Privacy Policy

I. Collection of Personal Data

1. Personal Data You Provide Directly

Account Information: When you create a Mirasim account, we collect your email address and, if you sign in with Google or Apple, the basic profile information they share with us (such as your name and email). If you set a password, we store it in hashed form and never in plain text.

Public Profile Information: If the Services offer public profiles, your display name and avatar are shown on your public profile, along with any simulations or reports you have chosen to publish.

Seed Materials and Simulation Requirements: The source code, repositories, project files, configuration files, datasets, links, and other reference materials you upload or connect in order to run a simulation ("Seed Materials"), together with any credentials, API keys, or other secrets you provide or that our Services access on your behalf to connect to your systems; the plain-language description of what you want to build, test, or predict; and the resulting code, patches, test results, agent execution logs and transcripts, terminal output, prediction reports, simulated agent interactions, comments, and other content you generate or publish while using the Services.

User Feedback: Ratings, bug reports, and other improvement suggestions, together with related conversation history, are stored when you provide feedback.

Communications: Correspondence via our support channels is retained, including contact details and message content.

2. Automatically Collected Technical Data

Device/Connection Metadata: device specifications, network information (ISP, IP-derived approximate location), and unique identifiers.

Usage Analytics: access timestamps, navigation paths, and feature utilization patterns.

System Logs: error reports, application state during incidents, and related user-provided context.

Tracking Technologies: cookies and similar tools (see Section III below) enable user recognition, personalization, optimization, and — where applicable — communications.

3. Content Generation and Model Data Sources

To power the AI systems that build simulations and agent personas, the third-party AI model providers we engage train and improve their underlying models using their own data sources, which may include publicly available internet sources, commercially licensed third-party datasets, user-contributed and crowd-worker-sourced materials, and synthetic data; those providers act as independent controllers or processors of that training data under their own applicable terms. We ourselves may generate or use internally generated synthetic data and de-identified or aggregated usage data to improve the Services.

4. Third-Party Personal Data in Seed Materials

Your Seed Materials (for example, source code, repositories, datasets, configuration files, credentials, or agent execution logs) may contain personal data about identifiable individuals other than you — such as names or email addresses in commit history, code comments, log files, or embedded datasets. You are responsible for ensuring you have a lawful basis to upload such materials to the Services. We process this data as part of providing the Services to you, and we do not independently verify the lawfulness of your Seed Materials before processing them.

II. How Do We Use Your Personal Data

1. Service Provision & Account Management: to run the simulations you request, generate prediction reports and agent personas, host and display any content you publish, administer your account, and enforce anti-abuse and fair-use limits. Legal basis: performance of our contract with you.

2. Communication & Support: to contact you regarding service updates, security alerts, and (where permitted) promotional materials, and to respond to inquiries and provide support. Where we use your personal data for direct marketing, we will do so in accordance with applicable law and give you an easy way to opt out at any time. Legal basis: performance of our contract with you (service and account communications) and, for promotional materials, our legitimate interest in promoting our Services or your consent where required by applicable law.

3. Security & Compliance: to detect, prevent, and investigate fraud, abuse, or violations; to comply with legal obligations and enforce our Terms, including the acceptable use provisions in Section 3 of our Terms of Service; and to protect the security and integrity of our systems. Legal basis: our legitimate interest in protecting the security and integrity of the Services and our users, and compliance with our legal obligations.

4. Service Improvement & Research: to debug errors, optimize performance, and conduct research and development to improve Mirasim, including the AI systems used to run simulations. Your Seed Materials, Simulation Requirements, and uploaded reference files are sent to the AI model providers we use (which may include third-party providers) in order to generate your Outputs; those providers process this data pursuant to their own applicable terms, in addition to ours. Legal basis: our legitimate interest in maintaining, debugging, and improving the Services.

5. Model Improvement. Depending on the feature you use and your account preferences, we and/or our AI model providers may use your Inputs and Outputs to improve the AI systems used to run simulations, unless you opt out at any time through your account settings or by contacting us at support@mirasim.ai; opting out will not affect your access to the core features of the Services. In all cases, we may use content as necessary for safety, security, and legal-compliance purposes, and we may use de-identified or aggregated data. Legal basis: our legitimate interest in improving our AI systems, or your consent where required by applicable law; where you object to this processing or exercise an opt-out, we will honor that choice.

6. Automated Decision-Making. We may use automated tools, informed by factors such as usage patterns and abuse signals, to help detect fraud and abuse and to apply Usage Limits. Where these automated processes produce legal or similarly significant effects on you (for example, suspending your Account) without meaningful human involvement, you may contact us at support@mirasim.ai to request more information about the logic involved, to express your point of view, and to request human review of the decision.

III. How Do We Use Cookies and Similar Technologies

We may use cookies and similar technologies (including browser cookies and web beacons) for purposes that include: (a) strictly necessary cookies required for the Services to function (such as authentication and session management); (b) functional cookies that remember your preferences; and (c) analytics cookies that help us understand how our Services are used. Some functions of our Services depend on strictly necessary cookies, which do not require your consent. For non-essential cookies, where required by applicable law we will ask for your consent through a cookie-consent tool before placing them, and we will make declining non-essential cookies at least as easy as accepting them; you may withdraw your consent at any time through that tool or your browser settings. We honor recognized opt-out preference signals, including Global Privacy Control (GPC), as a valid method of exercising these choices.

IV. How Do We Disclose Your Personal Data

1. Service Providers & Business Partners: we engage trusted third parties for hosting and infrastructure, AI model providers that help run simulations, compliance and auditing, research and data processing, and customer support.

