Privacy Policy

1. DATA CONTROLLER

The data controller for the personal data processed in connection with The Mirror is:

Refralume
Country: France
Data protection contact: hello@refralume.com

You can use this address for any question relating to this Privacy Policy or to exercise your rights regarding your personal data.

2. INFORMATION WE PROCESS

The Mirror limits data collection to what is necessary for the operation of the app and its features.

2.1. Account and authentication information

When you create or use an account, certain information may be processed to identify you and secure your access to the app. Depending on the sign-in method you choose, this may include:

• your e-mail address;
• technical information necessary for authentication;
• identifiers associated with Sign in with Apple or Google Sign-In when you use these services.

Authentication is provided by Firebase Authentication, a service provided by Google. When you use Apple or Google to sign in, these providers may also process information in accordance with their own privacy policies.

2.2. Questions and reflections submitted to The Mirror

When you use certain experiences in The Mirror, you may freely enter a question or reflection text. This includes in particular:

• your original question;
• an adapted version of your question, where applicable.

This content may, by its nature, contain personal, intimate, or sensitive information that you choose to share voluntarily. We recommend that you avoid unnecessarily identifying other people and avoid sharing sensitive data that is not necessary for your use of The Mirror.

Encryption of questions. For users for whom the encryption system is enabled, questions and adapted questions are encrypted on the device before storage. The Mirror uses a mechanism combining RSA-OAEP-256 and AES-256-GCM. The private key required for decryption stays on the user's device and is kept using the secure Keychain/iCloud Keychain system. The server only holds the public key needed for encryption and technical information identifying which key was used. The private key is never transmitted to The Mirror's server.

Automatic activation of encryption. The encryption mechanism activates automatically for every user the first time they use the app, with no action required on your part. In rare technical cases (for example, if iCloud Keychain is unavailable on the device, or in the event of a technical error during setup), some data may be temporarily stored without this client-side encryption, as readable text on the app's infrastructure.

2.3. Selected cards

When you take part in an experience using cards, The Mirror stores the information necessary for the reading, including:

• the selected cards;
• their position within the method used;
• information about their arcana or suit, where relevant.

This information is not currently protected by the client-side encryption mechanism described for questions.

2.4. Emotions selected in Structured Reflection

When you use the Structured Reflection mode, The Mirror may store the emotions you select or enter as part of the experience. This information is recorded to enable the operation and display of this experience. Emotions recorded are not currently protected by the client-side encryption mechanism applied to questions.

3. CONTENT GENERATED BY THE MIRROR

3.1. Generated readings

The Mirror stores the text of generated readings to enable their display and use within the app. Generated readings are not currently protected by the client-side encryption mechanism applied to questions.

A reading may nonetheless reflect or rephrase elements of the question or context you provided. Consequently, even when an original question is stored in encrypted form, the text generated from that question may contain similar elements in readable text. We invite you to bear this distinction in mind when using the app.

4. THE “GO DEEPER” FEATURE

The Mirror allows you to explore certain readings further using the Go Deeper feature. In this context, we may process:

• your follow-up messages;
• the context necessary for the conversation;
• the responses generated by artificial intelligence.

Conversation messages recorded by The Mirror as part of Go Deeper benefit from the same client-side encryption mechanism used for questions, where that mechanism is enabled. They are thus encrypted before storage using the RSA/AES system described in this Policy. The private key required for decryption is not stored on The Mirror's servers.

5. ARTIFICIAL INTELLIGENCE AND OPENAI

Certain features of The Mirror use artificial intelligence models provided by OpenAI via its API.

5.1. Generating a reading

To produce the requested reading, The Mirror may transmit to OpenAI the information necessary to generate the result, including:

• your question, in decrypted form at the moment it needs to be processed;
• the selected cards;
• the instructions and contextual information necessary to generate the reading.

The fact that a question is stored in encrypted form in The Mirror's database does not mean it remains encrypted throughout the entire generation process.

For the AI model to process your question, its content must be available as readable text at the moment of the request sent to the AI service.

