Privacy Policy

MIRU operates shopmiru.app and is the controller of the personal data described here. To contact us about privacy, use the contact form and select “Privacy or data deletion”.

Scan frames. When you run a scan, your device captures a short sequence of camera frames (or a photo you upload) and sends them to our servers for analysis.

Measurements and diagnostics. The results of that analysis — complexion measurements such as depth and undertone values, confidence and quality indicators, lighting and capture diagnostics, and device/browser characteristics relevant to the camera.

Your beauty profile, routine and wishlist. The preferences and saved items you create in the app.

Account data. If you sign in with Google or Apple: your email address, name and avatar as supplied by that provider.

Usage and click data. Which recommendations you view and which retailer/affiliate links you click, plus basic product analytics events.

Messages you send us. Contact and partnership enquiries, including the email address you give us.

To analyse your scan and generate your Beauty Profile and recommendations; to save your profile, routine and wishlist; to attribute affiliate commission on links you click; to measure and improve the accuracy and reliability of the scan; to keep the service secure and prevent abuse; and to reply to you when you contact us.

We do not sell your personal data, and we do not use your scan images for advertising.

Scan frames are transmitted over an encrypted connection to our backend, where they are processed. Part of that analysis uses a third-party AI vision model accessed through the Lovable AI Gateway (currently a Google Gemini model) to interpret the image.

What MIRU controls. We do not store your scan images as part of normal use. A quality-review store exists only for debugging capture problems; it is switched off by default and, when an operator switches it on, each stored image is written with an expiry date no more than 30 days ahead and is deleted by our clean-up process. What we keep beyond that is the derived measurement and diagnostic data, which does not include your photograph.

What our processors control. Once a frame is sent to the AI vision provider for analysis, any logging or retention on their side is governed by that provider's own terms, not by MIRU. We can tell you that we do not ask them to retain your images and that we do not receive them back, but we cannot guarantee a deletion timetable inside a third party's systems. The same applies to routine infrastructure logs and backups held by our hosting and database provider.

Your guest Beauty Profile, routine and wishlist are stored locally in your browser. Signed-in data, scan measurements, click records and messages are stored in our managed cloud database and are accessible only to the MIRU team and the processors listed below.

• Lovable Cloud (Supabase) — database, authentication, hosting infrastructure.
• Lovable AI Gateway (Google Gemini models) — scan image analysis.
• Google and Apple — optional sign-in, if you choose it.
• Amazon and other retailers — only receive the click, not your profile or scan.

These providers process data on our instructions and may store it outside your country, under appropriate safeguards.

Guest data stays in your browser until you clear it. Account data, saved routines and wishlists are kept while your account exists. Scan measurements and diagnostics are kept to monitor accuracy over time and are deleted or de-identified when no longer needed. Raw quality-review images, in the rare case the store is switched on, carry an expiry of no more than 30 days and are removed by our clean-up process. Contact and partnership messages are kept while we handle your enquiry and for a reasonable period afterwards. These periods describe MIRU's own systems; retention inside our processors' platforms is governed by their terms.

You can use MIRU entirely as a guest. Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal data, to object to certain processing, and to complain to your local data protection authority.

Deleting your data: on the profile page you can clear your locally stored beauty profile, and — if you are signed in — permanently delete your account together with your saved profile, routines and wishlist. You can also ask us to do it through the contact form.

Where required, we rely on your consent for camera access and biometric-adjacent complexion analysis (you can withdraw it by not scanning and by deleting your data), on contract to provide the features you request, and on legitimate interests to keep the service secure and to improve measurement accuracy.

MIRU is not intended for anyone under 16, and we do not knowingly collect their data.

If this policy changes we will update the date above and, for significant changes, say so in the app.