Privacy policy

MIRA BUILDING INVENTORY TECHNOLOGY AB, reg. no. 559477-7939, Läraregatan 3, 412 92 Gothenburg, Sweden.

Send data protection questions to info@miratechnology.eu.

We are the controller for user accounts and sign-in, security logs, contact and demo requests, customer relationships, web analytics on the public pages and the shared property register.

The content a customer adds to its projects (inventories, samples, drawings, photos, reports and details of clients and other people) we process on the customer’s behalf. For that content the customer’s organisation is the controller and we are its processor under a data processing agreement. For questions about that data, contact the organisation that runs the project. Requests that reach us are forwarded to it.

• Account and sign-in: email address, name, profile picture, role, organisation membership, passkeys (public key and name) and sessions with IP address and browser. We use them to create and manage your account, sign you in and tell you about events on your account. Legal basis: contract, or our and your employer’s legitimate interest when you use the Service at work.
• Security and audit: an audit log (who did what, when and from which IP address) and server logs. We use them to protect the Service and customer data, detect intrusion attempts and investigate incidents. Legal basis: legitimate interest.
• Contact and demo requests: name, email address, phone, company and your message. They reach us by email and are not stored in the Service’s database. The form is protected against spam with Google reCAPTCHA. Legal basis: legitimate interest and steps prior to a contract.
• Customer relationship and contracts: contact people at customers, correspondence and billing details. Legal basis: contract and legal obligation (bookkeeping).
• Web analytics: visitor statistics with Google Analytics on the public pages, only if you have consented in the cookie banner. Analytics tools are not used in the signed-in part of the Service. Legal basis: consent.
• Property register: property designation, address and owner details, and who has claimed a property, with supporting evidence, and who has changed its details. Legal basis: legitimate interest in an accurate shared register.

We never sell personal data and do not use customer data to train AI models.

We use the following providers (sub-processors). They process data only on our instructions and under contract.

• Beebyte AB, Sweden: the server that runs the Service and the database.
• Cloudflare, Inc.: file storage (photos, drawings, documents and encrypted backups) within the EU, and DNS.
• Amazon Web Services EMEA SARL: email delivery (sign-in links, invitations and notifications) from Stockholm.
• Google: waste code search (the search text), spam protection on the contact form (reCAPTCHA) and, with consent, visitor statistics.

We also disclose data where the law requires it, for example to a public authority.

Project data and accounts are stored within the EU/EEA. Google, Cloudflare and Amazon have parent companies in the USA, and some data (for example search texts and visitor statistics) may be processed there. In that case we rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

• Account: as long as the account exists. A deleted account is purged or de-identified within 30 days.
• Sign-in: a sign-in link is valid for 15 minutes. A sign-in ends after 60 minutes of inactivity and after 10 hours at the latest.
• Audit log: IP addresses are truncated after 90 days and entries are deleted after 24 months.
• Server logs: 90 days.
• Backups: 8 weeks. Deleted data therefore disappears from backups no later than 8 weeks after deletion.
• Contact and demo requests: 12 months after the last contact, unless a customer relationship follows.
• Accounting records: 7 years under the Swedish Bookkeeping Act.
• Project content: according to the customer’s instructions. When a customer contract ends, the customer’s data is deleted within 30 days, unless the contract sets a different period, for example for delivered reports.

All traffic is encrypted with TLS. Files and backups are stored encrypted. Sign-in is passwordless, with a one-time email link or a passkey. Access is checked on the server for every request, and access and changes are logged.

You have the right to:

• know what data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data erased;
• ask us to restrict processing, and object to processing based on legitimate interest;
• receive data you have provided in a machine-readable format (data portability);
• withdraw consent at any time, for example to web analytics.

You can export your data and request deletion of your account in your account settings, or contact us at info@miratechnology.eu. We reply within one month.

If you believe we process your data incorrectly, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

The Service stores data in your browser to keep you signed in, remember your language and work offline. This storage is necessary for the Service to work. Project data stored for offline work is removed from the device when you sign out.

Analytics cookies are set only on the public pages and only if you consent in the cookie banner.

We update this policy when our processing changes. The date at the top shows the current version. For material changes we notify you by email or in the Service.