What we collect, and what we do not

Mirakash is a product of Aikolumi Software Pvt Ltd, a company incorporated in India. Aikolumi Software Pvt Ltd runs this website, the Mirakash platform and the console at app.mirakash.com, and it is the company you contract with. It also holds the Meta developer app, the Meta Business portfolio and the WhatsApp Business Account behind Mirakash's WhatsApp features; what that means for data that comes from Meta is in section 12. For everything this page describes, Aikolumi Software Pvt Ltd is the controller: we decide what is collected and why. (India's DPDP Act calls this a "data fiduciary"; US state laws call it a "business" or a "controller".) "We", "us" and "Mirakash" on this page mean Aikolumi Software Pvt Ltd.

Who takes your payment. Card payments for Mirakash are collected for us by Naridon, Inc., a corporation incorporated in Delaware, USA, through Stripe, so your card statement and Stripe receipts name Naridon, Inc. That is its only part in Mirakash; how billing works is in section 09.

How to reach us. Every privacy question, request and complaint goes to one place: the form at /contact. It has options for seeing, deleting and correcting your data, for objecting to how it is used, for any other request and for appeals. It goes into our own system rather than a shared mailbox, and a person reads it. We do not publish an email address for privacy requests yet: the form is the route that reaches us.

If you are in the European Union, the United Kingdom or India, use the same form: it reaches the person who handles privacy requests and grievances for Mirakash.

Mirakash is a platform that businesses use to build AI agents: agents that answer and place phone calls, chat on websites and send messages. That gives us two different roles, and which one applies decides whose rules govern your data.

When the data is ours

Everything in sections 03 to 15 — this website, our own Guide assistant, the demo call, accounts, billing, verification, support, and our own security work. We are the controller, and this page is the policy.

When the data is a business's

When a business (our customer) uses Mirakash to run an agent, and you talk to it, are called by it or message it, that business is the controller of what is said and kept: the call audio, the transcript, the messages, the analysis of the conversation, any contact list you are on, and anything its agent looks up about you. We process that data on the business's instructions, as its processor (or "service provider"), under our Data Processing Addendum. The business decides whether calls are recorded, how long anything is kept, and what its agent is allowed to do, and the business's own privacy notice is the one that applies to you. The same is true of what a business keeps in its workspace on the console: the written agreement with that business governs it, not this page.

Where a business connects its own accounts with AI, speech, telephony or messaging providers to Mirakash, those providers work for the business under its own contract with them. They are the business's processors, not ours.

If that is you

• Ask the business first. It holds the decisions, and it is the one the law requires to answer you.
• If you cannot tell who it was, or cannot reach them, write to us at /contact. Tell us the number that called you or that you called, or the website you chatted on, and roughly when. We will work out which business it was, pass your request to them promptly, and help them answer it. We cannot overrule the business on its own data, but we act on its instructions and on what the law requires of us.
• If you do not want to be called by any agent on Mirakash, tell us through /contact (the option for an unwanted call or message). A member of staff will add your number to our platform-wide do-not-call list. Every call placed on Mirakash is checked against that list before it is dialled, whichever business places it, and so are WhatsApp template messages where WhatsApp is enabled.

How deletion works on both sides is explained step by step at /data-deletion.

This site is served by a CDN (Amazon CloudFront), and the CDN writes down every request it answers: the IP address it came from, the browser's user-agent string, the URL, the time, the response status and which edge location served it. Those log files land in a storage bucket in our own AWS account in eu-central-1 (Frankfurt) and are deleted automatically after 400 days.

This is not covered by the cookie banner and cannot be. Nothing is stored on your device and no cookie is involved — it is the web server writing down what it was asked for, which is what web servers have done since there were web servers. Switching it off would mean not knowing whether the site is up.

We query it in aggregate — visitor counts, popular pages, which AI crawlers read our pages — and to investigate an attack, never to build a profile of an individual. An IP address is still personal data, which is precisely why it is named here rather than quietly left out.

