Privacy Policy

MiraForms is operated by GIM Agency, Greece. For privacy questions or to exercise your rights, write to sales@gimagency.gr.

For the answers collected through a customer's form, that customer is the controller and MiraForms is the processor acting on their instructions.

Account data: name, email address, password hash, language and theme preferences, team role.

Form data: the forms you build, their settings and branding, and the responses submitted to them — including partial responses saved automatically while someone is filling a multi-page form.

Billing data: plan, subscription status and invoice history. Card details are handled by Stripe and never reach our servers.

Technical data: IP address, browser type, pages visited and basic usage events, used for security and for improving the product.

To provide the service: building forms, collecting and storing responses, sending notification, autoresponder and resume-link emails, and producing analytics and reports.

To handle payments and comply with accounting and tax obligations.

To keep the platform secure: spam and abuse prevention, rate limiting and audit logging.

Legal bases: performance of our contract with you, our legitimate interest in a secure and functional product, and your consent where required (for example marketing emails or optional cookies).

Supabase — database, authentication and file storage, hosted in the EU.

Stripe — subscription payments and invoicing.

Resend — delivery of form notifications, autoresponders, resume links and digest emails.

Google (Gemini via our AI gateway) — only the text you explicitly send to the AI builder or AI insights features.

Google Tag Manager and any analytics tags configured through it, when enabled on our public website.

We never sell personal data and we never use your form responses to train AI models.

We use essential cookies to keep you signed in and to remember your language and theme. These cannot be switched off.

On our public website we may load Google Tag Manager to measure traffic and campaign performance. Public forms you publish do not carry our marketing tags.

Account and form data: for as long as your account exists. After deletion, data is removed from live systems and backups within 30 days.

Partial responses with resume links expire automatically after 30 days.

Invoices and accounting records: retained for the period required by Greek tax law.

Data is stored on servers in the European Union. Where a processor transfers data outside the EEA, it is covered by the European Commission's Standard Contractual Clauses.

Traffic is encrypted in transit, data is encrypted at rest, and access to each account's data is enforced at database level with row-level security. Passwords are hashed and never stored in readable form.

Form passwords, API keys and other secrets are stored separately and are never returned to the browser.

You can request access, correction, deletion, restriction or portability of your data, and object to processing based on legitimate interest. Most of this is available directly in the app: export responses, delete forms, delete your account.

Write to sales@gimagency.gr and we will respond within 30 days. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (dpa.gr).

If we change this policy materially, we will notify you by email or in the app before the change takes effect.