Version 1.0 · Effective 31 August 2026
Privacy Policy
Mira asks you more personal questions than most apps ever will. This page says exactly what happens to the answers — written to be read, not to be survived.
The short version
Your answers are used to match you. No human reads them, they are never shown on your profile, and they are never sold.
Your verification video is deleted 30 days after review.
We store the city you are in, never a precise position, and never show it to another user.
Delete your account and everything goes within 30 days.
This summary is not a substitute for what follows. Where they differ, the text below applies.
1. Who is responsible for your data
The Umbrella Company (“Umbrella”, “we”, “us”) is the controller of the personal data described here. We are established in the Kingdom of Saudi Arabia, at [Registered address], commercial registration number [CR number]. For anything in this policy, write to info@theumbrellaai.com.
This policy is written to the Saudi Personal Data Protection Law and its Implementing Regulations.
2. What we collect
What you give us
- Your phone number, and your email address if you add one.
- Your first name, date of birth, gender and whether you show it, marital history, the city you are in, and the passions you pick.
- The avatar you choose, and any photographs you upload.
- Your answers to the 56 questions, including which five areas matter most to you and which requirements you mark as firm.
- What you are looking for — marriage within a year, marriage without a fixed timeline, or getting to know someone first.
- Your verification video.
- The messages, photographs, video and voice notes you send in a conversation.
- Reports you make about another person, and anything you write to support.
What we work out from that
- Your position in the model, and your compatibility score with other people.
- Which people are eligible to be introduced to you.
- Your account state: verified or not, which conversations are open, whether you are locked, your streaks, and whether you have Mira Plus.
What your device gives us
- Device model, operating system and app version, language, time zone, and an app-generated identifier.
- Your notification token, so we can send you a push.
- Your IP address, and the city derived from the location permission you granted.
- Crash reports and performance data.
- In-app events — which screens you opened and which actions you took — and session recordings of your own use of the app, used to find where the app is confusing or broken.
- Your device’s advertising identifier, but only if you allow tracking when iOS asks.
What we do not collect
Your contacts or address book. Your precise position — we store a city, not coordinates. Your activity in other apps or on other websites, except the install attribution described below, and only where you allowed tracking.
3. Sensitive data
Some of the questions ask about matters the Personal Data Protection Law treats as sensitive — your religion and how faith shapes your day, and whether you smoke. We ask because they are among the things that most decide whether two people can build a life together, and we rely on your explicit consent, given when you answer.
These answers are treated exactly like every other answer: encoded, compared, never displayed on your profile, never shown to another user, and never shared with a third party for their own purposes. You can withdraw consent by deleting your account, or by writing to us.
Your verification video shows your face. A person reviews it to confirm you are real. We do not run facial recognition on it, we do not derive a biometric template from it, and it is deleted 30 days after review.
4. Why we use it, and on what basis
We rely on the bases the Personal Data Protection Law allows: your consent, the performance of our agreement with you, our legitimate interests where they do not override your rights, and compliance with a legal obligation.
| Purpose | Data used | Basis |
|---|---|---|
| Create and secure your account | Phone number, email, device and sign-in data | Our agreement with you |
| Confirm you are a real person | Verification video | Our agreement with you, and our legitimate interest in keeping Mira safe |
| Match you and choose introductions | Your answers, age, city, marital history and intent | Our agreement with you; explicit consent for sensitive answers |
| Deliver your conversations | Messages, photographs, video, voice notes, notification token | Our agreement with you |
| Keep people safe and act on reports | Reports, the messages in a reported conversation, account and device signals | Legitimate interests, and legal obligation |
| Take payment for Mira Plus | Subscription and purchase state | Our agreement with you, and legal obligation |
| Fix and improve the app | In-app events, session recordings, crash and performance data | Legitimate interests |
| Measure which campaigns bring people who are serious about marriage | Advertising identifier, install and event data | Your consent, through the iOS tracking prompt |
| Send you news, updates and offers | Email address | Your consent, withdrawable at any time |
We do not use your answers or your messages to target advertising, and we do not make any decision with a legal effect on you by automated means. Matching decides who you are shown; it does not decide anything about your rights.
5. Who sees it
Other people on Mira
Someone you are introduced to sees your first name, your age, your city, your avatar, your passions, whether you are verified, and the three reasons you were matched. She does not see your answers, your phone number, your email, your position, or which requirements you marked as firm. Your photographs appear only after you have both asked to open them.
