Privacy Policy

This Privacy Policy explains how MIRAGOR EXPERIENCES OÜ ("Miragor", "we", "us") processes information in connection with its digital services, including Instagram automation, WhatsApp Business Platform integrations, Embedded Signup and specialised concierge automation.

1. Scope and roles

This policy applies to Miragor-operated applications and integrations. When a business connects its own Instagram professional account or WhatsApp Business Account, that business generally controls its end-customer communications and Miragor processes the relevant data to provide the requested service. Miragor may act as an independent controller for account administration, security, billing, compliance and its own direct customer relationships.

2. Information we process

Account and business information

• Names, business names, contact details and account preferences.
• Meta Business Portfolio, Page, Instagram account, WhatsApp Business Account and phone-number identifiers.
• Connection status, permissions, configuration and technical authentication records. Credentials and access tokens are restricted and protected.

Instagram integration data

• Comments, usernames and permitted profile information.
• Comment, media, account and message identifiers, timestamps and reply status.
• Automation rules, delivery results, analytics and error logs.

WhatsApp Business Platform data

• WABA ID, Phone Number ID, display name, business profile and onboarding status.
• Message templates, template status and messaging configuration.
• Inbound and outbound message content, telephone numbers, attachments, delivery/read status and webhook metadata when required to provide the service.
• Conversation history, routing decisions, support records and automation logs.

3. How we use information

• Connect and administer authorised Meta business assets through official Meta APIs and Embedded Signup.
• Receive webhooks, route conversations, send requested replies and display conversation history.
• Provide specialised concierge, customer-support and business automation features.
• Maintain security, prevent fraud and duplicate processing, troubleshoot errors and audit system activity.
• Comply with legal obligations, enforce our terms and respond to privacy requests.
• Improve service reliability and performance using aggregated or appropriately minimised analytics.

4. Legal bases

Where the GDPR applies, processing is based as appropriate on performance of a contract, legitimate interests in providing and securing the service, compliance with legal obligations, or consent. A connected business is responsible for identifying its own lawful basis and providing required notices to its end users.

5. Automated processing and AI

Where enabled, message content may be processed by automated classification or AI services to generate replies, extract service requests or route a conversation. Automation supports a defined business use case and may be reviewed or overridden. Miragor does not sell message content or use it to build advertising profiles.

6. Sharing and subprocessors

Information is shared only as needed with Meta and WhatsApp, infrastructure and hosting providers, communications providers, security and monitoring services, payment providers, and AI providers where the relevant feature is enabled. Providers are limited to the data needed for their function and are subject to contractual or platform obligations. Information may also be disclosed when required by law or to protect users and the service.

7. International transfers

Service providers may process data outside the European Economic Area. Where required, Miragor relies on recognised safeguards such as adequacy decisions or contractual protections.

8. Retention

We retain information only while necessary to operate the service, maintain security and audit records, resolve disputes and meet legal obligations. Connected-account data is removed or anonymised after termination or a verified deletion request, subject to limited legal, security and backup retention. Backup copies are deleted through the normal backup lifecycle.

9. Security

We use access controls, transport encryption, restricted credentials, logging and other technical and organisational measures appropriate to the service. No method of storage or transmission can be guaranteed to be completely secure.

10. Your choices and rights

Depending on applicable law, individuals may request access, correction, deletion, restriction, portability or objection, and may withdraw consent. Users can revoke Meta application access through their Instagram, Facebook or Meta business settings. See our Data Deletion Instructions or contact info@miragor.it.

11. Changes

We may update this policy when our products, providers or legal obligations change. The current version and update date will remain available at this URL.