This Privacy Policy describes how Trekeffect Incorporated doing business as Mirin ("Company," "we," "us," or "our"), collects, uses, and protects your personal information when you use our platform services ("Services"). Our Services include:
- Subscription Website Services: Pre-built websites for blue-collar professionals hosted on mymirin.com with optional custom domain support
- E-commerce Platform Services: Full-featured e-commerce solutions with revenue-sharing arrangements for select clients
- Initial Design Services: Custom homepage redesigns for prospective subscription customers to review
- Free Website Scorecard Tool: AI-powered website performance analysis available at mirin.com/scorecard, which collects your website URL and email address to generate and deliver scorecard reports
We are committed to protecting your privacy and being transparent about our data practices. This Policy applies to all users of our Services and describes your privacy rights under applicable United States privacy laws, including Connecticut state privacy laws.
No Protected Health Information (PHI)
Mirin is not offered as a service for processing protected health information, and we do not offer a Business Associate Agreement for these features. Do not submit PHI through forms, chat, document attachments, images or website URLs. Submit only a public business homepage or directory profile for a scorecard. Free-form inputs can contain information we did not request, so this restriction is not a guarantee that prohibited information is automatically detected or removed.
Information We Collect
Information You Provide Directly
- Account Information: Name, email address, business name, phone number, and other details you provide when registering
- Profile Information: Additional details you choose to add to your account profile
- Business Data: For subscription customers: business information, custom domain details, subdomain preferences, and website content
- Done-For-You Project Data: For Done-For-You Website Services customers: intake form responses, business information, service descriptions, photos and images you provide, brand guidelines, and any other materials submitted for your website project
- Project Communications: Emails, messages, revision requests, and other communications related to your Done-For-You Website project
- E-commerce Data: For revenue-share clients: product information, customer data, sales data, and other content uploaded to the platform
- Lead Information: Contact information submitted through lead capture forms on customer websites, stored in our database and accessible to website owners through their dashboard
- Payment Information: Billing address and payment method details processed securely through Stripe
- Device Authorization: When you sign in to the Mirin desktop app or the Mirin mobile app, device identifiers and authorization tokens that keep you signed in on that device. For the mobile app we also record the device name you have given your phone, whether it runs iOS or Android, the app version, and when it was last used, so that you can see your signed-in devices and remove any of them from the app
- Push Notification Tokens: If you allow notifications in the Mirin mobile app, a push token issued by Apple or Google that lets us alert you when a visitor messages your website. Push tokens are used only to deliver those alerts and are never used for advertising or shared with advertisers. Turning notifications off in your phone settings, or signing the device out, removes the token
- Website Audit Data: When you use our free website audit tool, we collect the website URL you submit and your email address to generate and deliver your audit report
- Communications: Messages, support requests, and other communications with us
- AI Inputs and Activity: Instructions, relevant conversation and page context, attached document text and metadata, generated content, and usage and billing records as described in Section 11
Information We Collect Automatically
- Usage Data: Pages visited, features used, time spent on our platform, and interaction patterns
- Device Information: IP address, device type, operating system, browser type and version
- Location Information: General location based on IP address for service optimization and security
- Log Data: Server logs, error reports, and system performance data
- Cookies and Tracking: Information collected through cookies and similar technologies (see our Cookie Policy)
Information from Third Parties
- Integration Data: Information from third-party services you connect to our platform
- Analytics Services: Data from analytics providers about your use of our Services
- Security Services: Information from security providers for fraud detection and prevention
- Sign In with Google: The email address on the Google account you choose, when you sign in with Google, as described below
Connected Services
When you connect an account such as Google, Microsoft, Calendly, Shopify, Square, Wix, BigCommerce or Stripe, you sign in with that service and approve what Mirin may read. Mirin uses that access only to provide the features you turned on, such as showing your analytics, bringing in your products, reading a calendar or a file you picked, or taking payments. Mirin does not use that data to serve advertising, does not sell it, and does not use it to train general AI models. You can disconnect at any time in Settings, Connectors, and choose whether to keep or remove what was already brought in.
Mirin's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. People at Mirin do not read that data except with your permission, for security purposes, to comply with applicable law, or when it has been aggregated and anonymized for internal operations.