5.2. Go Deeper

When you use Go Deeper, the elements necessary for the conversation may also be transmitted to OpenAI to generate the response, including:

• the relevant conversation context;
• your messages;
• previous responses necessary to maintain context;
• your new message.

The encryption applied to the storage of these messages by The Mirror is therefore distinct from the temporary processing necessary to generate an AI response.

5.3. Use of data by OpenAI

The Mirror uses OpenAI's API, not the consumer-facing ChatGPT service, to generate this content. Under the rules applicable to OpenAI's API services, data sent via the API is not used by default to train or improve OpenAI's models, unless a separate opt-in mechanism applies to the account in question.

Any technical retention period applied by OpenAI depends on the settings and conditions applicable to the API service used, including any Zero Data Retention mechanism that may apply to certain API accounts.

6. INFORMATION CONCERNING OTHER PEOPLE

Your questions or messages may sometimes concern another person. We ask you to avoid unnecessarily including:

• their full name;
• their contact details;
• their address;
• medical information;
• information about their private life;
• or any other information that would directly identify them when not necessary for your reflection.

When you voluntarily provide information about another person, you are responsible for the content you choose to share with The Mirror.

7. CREDITS AND TRANSACTION HISTORY

The Mirror uses a credit system to enable access to certain features. To manage this system, we may keep:

• your credit balance;
• credits purchased;
• credits used;
• credits given as a gift, where applicable;
• the transaction type;
• the transaction source;
• the relevant product identifier;
• the balance obtained after the transaction.

This information is necessary for the operation of the credit system and for preventing errors or abuse.

8. IN-APP PURCHASES (APP STORE AND GOOGLE PLAY)

In-app purchases on iOS are processed by Apple through the App Store and StoreKit, and in-app purchases on Android are processed by Google through Google Play Billing. The Mirror may keep certain technical transaction identifiers, in particular to:

• confirm that a purchase was processed;
• attribute the corresponding credits;
• prevent the same transaction from being credited more than once.

The Mirror does not directly receive your payment card information used by Apple or Google to process payment. Payment information held and processed by Apple or Google is subject to their own terms and privacy policies.

9. LANGUAGE PREFERENCE

The Mirror may store your language of use, or the language in which you wish to receive generated content. This information is used to provide the experience and readings in the appropriate language.

10. ENCRYPTION KEYS AND TECHNICAL SECURITY DATA

To enable the encryption mechanism to function, The Mirror may keep:

• your public encryption key;
• the identifier of the key used;
• the technical information necessary for the encryption system to function.

A public key is designed to allow data to be encrypted, but does not by itself allow it to be decrypted. The corresponding private key stays on the user's device and is not transmitted to The Mirror's servers.

11. TECHNICAL DATA PROCESSED BY THE INFRASTRUCTURE

The Mirror uses the following Firebase services: Firebase Authentication (authentication), Cloud Firestore (database), Cloud Storage, and Cloud Functions (backend processing). The Mirror does not host its own independent servers; the entire application backend runs on this Firebase/Google Cloud infrastructure. Cloud Storage is used solely to cache audio files generated by the text-to-speech (“listen”) feature; this cache is indexed by a hash of the read text, is shared across users, and is not linked to your account or identity. As part of the normal operation of this infrastructure, Google/Firebase may process certain technical information such as:

• IP address;
• device information;
• connection information;
• technical security and authentication data;
• logs necessary for the operation and security of the service.

This processing may result from the operation of the Firebase infrastructure itself and does not necessarily mean that The Mirror directly builds a user profile from this information.

12. WHAT THE MIRROR DOES NOT CURRENTLY USE

In the current version of the app:

• The Mirror does not integrate Firebase Analytics;
• The Mirror does not integrate Firebase Crashlytics;
• The Mirror does not integrate Firebase Cloud Messaging for push notifications;
• The Mirror does not collect Firebase Cloud Messaging tokens;
• The Mirror does not use user data for targeted advertising;
• The Mirror does not sell users' personal data;
• The Mirror does not use users' questions or reflections to build advertising profiles.

If these practices change in the future, this Privacy Policy will be updated before or when the relevant processing is introduced, in accordance with applicable requirements.