Companies that process data for us
Each of these acts on our instructions under a written contract, and may not use your data for its own purposes.
| Processor | What it does | What it receives |
|---|---|---|
| Google (Firebase, Google Cloud) | Sign-in, database, file storage, server functions, push notifications, app analytics | Effectively everything: account, profile, answers, messages, media, device data |
| Mixpanel | Product analytics and session recording | In-app events, device data, and recordings of your use of the app |
| AppsFlyer | Install and campaign attribution | Device identifiers and a limited set of install and conversion events — only where you allowed tracking |
| Adapty | Subscription management | Subscription and purchase state, and an app-generated identifier |
| Apple, Google | Sign-in, app distribution and payment | Sign-in identifiers and purchase records, under their own privacy policies |
Anyone else
We disclose personal data to a public authority only where the law of the Kingdom requires it or where there is a serious risk to someone’s life or safety, and we disclose the least that answers the request. We do not sell personal data, and we do not share your answers or your messages with advertisers. If Mira is ever sold or merged, we will tell you before your data moves, and this policy continues to apply until you are told otherwise.
6. Where your data is stored
Mira’s database, file storage and server functions run in Google Cloud’s europe-west1 region, in Belgium — the closest region to the Kingdom that supports every service Mira needs. Some of the companies listed above also process data in the United States and elsewhere.
That means your personal data is transferred outside the Kingdom. We make those transfers under the conditions the Personal Data Protection Law sets for transfer abroad, with a written contract with each processor covering security, confidentiality, and the limits on what they may do with it. You can ask us for details of the safeguards that apply to a particular transfer.
7. How long we keep it
| What | How long |
|---|---|
| Your account, profile and answers | Until you delete your account, then erased within 30 days |
| Messages and media in a conversation | For as long as the conversation exists; erased with your account within 30 days |
| View-once photographs and video | Deleted once opened, or once it expires unopened |
| Verification video | Deleted 30 days after review |
| Reports and moderation records | Kept after an account is deleted where we need them to protect other people or meet a legal obligation, and no longer |
| Purchase and subscription records | As long as tax and accounting law requires |
| Analytics events, session recordings and crash data | [Retention period — confirm in Firebase and Mixpanel] |
Deletion is not instant because a conversation cannot vanish mid-sentence for the person still in it. Your account closes immediately, stops being visible, and is then erased by a scheduled job within 30 days.
8. Your rights
Under the Personal Data Protection Law you have the right:
- to be informed of how and why we use your data — that is this page;
- to access the personal data we hold about you;
- to obtain a copy of it in a readable, transferable format;
- to have it corrected, completed or brought up to date;
- to have it destroyed where we no longer need it for the purpose we collected it; and
- to withdraw consent at any time, where we relied on your consent.
Write to info@theumbrellaai.com from the email address on your account, or from the phone number, and tell us what you need. We answer within 30 days. We may ask you to confirm your identity first — for a service that holds this much, we would rather be slow than hand your data to someone else.
If you are not satisfied with how we handled it, you can complain to the Saudi Data & Artificial Intelligence Authority (SDAIA), which supervises the Personal Data Protection Law.
9. The choices in the app
- Notifications — per type, and message previews on the lock screen are off by default.
- Tracking — iOS asks before AppsFlyer may read your advertising identifier. Declining changes nothing about who you are matched with.
- Discreet mode — nobody can request an introduction, and your region stops glowing. Existing conversations are unaffected.
- Guardian access — off unless you turn it on, read-only, and always disclosed to both people in the conversation.
- Photo visibility — locked until both of you ask.
- Marketing email — opt-in, and you can unsubscribe from any message.
- Location — a city, which you can change in your profile.
10. Security
- The app cannot write to the database directly. Every write goes through a server function that takes your identity from your authenticated session and never from the request — so nothing in the app can raise its own status, fake a match, or write to someone else’s account.
- Data is encrypted in transit, and encrypted at rest by our hosting provider.
- Access to production data is limited to a small number of named people and is protected by a password and a signed session.
- Screenshots and screen recording are blocked inside the app on both platforms.
No system is perfectly secure. If you believe you have found a problem, write to info@theumbrellaai.com and we will look at it. Where a breach is likely to harm you, we will tell you and notify the authority, as the law requires.
11. People under 18
Mira is for adults. We do not knowingly collect personal data from anyone under 18, and an account we find to belong to a minor is removed and its data erased. If you believe a minor has an account, tell us at info@theumbrellaai.com.
12. Changes to this policy
We will change the version and date at the top of this page, and tell you in the app before a material change takes effect. Where a change needs your consent, we will ask for it rather than assume it.
13. Contact
The Umbrella Company · [Registered address] · info@theumbrellaai.com
Personal data enquiries and rights requests: info@theumbrellaai.com