Sign In with Google
If you choose Continue with Google, Google tells us the email address on the Google account you pick, whether Google has confirmed that address, and, for a Google Workspace account, the domain of the organization that manages it. Google also sends an identifier for the account, which we do not keep.
We use this only to find your existing Mirin account and sign you in, or to confirm that you own the email address a website was made for. We do not receive your Google password. We do not ask Google for your name, profile picture, contacts, mail, calendar or files. We do not sell this information, share it for advertising, or use it to build a profile of you.
We keep a record that a sign in happened through Google, with the email address, the time, your IP address and your browser, in the same security log as every other sign in. You can sign in with a link sent to your email instead at any time, and you can remove Mirin from your Google Account under Third-party apps and services in your Google Account settings.
Sign In with Apple
If you choose Continue with Apple, Apple tells us an identifier for your Apple Account and, if you choose to share it, the email address on that account and whether Apple has confirmed it. If you choose Hide My Email, Apple gives us a relay address in its place. We do not use the relay address. We ask you for the email address you use with Mirin instead.
We keep Apple's identifier beside your Mirin account so that Apple can sign you in the next time. We use what Apple tells us only to find your Mirin account, sign you in, or start your account when you are new. We do not receive your Apple password. We do not ask Apple for your name, contacts, photos or files. We do not sell this information, share it for advertising, or use it to build a profile of you.
We keep a record that a sign in happened through Apple, with the time, your IP address and your browser, in the same security log as every other sign in. You can sign in with a link sent to your email instead at any time, and you can stop using Apple to sign in under Sign in with Apple in your Apple Account settings. Deleting your Mirin account removes Apple's identifier from our records.
Categories Under California Privacy Law
For California residents, the personal information we collect maps to the following statutory categories defined by the CCPA, as amended by the CPRA:
- Identifiers: Name, email address, IP address, device identifiers, cookie IDs
- Customer records: Phone number, billing address, business name
- Commercial information: Subscription history, payment records, products and services purchased
- Internet or network activity: Browsing history on our Services, page interactions, and scorecard activity
- Geolocation data: Approximate location derived from IP address (we do not collect precise geolocation as defined under CPRA)
- Inferences: Audience profiles derived from your activity for marketing optimization
Sensitive Personal Information
We process authentication information needed to secure your account. Our content and AI tools are not intended for sensitive personal information such as government identifiers, health records or financial credentials. Do not put that information into content, messages or attachments. User-submitted material can nevertheless contain personal or sensitive information. Contact us if you need to request its removal or exercise applicable privacy rights.
How We Use Information
Service Provision
- Provide, maintain, and improve our platform services (subscription websites and e-commerce solutions)
- Process subscription payments and manage billing through Stripe
- Host websites on mymirin.com subdomains and support custom domain routing
- Generate and provide an Initial Design of a homepage for prospective customers to review
- Process lead capture form submissions and deliver them to website owners
- For Done-For-You Website Services: design and develop custom websites using the information and materials you provide during the intake process
- For Done-For-You Website Services: communicate with you about your project, process revision requests, and deliver the completed website
- For e-commerce clients: facilitate product catalog management, order processing, and email marketing
- Manage revenue-sharing arrangements for applicable client accounts
- Display completed websites in our portfolio and marketing materials (as described in our Terms of Service)
Communication and Support
- Respond to your requests, questions, and provide customer support
- Store support conversations, attachments, and the diagnostic or build information you provide so we can investigate requests. Build history and AI conversations are distinct from a message sent to support
- Deliver optional device notifications using subscription identifiers and delivery metadata when you enable them. You can turn notifications off through the available app or device controls
- Send service announcements, updates, and security notifications
- Deliver marketing communications (with your consent where required)
- Conduct user surveys and gather feedback
Analytics and Improvement
- Analyze usage patterns to improve our Services and develop new features
- Conduct A/B testing and performance optimization
- Generate aggregated analytics and business intelligence
- Monitor system performance and troubleshoot technical issues
Security and Compliance
- Protect against fraud, abuse, and security threats
- Enforce our Terms of Service and other policies
- Comply with legal obligations and respond to legal requests
- Conduct security monitoring and incident response
Information Sharing and Disclosure
We do not "sell" your personal information for monetary consideration. However, under the California Privacy Rights Act (CPRA), the term "share" is defined more broadly to include disclosure of personal information to third parties for cross-context behavioral advertising. As described below, our use of advertising and analytics technologies (Meta Pixel and Google Ads) may meet that "sharing" definition. California residents (and residents of other states with similar laws) have the right to opt out — see Section 6.
