Privacy Notice

Effective date: 2026-08-24 | Last updated: 2026-08-24 This Privacy Notice explains how Mirentra LLC ("Mirentra," "we," "us," or "our") collects, uses, discloses, and protects personal data through our public websites, account registration, demonstrations, communications, support, and hosted platform. It does not govern personal data that our business customers process through the platform where Mirentra acts only as a processor or service provider; that processing is governed by the customer's instructions and our Data Processing Addendum ("DPA").

1. Who we are and how to contact us

Controller: Mirentra LLC, Houston, Texas, United States. Privacy email: ibrahimbandak@mirentra.com. Mirentra has not appointed a separate data-protection officer or EEA/UK representative at this time; privacy requests may be sent to ibrahimbandak@mirentra.com.

2. Personal data we collect

We may collect: (a) identity and professional data, such as name, work email, employer, title, organization, and role; (b) account and authentication data, such as user ID, organization ID, SSO provider, access status, and security events; (c) communications, demo requests, support messages, feedback, and meeting details; (d) device and usage data, such as IP address, browser, device, timestamps, pages/features used, referring URL, logs, diagnostics, and approximate location derived from IP; (e) commercial and billing contact data, order details, subscription status, and invoice records; and (f) Customer Data submitted to the platform, which may include entity, jurisdiction, CbCR, financial, evidence, review, and audit-trail information. Customer Data should not contain unnecessary personal or sensitive data.

3. Sources

We collect data directly from you; from your employer or organization administrator; automatically from devices and services; from SSO/identity providers you use; from service providers; and from lawful public or business sources.

4. Purposes and legal bases

We use personal data to provide and administer accounts and services; authenticate users; process requests and contracts; calculate, display, review, and export customer-requested results; secure, monitor, troubleshoot, and improve the Service; communicate about service, security, support, and updates; comply with law and enforce agreements; prevent fraud and misuse; and, where permitted, provide business-to-business marketing. Where GDPR/UK GDPR applies, legal bases may include performance of a contract, steps requested before a contract, legitimate interests in operating and securing a B2B service, compliance with legal obligations, and consent where required. We do not rely on consent where another basis is used, and you may withdraw consent without affecting earlier processing.

5. Customer-controlled data

For personal data contained in Customer Data, the customer normally determines purposes and means, and Mirentra processes the data on the customer's documented instructions. Individuals should first direct requests about Customer Data to the relevant customer. We will assist customers as required by the DPA and applicable law.

6. How we disclose data

We may disclose personal data to: the customer organization and its administrators/authorized users; hosting, infrastructure, authentication, email, support, logging, analytics, backup, and security providers; payment/invoicing providers; professional advisers and auditors; authorities or other parties when legally required or necessary to protect rights and security; and parties to a merger, financing, reorganization, or sale, subject to appropriate safeguards. We do not sell personal data for money. We do not use personal data for cross-context behavioral advertising.

7. Subprocessors and international transfers

Our current subprocessor list, service function, and processing location will be maintained at /legal/subprocessors. Personal data may be processed outside your country. Where required, we use recognized safeguards such as adequacy decisions, the European Commission's Standard Contractual Clauses, the UK Addendum, or another lawful mechanism. A copy of relevant safeguards may be requested, subject to confidentiality and legal restrictions.

8. Retention

We retain personal data only as long as reasonably necessary for the purposes described, including the service term, support, security, dispute, audit, tax, accounting, and legal requirements. Account and Customer Data are handled under the applicable agreement and deletion schedule, including a 30-day post-termination export window before deletion from active systems. Logs, backups, contracts, and legal records may have different retention periods.

9. Security

We use administrative, technical, and organizational measures designed to protect personal data, taking account of its nature and risk. These may include access controls, encryption in transit, logging, backup, and incident procedures. No method of transmission or storage is completely secure. Users must protect credentials and notify us of suspected unauthorized access. Additional detail is available in our Security Overview at /legal/security.

10. Privacy rights

Depending on location, individuals may have rights to know or access personal data, correct inaccuracies, delete data, receive a portable copy, restrict or object to processing, withdraw consent, opt out of certain sales/targeted advertising/profiling, appeal a denied request, and complain to a regulator. Rights are subject to verification, exceptions, and the role in which we process the data. Submit requests to ibrahimbandak@mirentra.com or mailto:ibrahimbandak@mirentra.com. Authorized agents may submit requests where permitted. We will not unlawfully discriminate for exercising rights.

11. Texas residents

If the Texas Data Privacy and Security Act applies, Texas residents may exercise the rights described above and appeal a decision by replying to our decision or writing to ibrahimbandak@mirentra.com. If an appeal is denied, the individual may contact the Texas Attorney General. Mirentra does not sell sensitive personal data or biometric data. If practices change, required notices and consent will be implemented before the change.

12. EEA and UK individuals

Where applicable, individuals may contact the relevant supervisory authority. Information about EEA authorities is available from the European Data Protection Board; UK individuals may contact the Information Commissioner's Office. Mirentra will identify any required EEA/UK representative above.

13. Cookies and similar technologies

We currently use strictly necessary technologies for security, authentication, session continuity, and operation. We do not currently deploy non-essential analytics, advertising, or tracking cookies, and there is no separate cookie preference center while only essential technologies are in use. If we introduce non-essential technologies, our Cookie Notice will identify them and we will obtain consent or provide opt-out rights where required before activation. Browser controls may not remove server-side records or all technologies.

14. Children

The Service is a business product and is not directed to children. We do not knowingly collect personal data from children. Customers must not upload children's data. Contact us if you believe such data has been provided.

15. Automated decisions

Mirentra performs customer-configured tax decision-support calculations but does not make decisions about individuals that produce legal or similarly significant effects.

16. Changes

We may update this Notice to reflect legal, technical, or operational changes. We will post the updated version and date and provide additional notice where required. Material changes will not be applied retroactively where prohibited.

17. Contact

Privacy questions or requests: ibrahimbandak@mirentra.com, Houston, Texas, United States. Security incidents should be reported to ibrahimbandak@mirentra.com.