the rights information you record), board notes, comments, prompts and conversations with the design agent, attachments, design tokens, components, screens, translations, store listings, releases, approvals and reviews. Workspace content may include personal data, for example names in comments.

Review guests. If someone shares a review link with you, we collect the name and email address you give us, a one-time code we send you, and the review decisions you record.

Repository content. If a workspace connects a GitHub repository through the M1rror GitHub App, we read the repositories it grants access to, store a copy of the commit we analyse and keep the analysis results, which can include commit and pull request authors' GitHub usernames.

Connected services. If a workspace connects Figma, Mobbin, App Store Connect or Google Play, we store the access credential it provides (encrypted) and the data it chooses to import or publish.

Billing information. Payments are processed by Stripe. Card details and billing addresses are entered directly into Stripe Checkout and the Stripe customer portal. We receive and store your Stripe customer and subscription identifiers, plan and seat details, invoice and payment records, credit purchases, and the billing details Stripe sends us about payments (such as the billing name, email address and address). We never receive or store full card numbers.

Usage data. Records of the runs you start and the usage units and credits they consumed; an audit log of actions taken in a workspace (who did what, and when); and a small set of product events, each an allowlisted event name with a few small values. Product events never contain your prompts, source code, URLs, comments or screenshots, and are not linked to your IP address or browser.

Sign-up attribution. If you arrive at our website from a campaign link or another website, we note the campaign parameters (such as utm_source), the referring website's domain and the page you landed on, and attach them to your account if you sign up. We skip this entirely when your browser sends a Global Privacy Control or Do Not Track signal. See section 9.

Error reports. When something fails in our servers, or in your browser while you use the Service, we record the type of error, its message and code location, the service and page path (without query strings), the browser family and the time. Before an error is stored we remove tokens, credentials, email addresses, IP addresses, query strings and other long identifiers, and we never record request bodies, cookies, headers or who you are.

Communications. Emails we send you and their delivery status, and the messages you send us, for example when you contact support or make a privacy request.

We do not collect sensitive personal data such as health, biometric or financial account data, other than your account password (stored only as a hash) and the payment data Stripe processes for us. Please do not put sensitive personal data into workspace content unless it is necessary.

3. How we use personal data and our legal bases

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases under the GDPR and UK GDPR (Article 6):

Where we rely on legitimate interests, we have balanced them against your rights and you can object as described in section 10. We do not use personal data for automated decision-making that produces legal or similarly significant effects on you.

Marketing. We do not currently send marketing emails. If we start, we will ask for your consent where the law requires it, and every marketing email will include a way to unsubscribe. Notification emails can be turned off in Settings → Notifications, and each one includes an unsubscribe link.

4. AI features

• We do not use your content to train AI models. Workspace content is used to provide the Service to your workspace only.

• Design agent and other language features. The design agent, design directions, reference analysis, translations and similar features use Anthropic's Claude models through Anthropic's commercial API. When you use them, the message, the context you attach and the project information the feature needs are sent to Anthropic to generate a response. A reference is sent to a model only if it has been marked as allowed to be sent to a model; uploaded references are not allowed by default. Repository code is sent for AI-generated component previews only when the project's settings allow it. Anthropic's commercial terms do not permit it to train its models on content we send through its API.

• Image, vector and video generation. Generation runs on fal.ai. When you start a generation, its prompt, settings and any images you choose as input are sent to fal.ai, and the results are stored in your workspace. fal.ai processes this content to provide the generation service under its own terms, which allow it to use anonymised or aggregated usage data.

• Sandboxes. Implementation runs and component previews run your repository in an isolated, disposable E2B sandbox for that run only, with outbound network access restricted.

5. How we share personal data

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share personal data only as follows.

Service providers (subprocessors). We use the following providers to run the Service. They process personal data on our behalf, under contracts that limit their use of it to providing their services to us:

We do not use third-party analytics, advertising or tracking services, and error reports stay in our own database. If we add a subprocessor, we will update this list before it processes personal data, and notify customers who have signed our Data Processing Addendum as it provides.

Services a workspace connects. If a workspace connects GitHub (through the M1rror GitHub App), Figma, Mobbin, App Store Connect or Google Play, we exchange data with that service as needed to read or publish what the workspace chooses. Those services process the data under their own terms and privacy policies. When you search for icons, we send the icon names and search terms (never personal data) to the public Iconify icon service.

Within your workspace. Content you add to a workspace, and your name and email address, are visible to its other members according to their roles. Review guests see what the review link shares. Workspace owners can export the workspace's member list and records.

Legal and safety. We may disclose personal data if we believe in good faith that it is required by law or legal process, or necessary to protect the rights, property or safety of our users, the public or us, including to prevent fraud or abuse.

Business transfers. If we are involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of that transaction, subject to this Privacy Policy, and we will notify you of any change in the controller.