Service Providers
We work with trusted third-party service providers who help us deliver our Services. These providers are bound by contractual obligations limiting their use of personal information to the services they perform for us:
- Cloud Hosting and Infrastructure: Google Cloud Platform for application hosting, managed databases, secret management, and monitoring; Cloudflare for DNS, content delivery, R2 object storage, custom hostname automation, and edge security; Amazon Web Services for email delivery and selected legacy or supporting services where still used during the migration
- Payment Processing: Stripe for secure payment processing and subscription billing. We do not store complete payment card information on our servers
- Email Services: Transactional and outbound email providers (including Amazon SES) for delivering account, lead, and nurture emails
- Product Analytics: PostHog for self-hosted product usage analytics, session events, and feature adoption metrics
- Marketing Analytics and Advertising: Google Analytics 4 (GA4) for website usage analytics; Meta Pixel (Facebook / Instagram) and Google Ads conversion tracking for measuring advertising effectiveness and building remarketing audiences. These services may receive your IP address, page and event activity, and a hashed version of your email address. See "Sharing for Cross-Context Behavioral Advertising" below for the CPRA disclosure
- AI Processing: OpenRouter and the model providers it routes requests to process the instructions and relevant context needed for AI features. Provider choice and retention policy can vary by feature and route. See Section 11 for the information involved and retention limits
- Security: Fraud detection and security monitoring services
- Customer Support: Help desk and support management tools
Sharing for Cross-Context Behavioral Advertising
We use Meta Pixel and Google Ads conversion tracking to measure ad campaign performance and reach potential customers on those platforms. These tools may receive identifiers (such as IP address, device identifiers, hashed email, and event activity) that allow Meta and Google to match your visit to their own user records and serve you personalized ads on their networks and partner properties. Under the CPRA, this disclosure meets the definition of "sharing" personal information for cross-context behavioral advertising, even though we receive no monetary consideration in exchange. You may opt out of this sharing at any time using the mechanism described in Section 6.
Business Transfers
If we are involved in a merger, acquisition, or asset sale, your personal information may be transferred as part of that transaction. We will provide notice before your information becomes subject to different privacy practices.
Legal Requirements
We may disclose your information if required to do so by law or in response to valid requests by public authorities, including to meet national security or law enforcement requirements.
Protection of Rights
We may disclose information when we believe it is necessary to investigate, prevent, or take action regarding potential violations of our Terms of Service, suspected fraud, situations involving potential threats to the safety of any person, or illegal activities.
Data Security
We implement security measures appropriate to our size and the nature of our Services to protect your personal information:
- Encryption in Transit: All data transmitted to and from our Services is encrypted using industry-standard TLS protocols
- Secure Infrastructure: Our Services use Google Cloud Platform, Cloudflare, and Amazon Web Services where applicable. These providers maintain SOC 2, ISO 27001, and other security certifications
- Access Controls: Limited personnel access to production systems with authentication requirements
- Regular Backups: Automated backups and snapshots with retention configured by service and environment
- Secure Authentication: JWT-based authentication tokens for user sessions
- Payment Security: All payment processing is handled by Stripe; we do not store complete payment card information
As an early-stage company, we continuously work to improve our security practices. While we strive to protect your personal information, no security system is impenetrable. We cannot guarantee the absolute security of your data transmitted through our Services.