The servers behind the site and the console also write their own operational logs. Those are kept for 14 days, and they are written to avoid personal data: where an email address has to appear, it is masked.

We use Google Analytics 4 (property G-1P6WX2Q1NB) to see which pages get read, in what order, and whether anyone reaches the demo page. It writes _ga cookies to your device, which is exactly the thing you get asked about.

It runs only if you press Accept on the banner. Until then — and permanently, if you press Reject — Google's tag is not even requested from Google's servers: nothing is sent to Google and no cookie is written. If you accepted once and change your mind, rejecting also deletes the cookies that were already set.

If your browser sends a Global Privacy Control or Do Not Track signal and you have not answered the banner, we treat the signal as a no: you do not see the banner, and analytics stays off. You can still turn it on deliberately with the button at the bottom of this page. Your answer, whichever it is, stands for six months; after that we ask again.

Accepting turns on analytics and nothing else. We run no advertising, no remarketing and no ad personalisation, so the advertising permissions in Google's consent model stay denied even when you say yes. Asking for a permission we have no use for is the habit these rules exist to break.

Full details of each cookie are in the Cookie Policy. You can change your decision at any time — the button is at the bottom of this page.

The form on /demo sends us a work email address, which is the only field it requires, plus anything else you choose to fill in: your name, your company, a phone number, and what you would like an agent to handle. The form on /contact sends your email address, your name and company if you give them, the topic you picked and your message.

Along with that, they send things you did not type:

• the page you submitted the form from, and the site that referred you;
• on the demo form, any utm parameters on the URL, so we can tell which campaign or article brought you;
• your browser's user-agent string.

Your IP address is used to rate-limit the forms: more than five submissions an hour from one address is refused. It is held in the running server's memory for that and nothing else, and it does not survive a restart. It is never written to the database, and it is not stored with your enquiry. We send no automatic emails. Once a message on the contact form is saved, the form shows you a reference; keep it if you may need to follow up. A person reads it and replies.

We use all of this to reply to you, to arrange a demo, to handle what you asked for, and — for privacy requests — to show later that we did. There is no newsletter and no mailing list, and the record is not sold or given to anyone outside Mirakash. The submission is stored in our own Postgres database, running on AWS in eu-central-1 (Frankfurt).

There is an AI assistant in the corner of every page on this site, the Mirakash Guide. It is our own product, running on our own infrastructure — the same thing we sell — and this part deserves to be said plainly rather than buried: if you talk to it, the conversation is kept, and we read it.

Every message you send and every reply it gives is written to a conversation record in our console, the same kind of record a customer's phone call produces. Alongside the words, the record holds the address of the page you were on (without anything after a question mark), the language, the timing, which AI model answered, what the exchange cost us, anything the Guide did for you (such as opening another page of this site), your answers to any question card or form it shows you, and which version of the Guide you were talking to when we are testing two against each other. Your IP address is not stored with it.

We read those records to find where the Guide is wrong, to score it with the same automated quality rubric we sell to customers, and because a visitor's question is often the most useful product feedback we get. A chat widget is not usually expected to keep a transcript, so we would rather you knew before you typed.

To answer you and point you to the right part of the site, the Guide is given what is on the page you are looking at — its headings, links and some of its visible text — and the list of pages on this site you have opened in the same tab.

Before a transcript is stored, card numbers, bank account numbers and IBANs, national ID numbers, security codes and PINs, email addresses and other long strings of digits are masked in it. Phone numbers and dates of birth are not. Please do not put anything in the Guide you would not put in an email to us. It is a sales and support assistant, not a secure channel, and it has no way to verify who you are.

Voice. If you start a voice conversation, your browser asks you for the microphone first. The audio is streamed to our own voice gateway and transcribed, and the transcript is kept as above. The audio itself is kept only if the Guide tells you, on screen, that the conversation is recorded. If it does not say so, only the transcript is kept.

