Privacy Policy
Last updated: October 2026
This policy explains what personal information Mirlaval holds about you, why, who else sees it, how long it is kept and what your rights are.
Who we are
Mirlaval is operated by Alcestra, registered in France. Address: [ADDRESS]. Alcestra is the data controller for the personal data processed through Mirlaval.
For anything about this policy, your data or your rights, write to contact@mirlaval.com.
What we hold and why
- Account details: your email address and a password (stored only in scrambled form), the country and language recorded on your invitation, and your language choice. Needed to create and run your account. Basis: performing the agreement with you.
- Your business information: the business profile, services, prices, costs, revenue, stock, notes and quotes you enter. Needed to give you your margin figures. Basis: performing the agreement with you.
- Conversations with Claire and Léo, once those assistants are available to you: your messages and their replies, so they can help you. Basis: performing the agreement with you.
- Proof of acceptance: the date and version of the Terms and Privacy Policy you accepted. Kept as evidence of the agreement. Basis: our legitimate interest in being able to prove it.
- Technical and security data: your IP address and request details, handled by our hosting provider to deliver the site and protect it from abuse. Basis: our legitimate interest in keeping the service secure.
The first time you visit, the country your connection comes from, as worked out by our hosting provider, is used only to choose between English and French. We do not store it.
We do not use your data for advertising, we do not sell it, and we do not use it to train AI models.
Who else handles your data
We use a small number of providers who process data for us, under contract:
- Supabase: database and sign-in. Your data is stored in the European Union (Ireland).
- Cloudflare: hosting, delivery and protection of the website.
- An email delivery provider: to send invitations, confirmation links and password resets.
- An AI model provider: once Claire and Léo are available, the text you send them is passed to the provider to produce a reply.
Where a provider handles data outside the European Economic Area, we rely on safeguards such as the European Commission's Standard Contractual Clauses. We do not sell or rent your data to anyone, and we share it with authorities only where the law requires it.
How long we keep it
Account and business data are kept while your account is open. When you ask us to close it, we delete your data within 30 days, apart from copies that sit in backups, which disappear in the normal backup cycle, and anything we must keep by law.
Proof of acceptance is kept as long as we may need it to defend our rights. Security data is kept only as long as it is needed to protect the service.
Security
Everything travels over HTTPS. Passwords are never stored in readable form. Access rules in the database make sure each business can only see its own information, and sign-up is limited to people we have invited.
If you find a security problem, please tell us at contact@mirlaval.com.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data erased;
- receive your data in a portable format;
- object to processing based on our legitimate interests, or ask us to restrict it;
- withdraw consent where we rely on it, without affecting what was done before.
To use any of these rights, write to contact@mirlaval.com. We aim to answer within a month. You can also complain to the data protection authority; in France that is the CNIL.
Age
Mirlaval is for adults running a business. We do not knowingly collect data from anyone under 18.
Changes to this policy
We may update this policy. The date above shows the latest version. If a change matters to how your data is used, we will tell you by email.