Data Retention
We retain your personal information for different periods based on the type of data and our business needs:
- Active Account Information: Retained while your account is active and after cancellation unless you explicitly request deletion. Valid deletion requests remain subject to legal, security, fraud-prevention, backup, and operational retention requirements
- Lead Capture Form Data: Stored in our database and accessible through your dashboard until you delete it or your account is terminated. Lead data is deleted within 30 days of account termination
- Subscription Data: Retained after cancellation unless you explicitly request deletion, subject to the retention requirements described here. Transaction, billing, and contract records follow the separate retention period below
- Done-For-You Project Data: Intake form responses, project communications, and design assets you provide are retained for the duration of your project plus 1 year after project completion. This allows us to reference your materials if you return for additional services or support
- Project Files and Deliverables: Retained while your hosting subscription is active and after cancellation unless you explicitly request deletion, subject to the retention requirements described here. Retention does not guarantee that a prior site, account configuration, or data can be restored if you return
- Analytics Data: Individual-level data for 1 year; aggregated data for 2 years
- Transaction, Billing, and Contract Records: Payment records and versioned agreement or consent evidence are retained for 7 years to meet tax, audit, contract, and legal requirements
- System Logs: 90 days for security monitoring and troubleshooting
- Customer Support Records: 3 years for service improvement and legal purposes
Backup Retention: Deleted data may persist in encrypted backups for up to 15 days before being automatically purged through our rolling backup system.
We may retain certain information for longer periods where required by law or for legitimate business purposes such as fraud prevention.
Your Privacy Rights
General Rights
You have the following rights regarding your personal information:
- Access: Request a copy of the personal information we hold about you
- Correction: Request correction of inaccurate or incomplete personal information
- Deletion: Request deletion of your personal information (subject to legal retention requirements). How to delete your Mirin account
- Portability: Request a copy of your data in a machine-readable format
- Opt-out: Opt out of marketing communications at any time
State-Specific Rights
Connecticut Residents (CTDPA)
Connecticut residents may exercise the rights below. Statutory rights under the Connecticut Data Privacy Act depend on the law's coverage and the context in which information is processed. We also provide the general rights described above:
- Right to confirm whether we are processing your personal data
- Right to access your personal data
- Right to correct inaccuracies in your personal data
- Right to delete your personal data
- Right to obtain a portable copy of your personal data
- Right to opt out of targeted advertising (when applicable)
- Right to opt out of the sale of personal data (we do not sell personal data)
- Right to appeal our decision regarding your privacy request
You can use the browser-level cookie controls below to opt out of targeted advertising immediately on this device. You may also email [email protected] with "Opt Out of Targeted Advertising" in the subject line, and we will process your request within 15 days.
To appeal a decision, email [email protected] with "Privacy Appeal" in the subject line. We will respond within 60 days.
California Residents (CCPA / CPRA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:
- Right to know: request the categories and specific pieces of personal information we have collected about you, the sources we collected it from, the purposes for collection, and the third parties with whom we have shared or disclosed it
- Right to delete: request deletion of personal information we have collected from you (subject to legal retention requirements)
- Right to correct: request correction of inaccurate personal information
- Right to opt out of sale or sharing: direct us to stop "selling" (we do not) or "sharing" (as defined by CPRA, for cross-context behavioral advertising) your personal information
- Right to limit use of sensitive personal information: request limitations on use and disclosure where this right applies under law
- Right to non-discrimination: we will not deny you Services, charge different prices, or provide a different level of quality because you exercised any of these rights
Authorized Agents
You may designate an authorized agent to submit a privacy request on your behalf. The agent must provide signed written permission from you, and we may verify your identity directly or require you to confirm the agent's authority before fulfilling the request. Send authorized agent requests to [email protected].
Other State Privacy Laws
Residents of states with comprehensive consumer privacy laws — including Virginia (VCDPA), Colorado (CPA), Utah (UCPA), Connecticut (CTDPA, addressed above), Texas (TDPSA), Florida (FDBR), Oregon (OCPA), Montana (MTCDPA), Tennessee (TIPA), Iowa, Indiana, New Jersey, Delaware, New Hampshire, Maryland, Minnesota, and any other state that has enacted similar legislation — generally have rights similar to those described in the California section above: the right to access, correct, delete, and obtain a portable copy of personal information, and the right to opt out of targeted advertising and the sale of personal information. To exercise any of these rights, email [email protected]. We will respond within the time period required by your state's law (generally 30 to 45 days).
How to Exercise Your Rights
To exercise your privacy rights:
- Email us at [email protected]
- Update information directly in your account settings (for subscription customers)
- Use the unsubscribe link in marketing emails
We will respond to your request within 30 days and may need to verify your identity before processing certain requests.