13. WHY WE PROCESS THIS DATA

We process the information described above only for determined purposes, including:

• creating and securing your account;
• authenticating you;
• providing the requested reflection experiences;
• generating your readings;
• enabling the Go Deeper feature;
• storing and displaying content associated with your account;
• managing your credit balance;
• recording and validating transactions;
• preventing the double processing of a purchase;
• providing content in the language of your choice;
• ensuring the security and technical operation of the app;
• preventing abuse or fraudulent use;
• complying with our legal obligations.

We do not use your personal reflections for behavioral advertising purposes.

14. LEGAL BASES FOR PROCESSING

Where the General Data Protection Regulation (“GDPR”) applies, we rely on one or more legal bases depending on the processing concerned.

Performance of a contract

Processing necessary to create and manage your account, provide a requested reading, enable Go Deeper, manage your credits, and process and record purchased features is necessary to provide the service requested by the user.

Legitimate interest

Certain technical processing strictly necessary for security, fraud prevention, protection of the service, and diagnosing issues may rely on our legitimate interest in operating a reliable and secure service.

Legal obligation

Certain information may be kept or processed where the law requires us to do so, in particular for accounting, tax, judicial, or regulatory purposes.

Consent

Where applicable regulations require your consent for optional processing, it will be requested separately. You will be able to withdraw this consent under the conditions set out by applicable regulations.

15. SERVICE PROVIDERS AND RECIPIENTS

To provide The Mirror, certain information may be processed by technical service providers acting on our behalf or providing services necessary for the app to function. These include in particular:

Google / Firebase

For authentication, storage, and backend services necessary for The Mirror to function.

OpenAI, L.L.C. (United States)

For processing requests necessary to generate readings and Go Deeper responses.

Apple

For Sign in with Apple, services related to the iOS ecosystem, and processing in-app purchases via the App Store and StoreKit.

Google

When you choose Google Sign-In to authenticate, and for processing in-app purchases on Android through Google Play Billing.

We do not transfer your data to third parties for their own behavioral advertising purposes. We may also disclose certain information where legally required, in particular to comply with a legal obligation, a court order, or a legally binding request from a competent authority.

16. INTERNATIONAL DATA TRANSFERS

Some of our service providers may process data outside France or the European Economic Area. This is notably the case for OpenAI, L.L.C., a company established in the United States, to which certain data is transmitted for generating readings and Go Deeper responses, as well as, where applicable, other technical service providers established outside the EEA.

Where the GDPR requires specific safeguards for an international data transfer, we rely on the transfer mechanisms offered by our service providers and recognized by European regulations, such as, depending on the case:

• an adequacy decision of the European Commission;
• standard contractual clauses approved by the European Commission;
• or any other legally recognized mechanism.

You may contact us for further information regarding the safeguards applicable to a particular transfer.

17. RETENTION PERIODS

We do not wish to keep your data longer than necessary for the purposes for which it is processed. The periods below apply to the following categories of data:

Account data: For the entire lifetime of the account; deleted immediately and automatically upon account deletion.

Questions and adapted questions: Until the corresponding reading is deleted by the user, or until the account is deleted.

Generated readings: Until the corresponding reading is deleted by the user, or until the account is deleted.

Go Deeper messages: Until the associated reading is deleted (Go Deeper messages are part of the same document), or until the account is deleted.

Credit balance and history: For the entire lifetime of the account; deleted upon account deletion.

Purchase transaction identifiers (Apple StoreKit transaction identifiers and Google Play order identifiers): Kept independently of the user account, for the purpose of fraud prevention and preventing duplicate transaction crediting, including after account deletion (see Section 18).

Any technical logs: according to the periods applied by the relevant service providers and our legitimate security needs, subject to applicable legal requirements.

Where certain information must be kept longer to comply with a legal obligation or to establish, exercise, or defend a legal claim, its use is limited to that purpose.

18. ACCOUNT AND DATA DELETION

You can request the deletion of your account and associated personal data directly from within the app, in the Account section.

