Privacy Notice

1. Who we are

Mirror is operated by K2 graphics ltd, a company registered in England and Wales. K2 graphics ltd is the data controller for the personal data described in this notice, meaning we decide why and how it is processed.

2. What we collect and why

• Photographs you upload (images of you and of garments) — to generate your try-on results, fidelity score and 360° spin frames. These are biometric-adjacent images of you, so we treat them with care. Legal basis: performance of our contract with you, and your consent where required.
• Account data (email address, login credentials, authentication identifiers) — to create and secure your account. Legal basis: contract.
• Subscription data (plan, status, renewal dates, payment provider customer and subscription identifiers) — to give you Premium access. Legal basis: contract.
• Usage and technical data (try-on counts, feature usage, device and browser information, IP address, error logs) — to operate the service, prevent abuse and fraud, and improve the product. Legal basis: legitimate interests.
• Support messages you send us — to answer you. Legal basis: legitimate interests.

We do not collect or store your card details. Payment information is collected directly by Paddle.

3. AI processing

Your uploaded images are sent to our AI model providers to generate try-on results. They process the images on our instructions to return a result and are not permitted to use them to train their own models for unrelated purposes.

4. Who we share data with

• Service providers / subprocessors — hosting, database and authentication providers, and AI model providers used to render try-ons.
• Merchant of Record — Paddle.com, which handles the sale of Premium, subscription management, payments, tax compliance and invoicing, and acts as controller for that payment data.
• Professional advisers — legal and accounting, where needed.
• Authorities — where we are required to disclose by law.

We do not sell your personal data.

5. International transfers

Some of our providers process data outside the UK and EEA. Where that happens we rely on appropriate safeguards, such as UK/EU Standard Contractual Clauses or an adequacy decision.

6. Retention

Uploaded photographs and generated results are kept only as long as needed to provide the feature and are deleted or anonymised when no longer needed. Account and subscription records are kept for the life of your account, and afterwards only where required for legal, tax or accounting purposes. Logs are kept for a short period for security and troubleshooting.

7. Your rights

Under UK GDPR and EU GDPR you have the right to access your data, have it corrected or erased, restrict or object to processing, request portability, and withdraw consent at any time. We aim to respond within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

8. Security

We apply appropriate technical and organisational measures, including encryption in transit, access controls, and row-level database policies that restrict each account to its own records.

9. Cookies and similar technologies

We use essential cookies and browser storage to keep you signed in and to run the checkout. We do not use advertising cookies. You can clear or block cookies in your browser settings, though signing in will stop working if essential cookies are blocked.

10. Contact

To exercise your rights or ask a privacy question, contact K2 graphics ltd through our support channel. Payment-related privacy queries can also be raised with Paddle at paddle.net.