Cookies and Tracking Technologies
We use cookies and similar tracking technologies to enhance your experience and collect information about how you use our Services:
Types of Cookies We Use
- Essential Cookies: Required for the Services to function properly
- Performance Cookies: Help us analyze how you use our Services
- Functional Cookies: Remember your preferences and settings
- Marketing Cookies: Used to deliver relevant advertising based on your consent or opt out choice
You can control cookies through your browser settings. However, disabling certain cookies may affect the functionality of our Services. For more detailed information, please see our Cookie Policy.
International Data Transfers
Our Services are primarily designed for users in the United States. Our core infrastructure is in the United States. Cloud, network, support, and AI providers may process information in other countries depending on the service and provider involved.
If you access our Services from outside the United States, your information may be transferred to the United States and other countries with different data protection laws. Where applicable law requires transfer safeguards, those requirements continue to apply. AI features do not provide a country-specific processing guarantee.
We do not currently target or market our Services to residents of the European Union. When our website detects an EEA, United Kingdom, or Switzerland browser context, optional analytics and advertising cookies stay off unless the visitor accepts them.
Children's Privacy
Our Services are designed for business use and are not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18 years of age.
If we learn that we have collected personal information from a child under 18 without verification of parental consent, we will take steps to delete that information promptly.
If you believe we have collected information from a child under 18, please contact us immediately at [email protected].
Do Not Track Signals
Some browsers and devices offer "Do Not Track" (DNT) signals or similar mechanisms. Currently, there is no universal standard for recognizing and implementing Do Not Track signals.
Our Services do not currently respond to Do Not Track signals. When your browser exposes a Global Privacy Control signal, we treat it as an opt out of targeted advertising. You can also use the cookie management options described in our Cookie Policy to control our use of cookies for analytics and advertising purposes.
Automated Decision-Making and AI Processing
We use AI for website analysis, builder chat, page and component editing, image creation, attached-document assistance and supported store questions and changes. Depending on the request, processing can include your instructions, relevant conversation context, page text and component code, selected images or image descriptions, extracted document text, product information and store-query results.
OpenRouter routes inference requests to underlying model providers. The providers and models may change. Some routes require providers that advertise zero data retention; other routes, including image routes, may permit providers that retain request or response data under their policies. Zero data retention routing does not mean that Mirin deletes your saved conversations, generated assets or billing records. It is also not an independent guarantee that every provider deletes every record. Do not submit confidential or regulated material unless its processing is appropriate for your use and your obligations.
For supported store answers, the system uses scoped store data and replaces customer names in structured model context where that workflow supports it. This does not remove personal information you type into a message or attach in a document. Customer deletion controls also remove associated identifying information from stored store answers; legal billing and transaction retention requirements can still apply.
Document uploads are parsed to extract text and file metadata. Attached reference text becomes unavailable to new AI requests after 24 hours and expired document rows are removed during subsequent upload cleanup. This is not a promise that all copies disappear at the 24 hour mark: generated content, saved conversations, backups and provider records follow their own retention rules. Removing an attachment does not undo content already created from it.
We keep AI usage records including the action, quality tier, model identifiers, credit amounts, supplier cost when available, timing and outcome to operate the service, reconcile billing and investigate failures. Saved outputs and conversations remain subject to the account and content retention rules in Section 5. Requests for access or deletion can be made through the contact methods in Section 6.
AI answers can be inaccurate. The assistant is intended to help you create content and operate your website, not to make decisions about a person's eligibility for employment, credit, housing, health care or other significant opportunities. Review outputs and use the applicable confirmation controls before making consequential changes.
Data Breach Notification
In the event of a data breach that affects your personal information, we will:
- Investigate the incident promptly to determine the scope and impact
- Take immediate steps to contain and mitigate the breach
- Notify affected users within 72 hours of confirming the breach, or as otherwise required by applicable law
- Provide information about what data was affected and steps you can take to protect yourself
- Report to relevant authorities as required by law
The notification timeline may be extended if law enforcement determines that notification would impede a criminal investigation.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements.
We will notify you of any material changes by:
- Sending an email to the address associated with your account
- Posting a notice on our website
- Updating the "Last Updated" date at the top of this Policy
We will obtain consent where applicable law requires it for a new processing purpose or material change. Continued use alone does not replace consent required by law.
Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Mirin
310R Flanders Rd
Rear Bldg #410
East Lyme, CT 06333
United States
Email: [email protected]
Response Time: We will respond to privacy inquiries within 30 days of receipt.