When you confirm this request, your account and all associated personal data (including your readings, your Go Deeper messages, your credit history, and your encryption identifiers) are deleted immediately and automatically, subject to:

• data we are legally required to retain;
• information necessary to establish, exercise, or defend legal claims;
• technical delays reasonably necessary to delete backup copies where they exist;
• technical purchase transaction identifiers (Apple StoreKit transaction identifiers and Google Play order identifiers; see Section 8), which are kept independently of your account for fraud prevention and duplicate-transaction purposes, including after your account is deleted.

This deletion is final and cannot be undone once initiated.

Certain data processed independently by Apple, Google, OpenAI, or other service providers may be subject to their own retention policies and obligations.

19. SECURITY

We implement technical and organizational measures designed to protect personal data against, in particular:

• unauthorized access;
• loss;
• alteration;
• disclosure;
• destruction;
• misuse.

For certain particularly personal categories of content, The Mirror uses the client-side encryption mechanism described above. However, no computer system, network, or storage method can guarantee absolute security. We therefore do not present encryption or any other security measure as entirely eliminating the risks associated with processing digital data.

20. SENSITIVE PERSONAL DATA

The Mirror is a reflection tool. Users may therefore choose to write personal information in their questions or conversations. The Mirror does not ask you to share sensitive data that is not necessary for the service to function.

We recommend in particular that you avoid unnecessarily providing information concerning:

• your health;
• your sexual orientation or sex life;
• your political opinions;
• your religious or philosophical beliefs;
• your racial or ethnic origin;
• or any other particularly sensitive information.

When you voluntarily choose to include such information in free text, it may be processed to provide the feature you expressly requested.

21. AUTOMATED DECISIONS AND THE NATURE OF RESULTS

The Mirror uses automated systems and artificial intelligence models to produce certain analyses and responses. These results are intended to support a personal process of reflection and introspection.

They do not constitute a decision automatically producing legal effects or similarly significant effects concerning you. The Mirror should not, in particular, be considered a substitute for a qualified professional in making medical, psychological, legal, financial, or safety-related decisions.

22. YOUR RIGHTS UNDER THE GDPR

If the GDPR applies to your situation, you have, depending on the circumstances, several rights regarding your personal data. You may in particular request:

• access to the personal data we hold about you;
• correction of inaccurate data;
• erasure of your data;
• restriction of certain processing;
• portability of certain data;
• objection to certain processing based on legitimate interest;
• withdrawal of your consent where processing is based on it.

Withdrawing consent does not affect the lawfulness of processing carried out before that withdrawal.

To exercise your rights: hello@refralume.com

We may request the information strictly necessary to verify your identity where this is necessary to prevent another person from obtaining or deleting your data without authorization.

You also have the right to lodge a complaint with the competent supervisory authority. In France, the competent authority is the Commission nationale de l'informatique et des libertés (CNIL).

23. CHILDREN AND MINORS

The Mirror is not designed to allow the voluntary collection of personal data from children under conditions contrary to applicable regulations.

Minimum age to use The Mirror: 15 years old. Users under 15 are not permitted to create an account or use the Services, in accordance with the digital consent threshold applicable under French law.

If we learn that data concerning a child has been processed in violation of applicable requirements, we will take reasonable steps necessary to delete it.

24. ANALYTICS, TRACKING, AND ADVERTISING

The Mirror does not currently use Firebase Analytics and does not implement any system designed to track your behavior within the app for targeted advertising purposes. We do not sell your questions, readings, or conversations to advertisers. We do not use your questions, readings, or conversations to build an advertising profile.

If The Mirror later introduces analytics, tracking technologies, or optional processing requiring consent, we will update this Policy and request your consent where the law requires it.

25. CHANGES TO THIS POLICY

The Mirror will evolve over time. We may modify this Privacy Policy in particular when:

• we add a new feature;
• the way certain data is processed changes;
• we add or replace a service provider;
• our security or encryption measures evolve;
• applicable regulations change.

The “Last updated” date at the top of this Policy indicates the date of the most recent version. In the event of a substantial change affecting how your personal data is used, we will inform you appropriately where required by regulation.

26. CONTACT

For any question regarding this Privacy Policy, the processing of your data, or the exercise of your rights:

Refralume
France
E-mail: hello@refralume.com