Transparency
Every decision, traced.
Black box vs glass box. Three real PPC decisions, side by side — what the AI decided, what data it used, and which alternatives it ruled out. Then a live Simulation Mode panel showing what you would actually see in your account.
Read a decision traceStop trusting Black Boxes
with your capital.
Legacy "AI" tools hide their logic behind generic status updates. Our Glass Box architecture exposes the exact mathematical proof for every single decision made on your account.
Target: noise cancelling headphones
Bid → €0.89
Status: AI Optimized ✨
Data minimization · three layers
What we never receive. What we never store.
The safest data is data we never hold in the first place. Three places where we keep your buyer information away from our servers — by design, not by promise.
We don't ask Amazon for it.
When we pull your orders to attribute ad revenue, we ask Amazon for only what we need: order ID, total, status, marketplace, and date. Buyer name, email, and shipping address are simply not in the response.
Amazon would send these if we asked
- Buyer name
- Buyer email
- Shipping address
- Tax info
- Buyer location
Compliant with Amazon's Data Protection Policy at the source. A field never received cannot be leaked, lost, or misused.
We strip before storing.
If any Amazon response ever contains buyer information, our PII filter removes it before the data touches our database. It's a second line of defence behind the first.
Removed before write
- Buyer info
- Shipping address
- Tax info
- Cancel request
Defence in depth. Even an unexpected change on Amazon's side cannot create a log row that contains buyer data.
We don't keep it.
Orders are fetched live whenever we need them, and never kept in a long-lived cache. Only the five non-personal fields below are recorded, and they expire after seven days.
All that we keep
- Order ID
- Order total
- Order status
- Marketplace
- Purchase date
Five fields. Seven days. That's the entirety of what we hold about your orders — your ad attribution runs on that and nothing more.
Retention map
What we store. For how long. Then it's gone.
Every class of data in the system has a defined lifespan and a defined way to be deleted. Concrete numbers, no asterisks.
| Data class | Retention | How it's deleted |
|---|---|---|
Internal debug logs Conversations between AI agents and low-level model calls — useful for engineering, gone fast | 48h | Daily cleanup at 48 hours · also cleared on disconnect |
Amazon request log Which Amazon endpoints we called, with no buyer information | 7d | Daily cleanup at 7 days · also cleared on disconnect |
Decision history Every bid the AI considered, the inputs it used, the safety checks it passed | 30d | Daily cleanup at 30 days · also cleared on disconnect |
Simulation simulations Every simulation-mode bid the AI would have placed, with the math behind it | 90d | Daily cleanup at 90 days · also cleared on disconnect |
Access audit log Every read of your Amazon data, with who and when — kept long for forensic reasons | 365d | Retention sweep only — the log itself is append-only |
Orders / buyer info We fetch this live whenever we need it, we never write it down | — | Never stored — nothing to delete |
Amazon connection Encrypted in place with AES-256-GCM — never readable in plain text | ≤30d | Removed within 30 days of disconnect |
Search-query insights Brand Analytics snapshots used to track your organic visibility | ≤30d | Removed within 30 days of disconnect |
Reviewed every six months. If you'd like a copy of the policy, write to privacy@mirox.pt.
Append-only access log
Every read of your data, on the record. For 365 days.
Every time we — or you — open something that touches your Amazon data, our database writes a permanent receipt. Permanent in the literal sense: the database refuses to let us edit or delete it.
Edits blocked
The database rejects every attempt to modify a row, by every user and every process.
Deletes blocked
Removing a row is only possible through the scheduled retention job, and only for rows past 365 days.
Most software stores logs. We store logs in a place where even our own engineers cannot quietly change history. That's the difference between a policy and a constraint.
- id
- 47281
- tenant_id
- t-7c4a…2f9
- user_id
- u-a91…03b
- action
- Read keyword history
- resource_type
- keyword
- resource_id
- 8432
- ip
- 87.x.x.x
- user_agent
- Mozilla/5.0 (Macintosh; …)
- occurred_at
- 2026-05-28T14:23:11Z
Reads that leave a receipt
- Opening an orders report
- Viewing Simulation Mode bids
- Pulling a keyword's bid history
- Exporting decision traces
- Listing your seller campaigns
Every one — by any user, by any of our engineers. There is no back-door.
Right to be forgotten · 30-day SLA
Disconnect, 30 days, and it's gone.
GDPR Article 17 and Amazon's Data Protection Policy both require deletion within 30 days of disconnect. We don't promise it — we make it happen, automatically.
You disconnect
You disconnect the Amazon connection in the dashboard, or cancel your subscription. The clock starts.
We schedule the deletion
Your erasure is queued and dated. Even years later, you can prove when it happened.
A daily check
Our scheduler wakes once a day. The moment your 30-day timer expires, your data is queued for removal — without anyone needing to push a button.
Everything is cleared
Every cache, every config, every credential — in that order. Your Amazon connection itself is removed last.
What gets cleared
Every place we hold your data, in order
Caches & telemetry
Everything we cached to keep the dashboard fast — catalog data, inventory snapshots, pricing, bid history, decision traces. Cleared first because there's no reason to keep them around.
Seller configuration
Everything we built on top of your account — keyword lists, ASIN settings, campaign groupings, marketplace profiles. Whatever we knew about how you run your account.
Amazon connection
The connection itself is removed last. After this step, there's no path back into your Amazon account from our side — you'd have to reconnect.
Need it now
Immediate erasure — Article 17
Email privacy@mirox.pt and ask for immediate erasure. We process Article 17 requests within five business days.
Forensic record
The deletion itself is kept
We keep a single record that your deletion happened, on the date it happened. Even years later, you can ask us to confirm — and we will.
Simulation Mode · what you actually see
Every decision, side-by-side with what your current setup did.
Below is an illustrative Simulation Mode panel. Mirox runs read-only on your real account, for as long as you like. You see the bid the AI would have placed, what it cost vs your current spend, and the trace behind every call — before a single euro is committed.
Decisions traced
1,284
Would-have spent
€2,847
Your actual spend
€3,612
Delta if you flipped live
−€765 / −21%
| Keyword / ASIN | Your bid | Mirox bid | Δ | Why (trace) |
|---|---|---|---|---|
organic pre-workout B0XXX1A2B3 | €1.85 | €2.45 | +32% | pCVR 3.2× category mean · ROAS headroomtrace |
vegan supplements B0XXX4C5D6 | €0.95 | — | paused | ACoS 184% · 21d losing streak · safety floortrace |
caffeine free pre-workout B0XXX7E8F9 | €1.40 | €1.65 | +18% | ToS placement +50% · seasonality matchtrace |
magnesium glycinate 400mg B0XXXG1H2I | €2.20 | €2.05 | −7% | Sentinel: L_eff 16d · inventory throttletrace |
Illustrative · real Simulation panels render your account, your keywords, your numbers
Ready when you are
The AI that shows its work.
Real account, read-only, free indefinitely — every bid the AI would have placed, every alternative it ruled out, every safety gate it passed. Decide from data, not promises.
Public Simulation Mode opens after the program · one email when the door opens · no drip