2. Legal & Compliance Disclosures: we may disclose personal data to comply with legal obligations, to protect safety, rights, or property, and to enforce our Terms, including the acceptable use provisions in Section 3 of our Terms of Service.

3. Business Transfers: if we undergo a merger, acquisition, or asset sale, personal data may be transferred as part of the transaction.

4. Third-Party Integrations: our Services include sign-in integrations (such as Google and Apple) that operate under their own privacy policies.

5. With Your Consent: we will share personal data with additional third parties only with your explicit permission.

6. Published Simulations and Public Profile Information: If you choose to publish a simulation or report to a public gallery or community area of the Services, that content (including any personas, text, or visualizations it contains) and your public profile information become visible to other users and visitors of the Services. Unpublished drafts, Seed Materials, and Simulation Requirements remain private to your account — accessible only to you while signed in, or through short-lived signed preview links that the Services themselves create. Your email address is never shown publicly.

We do not sell your personal data for money, and we do not "sell" or "share" it for cross-context behavioral advertising as those terms are defined under California law.

V. How Your Personal Data May Be Transferred Globally

• 1. Depending on where you are located and the features you use, your personal data may be transferred to, and stored and processed in, the United States, Singapore, and other countries where we, our affiliates, or our service providers (including cloud hosting and AI model providers) operate. These locations may change from time to time as we update our infrastructure and service providers.
• 2. These countries may have data protection laws that differ from those in your jurisdiction.
• 3. We take appropriate safeguards to ensure your personal data remains protected in accordance with this Privacy Policy and applicable laws. Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses and, for transfers from the United Kingdom, the UK International Data Transfer Addendum (or the UK Standard Contractual Clauses), together with a transfer impact assessment where required. For transfers from other jurisdictions, we take steps designed to ensure a comparable standard of protection, including through contractual protections with the recipients of the data. You may request a copy of the relevant transfer safeguards by contacting us as described in Section XII.

VI. How Do We Retain Your Personal Data

We retain personal data only as long as necessary for legitimate business needs or legal compliance. In determining retention periods we consider the amount, nature, and sensitivity of the data, the purposes for which we process it, whether we can achieve those purposes by other means, and applicable legal, tax, accounting, and reporting requirements. For example: account information is generally retained for the life of your account and for 30 days afterward; system logs are retained for 60 days; and backups are retained for 90 days. When you delete your Account, we delete or anonymize your account data on the schedule above. However, simulations or reports you chose to publish to a public gallery or community area may remain available after Account deletion to the extent other users have viewed, relied on, or built upon them, or to comply with law or resolve disputes — this reflects the freedom-of-expression and third-party-rights exception recognized in Article 17(3) GDPR and equivalent provisions elsewhere, and does not extend to Seed Materials or drafts that were never published. Where reasonably practicable, you may ask us to remove your name or public profile information from previously published content by contacting us at support@mirasim.ai. Once no longer needed, we securely delete or anonymize the data.

VII. How We Protect Your Personal Data

We implement technical and organizational security measures designed to meet industry standards for a company of our size and the sensitivity of the data we process, including encryption of data in transit and, where technically feasible, at rest; an information security program; malware protection; and access controls. However, no internet or wireless transmission can be 100% secure. You are responsible for maintaining the confidentiality of your account password and device security.

Data Breach Notification. Where required by applicable law, we will notify the relevant authorities and affected individuals of a data breach involving your personal data without undue delay and in accordance with applicable law.

VIII. How Do We Process Children's Personal Data

Our Services are not directed towards, and we do not knowingly collect personal data from, children under the age of 13. If you become aware that a child under 13 has provided personal data to us, please email us at support@mirasim.ai and we will investigate and, if appropriate, delete the personal data.

Users between the age of 13 and the age of legal majority in their place of residence may only use the Services with the involvement and consent of a parent or legal guardian, consistent with our Terms of Service.

IX. Your Rights to Your Personal Data

Depending on the jurisdiction in which you reside, you may have the right to: access your personal data; erase or delete your personal data; update or correct your personal data; data portability; restrict or object to processing; withdraw your consent; and/or make a complaint to your data protection authority. You can exercise some of these rights through your account, or by submitting a request to support@mirasim.ai. We will respond within the time required by applicable law. We will not discriminate against you for exercising your privacy rights.

X. Additional Information for California Residents

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know the categories and specific pieces of personal information we collect, use, and disclose; to delete personal information; to correct inaccurate personal information; to opt out of the "sale" or "sharing" of personal information; to limit the use of sensitive personal information; and to be free from discrimination for exercising these rights. As stated in Section IV, we do not sell or share your personal information. We honor opt-out preference signals, including Global Privacy Control (GPC). To exercise your rights, contact us at support@mirasim.ai; you may use an authorized agent, and we will verify your request as required by law. Some of the information you provide (for example, the contents of your Seed Materials or communications with the Services) may be "sensitive personal information"; you may request that we limit our use of it, and we do not use sensitive personal information to infer characteristics about you.

XI. How to Update the Privacy Policy

We may update this Privacy Policy from time to time in response to changing legal, regulatory, technical, or business developments. Any changes will be communicated by updating the Privacy Policy accessible via the Services. For material changes, we will provide additional prominent notice (for example, by email or in-product notice) before the change takes effect. The updated Privacy Policy will become effective on the date specified.

XII. How to Contact Us

If you have any questions about this Privacy Policy, or any complaints or requests regarding your personal data, you can contact us at:

Mirasim, Inc.

By email: support@mirasim.ai.