Privacy Policy

Mirox, LDA ("Mirox", "we", "our", "us") is a company registered in Portugal (NIPC PT517994160; registered office in Castelo Branco — see the Legal Notice for full statutory information). This Privacy Policy explains how we process personal data under Regulation (EU) 2016/679 (the General Data Protection Regulation, or "GDPR") and the Portuguese Data Protection Act (Lei n.° 58/2019), and how we handle "Amazon Information" under Amazon's Data Protection Policy.

1. Information we collect and lawful basis

We process your data only under the lawful bases set out in Article 6 GDPR:

A. Performance of a contract (Art. 6(1)(b))

• Account data: name, email address, company details, billing information needed to provide the Service.
• Amazon Information: advertising campaigns, search-query performance, FBA stock levels, sales velocity, catalog data, and order summaries (without buyer Personally Identifiable Information — see Section 2 below) ingested via Amazon SP-API and Advertising API to run the Mirox agents.

B. Consent (Art. 6(1)(a))

• Marketing communications: newsletters and product updates. You can withdraw consent at any time via the unsubscribe link in any email or by emailing info@mirox.pt.
• Non-essential cookies and product analytics: on the marketing site (mirox.pt) only, and only if you accept analytics in the consent banner, we record pageviews, navigation paths, and conversion events via PostHog (EU Cloud, Frankfurt) under a pseudonymous device identifier. We never enable session recording. See the cookie policy for the exact cookie list.

C. Legitimate interests (Art. 6(1)(f))

• Platform improvement: aggregated, anonymised metadata (e.g., system-wide latency, feature usage) used to improve the Service. No customer-identifiable data is used for this purpose.
• Security and fraud prevention: IP addresses and system logs retained per the windows in Section 6.

2. Buyer Personally Identifiable Information (Buyer PII)

Amazon's SP-API exposes endpoints that return buyer Personally Identifiable Information (names, email addresses, shipping addresses, county, tax info). Mirox does not need this data to optimise PPC campaigns and applies the GDPR principle of data minimisation:

• Mirox does not call buyer-PII endpoints (e.g. /orders/v0/orders/{id}/buyerInfo, /orders/v0/orders/{id}/address). On the order-summary endpoints we do call (/orders/v0/orders and /orders/v0/orders/{id}/orderItems), the dataElements parameter is omitted, which instructs Amazon to return only non-PII fields.
• As a direct consequence, Buyer PII is never received by our systems — not in memory, not in logs, not in any cache. A field that is never received cannot be leaked.
• Order summary caches store only the order identifier, total, status, marketplace, and purchase date — no buyer fields. As defence in depth, our log redactor and cache writer would strip any buyer fields if Amazon ever returned them, even though by design they should not.

3. Cookies and consent

In line with the ePrivacy Directive and GDPR, non-essential cookies are only set after your explicit, affirmative consent. You can review or withdraw consent at any time from the cookie banner footer link or your account settings. Essential cookies (session, CSRF, authentication) are set without consent under Art. 5(3) ePrivacy Directive.

4. Your rights as a data subject

You have the following rights under Articles 15-22 GDPR:

• Access (Art. 15): request a copy of the personal data we hold about you.
• Rectification (Art. 16): ask us to correct inaccurate or incomplete data.
• Erasure (Art. 17): request deletion. See the "30-day deletion SLA" commitment in Section 6 below.
• Restriction (Art. 18): ask us to pause processing in defined circumstances.
• Portability (Art. 20): receive your data in a structured, machine-readable format.
• Object (Art. 21): object to processing based on legitimate interests or for direct marketing.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD) at www.cnpd.pt, or with the supervisory authority of your habitual residence.

To exercise these rights, email privacy@mirox.pt. We respond within 30 days (Art. 12(3) GDPR).

5. International data transfers

The Mirox Service is hosted within the European Economic Area (EEA) on managed infrastructure in Castelo Branco, Portugal. Where data is transferred outside the EEA — for example, when calling Amazon SP-API endpoints whose backend is operated globally, or when invoking US-based LLM sub-processors — we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) together with technical safeguards including AES-256-GCM encryption at rest and TLS 1.2+ in transit. A list of applicable safeguards is available on request.

6. Data retention and the 30-day deletion SLA

Per-class retention windows on production systems:

• Account data (name, email, company): for the lifetime of your account; deleted within 30 days after termination, except where Portuguese tax law (10 years for invoices) requires retention.
• Amazon Information — tokens, catalog, inventory, pricing, order summaries: while your seller account is connected; deleted within 30 days of disconnect or cancellation.
• Tenant configuration (campaigns, keywords, settings): while your account is connected; deleted within 30 days of disconnect or cancellation.
• Simulation simulation logs (bid history): 90 days rolling on production; deleted on tenant purge.
• Agent decision traces: 30 days rolling on production; deleted on tenant purge.
• Semantic / inter-agent / LLM telemetry logs: 48 hours rolling; deleted on tenant purge.
• API request logs: 7 days rolling; request and response bodies are redacted of any buyer PII at write time as a defence-in-depth measure.
• Audit log of human access to Amazon Information: 365 days, append-only.
• Backups: nightly volume snapshots retained 7 days. We do not restore from snapshots in a way that would re-introduce purged data; snapshots age out naturally.

