Privacy Policy

Last updated 1 October 2026

Mirror Panel is a synthetic consumer research tool. You bring marketing material — a tagline, a concept, a question — and we simulate how a demographically representative panel would respond. This policy describes what we collect from you in the course of that, and what we do with it.

What we collect

Category	What it is
Account details	Your email address and display name, held in Amazon Cognito, which is where you sign in. Your membership of each brand workspace, and of an organisation where you belong to one — your user id, your email, your role or permissions — is a separate record in our own database, so closing the Cognito account does not by itself remove it.
Study content	The material you submit for testing, the audience filters you choose, and the results we generate — scores, written responses, and the panel profiles behind them.
Brand settings and assets	Brand descriptions, attribute overrides, and any images or files you upload to use in a study.
Billing details	Your plan, credit balance, and the identifiers Stripe gives us. Checkout also asks for a billing address, which Stripe keeps against your customer record for renewals. Card numbers and the address go to Stripe directly; Mirror Panel never holds either.
Invitations	Inviting someone to a brand records the email address you invited, who invited them and the role offered. That happens whether or not they ever accept, so we may hold an address for a person who never became a user.
Enquiries	If you ask for a pilot from the home page without an account, the email address you type is sent to our inbox so we can reply. No account is created.
Interest signals	Asking for a custom audience records the request against your brand: your email, your user and brand ids, the page you asked from, the host, and your browser's user agent.
Usage and session data	Pages visited, actions taken, and errors encountered, including session replays and heatmaps collected through Microsoft Clarity.

How it is used

• Running the studies you ask for, and showing you the results.
• Authenticating you and keeping each brand workspace separate from every other.
• Billing, where you are on a paid plan.
• Diagnosing failures and understanding which parts of the product are used, so we can improve them.
• Meeting legal obligations, and enforcing our terms.

We do not sell your data, and we do not use the material you submit to train our own models.

Who it is shared with

Mirror Panel runs on Amazon Web Services in the United States (us-east-1); study data and assets are stored there. Beyond AWS, these processors receive data:

Processor	What it receives, and why
Model providers	The material you submit and the audience context for it, sent to the models that generate panel responses: Amazon Bedrock, OpenAI, Google Vertex AI, and Anthropic. Interviewing a respondent sends more: the question you type, the transcript so far, and the response being discussed. Which providers are used depends on the models configured for your study.
Stripe	Payment and subscription details, where you are on a paid plan. Purchases are sold through Link, Stripe's merchant-of-record service: Stripe takes the payment, collects any sales tax, VAT or GST due for your billing address, and handles payment support. We receive status and identifiers, not card data.
Microsoft Clarity	Session analytics — page views, interactions, replays and heatmaps. Signed-in sessions are labelled so we can trace a reported problem to the session that produced it; that label includes your email address and display name.
Google	Choosing “Continue with Google” hands the sign-in to Google, which tells it that you signed in to Mirror Panel and returns your email address and name to us. Separately, every page loads its typefaces from Google Fonts, so your browser requests them and Google sees the IP address that asked.
Sanity	Blog posts and some documentation are fetched from Sanity's content CDN by your browser, so opening those pages tells Sanity your IP address and what you asked for. Nothing about your account is sent.
Slack	Only if you install the Mirror Panel Slack app: the commands you run there and the results returned to your workspace.

We also disclose data where the law requires it, and to a successor if the business is acquired.

How long it is kept

• Account details: for as long as your account exists.
• Studies: deleting one removes the study and its summary from the product.
• Uploaded assets: deleting one removes it from the product immediately. Object storage keeps previous versions of a file, and those copies are not purged automatically, so write to support@mirrorpanel.io if you need an upload erased outright.
• Records created while a study ran: kept after the study is deleted. That covers the individual panel responses, the run plan (which includes the material you submitted), and any interview transcripts. Responses are stored against a hash of the material they rated and reused when the same material is tested again, which is what makes a repeat study fast. Write to support@mirrorpanel.io to have any of it erased.
• Billing records: as long as tax and accounting rules require, which is typically seven years.
• Invitations, enquiries and interest signals: kept until erased on request. An expired invitation stops working but is not deleted.
• Nothing else expires automatically unless it says so above. Where a record is not listed here, assume it is kept until you ask us to remove it, and ask.
• Session analytics: according to Microsoft Clarity's own retention period.

Your choices

• Delete a study or an asset from within the product at any time.
• Ask us to delete a brand workspace, or the panel responses behind a deleted study, by writing to support@mirrorpanel.io. Neither can be removed from within the product today.
• Ask us to export or delete your account and everything in it, by writing to support@mirrorpanel.io.
• Disconnect an AI assistant (Claude, ChatGPT) or the Slack app at any time from that tool's own settings, which removes Mirror Panel from it and stops it making further requests. We cannot yet revoke a credential that has already been issued: an access token stays valid until it expires, within 12 hours, and a refresh token the assistant retains can obtain new ones for up to 30 days. Tell us at support@mirrorpanel.io if you think a credential has been misused.
• Block session analytics with a tracker-blocking extension. There is no in-product opt-out today: the analytics script loads with the page, so declining cookies in your browser does not stop it. Write to support@mirrorpanel.io to be excluded and we will arrange it.

If you are in the UK or the EU you also have rights of access, correction, erasure, portability and objection under the UK GDPR and GDPR. Write to support@mirrorpanel.io and we will answer within one month.

AI assistants

Connecting Mirror Panel to Claude, ChatGPT or another MCP client authorises that assistant to read and act on your Mirror Panel data on your behalf, scoped to your account and the brands you can already reach. What the assistant then does with that data is governed by its own provider's privacy policy, not this one.

Contact

Questions, requests, or complaints: support@mirrorpanel.io.