The content of the conversation is sent to the AI model and speech providers that handle it, in order to answer you — that is what an AI reply is. They are named on our sub-processors page, because speech recognition, the language model and speech synthesis are separate, swappable stages, and a list is easier to keep current than a paragraph. What they may do with it is in section 14.

The Guide keeps a short list of the pages of this site you have opened in the tab, so it can say "you have already looked at pricing". Until you first talk to it, that list is held only in the page's memory and is not written to your device. Once you have talked to it, the list — up to the last 12 page paths — moves into your browser's session storage (mirakash.widget.visited), along with a session id, the conversation so far, and the panel's size and position. All of it is per tab and is gone when you close the tab. The session id is also used to stop one visitor flooding the Guide with requests; if your browser does not send one, your IP address is used for that instead, and that counter is not kept with the conversation and is gone within a day.

You can ask one of our AI agents to ring you, so you can hear what one sounds like. You give us a phone number and choose a kind of agent; we send a one-time code to that number by text message (or, if the text cannot be delivered, a short automated call reads it to you); you type the code in; and the agent calls you once. The call ends after at most two minutes.

The agents in the demo play fictional businesses — a college admissions desk, a clinic reception and so on — with made-up sample facts. They are AI, you asked for an AI, and they say so if you ask. Nothing you say to them reaches a real clinic, shop or bank, so please do not give them real health, card or account details.

What we keep:

• The number you gave, the kind of agent you chose, and when it was called. We keep this with no end date, because it is how we make sure a number is only ever called once. It is not added to any marketing list and we do not call it again.
• A one-way, salted fingerprint of your IP address — not the address itself — so that one connection cannot request calls to many numbers in a day.
• The one-time code, only as a one-way hash. It expires after ten minutes, and is cleared once it is used or after five wrong tries.
• The call itself: the transcript; the audio, when the agent tells you at the start that the call is recorded; an automated summary; whether the call did what it set out to; the language; whether you asked if it was an AI; and a quality score.

A number on our do-not-call list is not called, even if it is entered here. Calls are allowed only to the countries we currently serve, and there are daily limits per address and overall; see section 21.

The console at app.mirakash.com is for businesses. Self-serve sign-up is closed: accounts are created by invitation, or after a conversation with us. If you have an account, or a colleague has invited you to their workspace, this is what we hold.

• Your profile: email address, first and last name, when you verified your email address, and when you accepted our Terms and which version.
• Your password, only as a one-way hash (scrypt). We cannot read it, and nobody at Mirakash will ever ask you for it.
• Two-step sign-in, if you turn it on: the secret behind your authenticator app, encrypted, and your recovery codes, hashed.
• Your workspaces and role (owner, admin, member or viewer), and invitations: the email address of the person invited and who invited them.
• Your sign-in sessions: when each started and was last used, whether two-step sign-in was passed, and a coarse device label such as "Chrome on macOS". Not your IP address.
• An audit trail of what is done in a workspace: the action, the time, the email address of the person who did it, and their IP address and browser.
• Sign-in protection counters: to slow down password guessing, failed attempts are counted per IP address and per email address (the email address hashed). They are deleted after a day.

We send you service emails — verifying your address, resetting a password, invitations, billing notices — through an email delivery provider. Owners and admins of a workspace can see its members and its audit trail.

There is no button to delete your account yet. To close it, ask through /contact and a member of staff will do it within 30 days, keeping only what section 26 says we must.

Paid plans are sold by Aikolumi Software Pvt Ltd, and card payments are collected for us by Naridon, Inc. (Delaware, USA), in every country. You pay on Stripe's own hosted checkout page, so your card details go to Stripe, not to us: we never receive or store a full card number.

From Stripe we get what we need to run your account: your billing name and address (the checkout requires one), your email address, what you bought and for which workspace, the amounts, invoices, and whether a payment succeeded, was refunded or was disputed. If a payment is disputed, the workspace is suspended automatically; see section 21.

Stripe also uses payment data for its own purposes, such as preventing fraud and meeting its own legal obligations, under its own privacy policy.