6. International transfers

We are based in the United States, and we and our service providers process personal data in the United States and in other countries where they operate. These countries may not have the same data protection laws as your country. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we use the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with additional safeguards where appropriate. You can request a copy of the relevant safeguards at [email protected].

7. How long we keep personal data

We keep personal data only as long as needed for the purposes described above, and then delete or de-identify it.

We may keep data longer where the law requires it or where it is needed to establish, exercise or defend legal claims.

8. Security

We protect personal data with administrative, technical and physical safeguards appropriate to the risk, including: encryption in transit with TLS; encryption of integration credentials at rest with AES-256-GCM; storing passwords, agent and API access tokens, invitation tokens, review-link passcodes and one-time codes only as hashes; strict separation of each customer's data; role-based access control checked on every action; running customer code only in isolated, disposable sandboxes with restricted network access; limited, least-privilege staff access with step-up authentication for sensitive actions; and audit logging of administrative actions. You can protect your account with two-factor authentication. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities as the law requires. You can report a vulnerability to [email protected].

9. Cookies and similar technologies

We use only what the Service needs to work, plus first-party sign-up attribution:

• Strictly necessary cookies. A session cookie keeps you signed in (it lasts up to 7 days and is renewed while you use the Service), and short-lived cookies support two-factor sign-in and review links (a guest's verified session and a link's passcode). These cookies are required for the Service to work.

• Preferences in your browser's local storage. Settings such as your theme, panel layout, dismissed tips and unsaved drafts are stored in your browser so the Service remembers them. They are not sent to us for tracking.

• First-party sign-up attribution. If you arrive from a campaign link or another website, we keep the campaign parameters, referring website and landing page only in the open page and in the address of our sign-up link, never in cookies or your browser's storage, and attach them to your account only if you sign up in that browser tab. This is not shared with anyone. It is skipped when your browser sends a Global Privacy Control or Do Not Track signal, and it is forgotten when you close the tab.

We do not use advertising cookies, third-party analytics or tracking scripts, or social media pixels, and our pages load no third-party scripts or fonts.

10. Your rights and choices

Everyone. Wherever you live, you can:

• update your display name in Settings → Your account, and turn notification emails on or off in Settings → Notifications (to change the email address on your account, contact us);

• download a copy of your account data from Settings → Your account;

• delete your account from Settings → Your account (if you are the only owner of a workspace, first make another member an owner or delete the workspace);

• disconnect GitHub, Figma, Mobbin, App Store Connect or Google Play at any time; and

• contact us at [email protected] for any other request, including a complete copy of the personal data we hold about you.

EEA, UK and Switzerland. You have the right to access, correct, delete or receive a portable copy of your personal data; to restrict or object to our processing of it, including processing based on legitimate interests; and, where we rely on consent, to withdraw it at any time without affecting earlier processing. You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to address your concern first.

California and other US states. If you are a resident of California or another US state with a comprehensive privacy law, you have the right to know what personal information we collect, use and disclose; to access and receive a portable copy of it; to correct it; to delete it; and to opt out of its sale, its sharing for cross-context behavioural advertising, and profiling with legal or similarly significant effects. We do not sell or share personal information, have not done so in the past 12 months, do not profile in that way, and do not knowingly sell or share the personal information of anyone under 16. We use sensitive personal information (your account login credentials) only to provide and secure the Service, so the right to limit its use does not apply. We will not discriminate against you for exercising your rights. You may use an authorised agent to make a request, and where your state provides one, you may appeal our decision by replying to it.

In the past 12 months we have collected these categories of personal information, from you, your organisation, the services you connect and your browser: identifiers (name, email address, IP address, account identifiers); customer records (billing name and address); commercial information (plans, purchases and payments); internet or other electronic network activity (sessions, product events, sign-up attribution and error reports); professional information (workspace memberships and roles, and content you contribute); and sensitive personal information (account login credentials). We collect them for the business purposes described in section 3, disclose them only to the recipients in section 5, and keep them for the periods in section 7.

Making a request. Email [email protected]. We will verify your request, usually by confirming it from the email address on your account, and respond within one month (EEA and UK) or 45 days (California and other US states), extendable where the law allows, in which case we will tell you why. Requests about workspace content are handled together with the workspace's owner, as described in section 1.

11. Children

The Service is for businesses and professionals and is not directed to children. You must be at least 18 to create an account. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact [email protected] and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy here and change the "Last updated" date above. For material changes, we will notify account holders by email or in the product at least 30 days before the changes take effect, unless a change is required sooner by law.

13. Contact us

UpLevel Technologies LLC, a California limited liability company, is the controller of the personal data described in this policy.

• Privacy questions and requests: [email protected]

• Legal notices and Data Processing Addendum requests: [email protected]

• Security vulnerability reports: [email protected]