7. Sub-processors

We engage the following sub-processors, each bound by a written agreement compliant with Art. 28 GDPR:

• Cloud hosting: Hostinger International Ltd — managed VPS in the EU (Castelo Branco, Portugal).
• Customer dashboard hosting: Netlify, Inc. — static hosting on the global CDN (no customer data is stored at the edge; all dynamic data comes from our EU API).
• Payments: Stripe Payments Europe Ltd (PCI-DSS compliant).
• Transactional email: Resend (Resend, Inc.) for service notifications such as sign-in, billing, and security alerts.
• LLM inference: Google LLC (Gemini API) under zero-retention contract terms.
• Product analytics (marketing site only, with consent): PostHog Inc. — EU Cloud tenant hosted in Frankfurt, Germany. Receives only pageviews, navigation events and conversion events for visitors who accept analytics cookies. IPs are used for coarse geo-resolution and not stored verbatim. No session recording. DPA at posthog.com/dpa.

We notify customers in advance of material sub-processor changes; you may object on legitimate data-protection grounds.

7a. Advertising measurement

We advertise Mirox on Google and Microsoft search. To know which campaigns are worth paying for, we need to connect a form submission back to the advertisement that preceded it. Two mechanisms do this, and both require your ad-measurement consent: a first-party cookie plus a conversion record sent from our own server, and — since 13 August 2026 — the Google Ads tag running in your browser. If you do not consent, the Google tag is never downloaded and no advertising code runs on this site at all.

How it works, and what leaves our systems:

• What we store: when you arrive from an advertisement, the URL carries that network's click identifier (for example Google's gclid). With your ad-measurement consent we keep it in a first-party cookie for 90 days, alongside any campaign tags in the URL. Details in the Cookie Policy.
• What we send, and when: nothing, unless and until you submit a form. At that point our server sends the relevant network a conversion record containing the click identifier, a timestamp, a conversion label (for example “Audit Request”) and a monetary value. Where no click identifier survived, we may instead send a SHA-256 hash of your email address so the network can match it against its own record of the click.
• What we never send: your name, company, message, uploaded files, ad-spend figures, marketplace selection, or your email address in readable form.
• Recipients: Google Ireland Ltd. and Microsoft Ireland Operations Ltd. For this conversion record they act as independent controllers under their own advertising terms, not as our processors. Transfers outside the EEA rely on those controllers' own transfer mechanisms (Standard Contractual Clauses and, for the United States, the EU–US Data Privacy Framework).
• Legal basis: your consent (Art. 6(1)(a) GDPR) for both the cookie and the onward transmission. Withdraw it at any time via Cookie settings in the footer — the cookie is deleted immediately and no further conversion records are sent. Records already transmitted cannot be recalled from the network; you may contact the network directly to exercise your rights over them.
• If you decline: the form works exactly the same. We simply cannot tell which advertisement brought you.
• The Google Ads tag: with your consent, gtag.js is loaded from googletagmanager.com and sends Google your IP address, the pages you visit on this site and its own _gcl_* cookie identifiers. Google uses this to attribute conversions and to build advertising audiences, which allows us to show you Mirox advertising on other sites (remarketing). We use Google Consent Mode: until you opt in, ad storage, ad personalisation and ad user data are all signalled as denied, and withdrawing consent sends a revocation and deletes the cookies.

We do not use this data to decide what you see on this site, and we do not sell it. Note that the Google Ads tag does allow audience building and remarketing by Google, as described above; nothing else on this site does.

8. Security

Technical and organisational measures under Article 32 GDPR include: AES-256-GCM at-rest encryption of seller OAuth tokens; TLS 1.2+ for all public traffic with HSTS preload; multi-factor authentication on cross-tenant administrator accounts; tenant-scoped query enforcement on every API endpoint; append-only audit logging of every read of Amazon Information; documented incident-response runbook with a 24-hour notification commitment to Amazon for any unauthorised access to Amazon Information; documented quarterly key rotation. Full detail at /legal/security.

9. Contact

For privacy questions or to exercise your rights:

Privacy & data-subject requests: privacy@mirox.pt
Security vulnerabilities: security@mirox.pt
General support: support@mirox.pt
Postal: Mirox, LDA — Rua Poço do Moleiro, n.º 241, piso intermédio esq. — frente, 6000-412 Castelo Branco, Portugal