Before a business can have phone numbers or send texts in some countries, telephone carriers and regulators require us to know who it is. Registration schemes such as US 10DLC for business texting and India's DLT for commercial messages work the same way. So when a business asks for numbers or senders, we ask it for documents.

Depending on the country, that can include business registration and tax documents (in India, for example, a PAN), proof of address, an identity document of the person signing, and a letter authorising them. Agreements are signed by typing a name; we record the name, the time, the IP address and the browser, and add the signature to the workspace's audit trail.

Documents are stored encrypted in our database and checked by a member of staff. The details a carrier or registry requires are filed with the carrier or messaging provider, which files them with the regulator or registry.

When you ask us for help, or talk to us about buying, we keep what you send us, our replies, and notes about what you need: your company, your role, what you are trying to build. If you ask us to look at a problem in your workspace, a member of staff may look at the data in it — calls, agents, settings — as far as needed to fix it, on your organisation's behalf.

Mirakash can connect a business's WhatsApp number to its agents, so they can answer and send WhatsApp messages. That runs on Meta's WhatsApp Business Platform, through a Meta developer app and a WhatsApp Business Account registered to us, Aikolumi Software Pvt Ltd. WhatsApp is being rolled out and is not enabled for every workspace; this section describes what happens where it is enabled.

What we receive from Meta

• When a business connects its WhatsApp account(through Meta's own sign-up window): an access token for that account, which we store encrypted; the account's id; the phone number and its display name; whether Meta has approved the name; and the number's quality rating. We also hold, encrypted, the PIN used to register the number.
• When someone messages a connected number: the sender's WhatsApp phone number and profile name; the message — text, photos, videos, documents, stickers, voice notes and shared locations; when it was sent; its id; and which message it replies to. A photo is handed to the AI provider answering that conversation so the agent can see it, and a voice note is transcribed so the agent can read it; we do not keep the photo or the recording, only the transcript and a note that a photo arrived. We do not store the profile name.
• Delivery and read receipts: for each message an agent or a person sends, Meta reports whether it was sent, delivered, read or failed. We keep that state, Meta's error code if it failed, the times, and Meta's id for the message, so the business can see whether its reply arrived. Meta's message id can be decoded to the recipient's number, so we remove it after 30 days, when receipts have stopped arriving; the rest of the record goes when its conversation does.
• When an agent sends a message: the recipient's number, the content, and the approved template used, if any. Templates are read live from Meta and not stored.

What we do with it, and what we do not

Messages to a business's number are that business's data: we process them on its instructions (section 02). The connection details are ours to look after, so the integration works and stays secure. Either way, we use data from Meta only to provide the conversation it belongs to: to hand the message to the business's agent or inbox, to let the agent reply, to keep the conversation record for the business, and to keep the service secure.

• We do not sell, license or rent it.
• We do not use it for advertising, or to build profiles of people.
• We do not combine it with other data for any other purpose.
• We do not use it to decide anyone's eligibility for housing, work, credit, insurance or education, or for surveillance.
• We share it only with the providers needed to run the conversation — hosting, and the AI and speech providers that read and answer it — and where the law requires.

We handle this data as Meta's Platform Terms and developer policies require, and those terms bind us in addition to this policy.

Deleting it

A business that disconnects its WhatsApp account removes the access token and the number from Mirakash at once. Messages already received stay in that business's workspace under its retention settings, and the business can delete them. If you messaged a business and want your messages deleted, ask the business, or ask us and we will pass it on. The steps are at /data-deletion. Meta keeps its own copy under WhatsApp's terms, which we do not control.

A platform that places phone calls can be misused to harass people, so part of what we process exists to stop that. If an agent on Mirakash called or messaged you when it should not have, report it at /contact.

• Do-not-call lists. Numbers that asked not to be contacted, either by one business or by anyone on Mirakash. They are kept in our database with no end date, because a do-not-call request that expires is not one. Every call is checked against them before it is dialled, and so are WhatsApp template messages and the text and WhatsApp messages an agent starts. Entries are added by a business, by our staff, by an agent when the person asks it to stop during a conversation that has their number, and automatically when someone replies STOP (or a similar single word) by text, WhatsApp or RCS. A STOP reply that we cannot link to one business goes on the platform-wide list.
• Limits. Rate limits count requests per IP address, account or session; spend and usage limits stop a workspace when they are reached. When a limit cannot be checked, the request is refused rather than allowed.
• Destination rules. Outbound calls are allowed only to destinations we have enabled, and a call to anywhere else is refused.
• A web application firewall in front of the console screens requests for known attack patterns. It keeps no logs.
• Investigations. When we suspect the service is being used against our Acceptable Use Policy or the law, staff may look at the account and its activity to find out.

We use our own records — Guide conversations, demo calls, how the console is used, and what you tell us — to find mistakes and make Mirakash better. People on our team read conversations and scores to do that.

The learning loop

Mirakash has a feature that lets an agent learn from its calls, and it runs on calls handled for businesses as well as on our own. After a call is scored, an AI model reads the transcript and the score and writes short lessons: a tactic that worked or did not, a one-line takeaway, a short quote from the call as evidence, and a rough description of the caller (such as their role, age band, gender or region) where the caller said so. It is never guessed from a voice. The agent's later calls are given those lessons as instructions.

Where a business has told us what field and language an agent works in, lessons are by default also offered to other agents in the same field and language, including agents belonging to other businesses. The tactic, the takeaway and the caller description travel; the quote does not. When a call is deleted, by a retention window or an erasure request, its quote and its caller description are removed from its lessons, and the tactic and takeaway stay.

AI training

We do not train or fine-tune any AI model of our own on conversations. The learning loop above works by writing instructions, not by training a model.

The AI model and speech providers we use receive conversation content in order to answer it. Whether each of them keeps it, for how long, and whether it may use it to train its own models depends on that provider's terms and on the settings we use with it, and we are not going to print a blanket "your data is never used for training" that we have not checked provider by provider. What we know per provider is on the sub-processors page.

We turn some of what we hold into numbers that do not identify anyone: visitor counts from the access log, how many calls the platform handles, what they cost, average quality scores. We use those numbers to run and plan the business, and we may say them in public ("our agents handled this many calls").

Once data can no longer identify you, this policy's rights no longer apply to it. We keep such data in that form, and we do not try to work out who it was about.

On this website:

• _ga, _ga_1P6WX2Q1NB — cookies, Google Analytics, written only after you accept. Google's default lifetime is two years; rejecting deletes them.
• mirakash.consent.v2 — local storage, not a cookie, and never sent to any server. It holds your answer to the banner and when you gave it; after six months the answer lapses and you are asked again. We keep it so we do not ask you on every page, and it is the one thing here we do not ask permission for, because it exists to record a decision you already made. (An older key, mirakash.consent.v1, is deleted when the site sees it.)
• Guide keys, including mirakash.widget.visited — session storage, written only after you have talked to the Guide in that tab: session id, the conversation so far, panel size and position, and up to the last 12 pages of this site you opened. Cleared when you close the tab.

On the console at app.mirakash.com, if you have an account:

• __session — keeps you signed in.
• __mfa_challenge — holds a two-step sign-in while it is in progress.
• mk_locale — remembers the language you chose.

Those are needed for the console to work and are not used for tracking. There are no advertising cookies, no cross-site trackers, no social plugins, no session recording or heatmap tools, and no fingerprinting, on the site or in the console. Every cookie, what it holds and how long it lasts is in the Cookie Policy, and you can change your analytics choice at the bottom of this page.

We share personal data only with the kinds of recipient below, and only for the reasons given.

• Service providers who work for us — hosting and storage (Amazon Web Services), AI models and speech recognition and synthesis, telephony carriers and SMS providers, messaging (Meta, for WhatsApp), email delivery, payments (Stripe) and analytics (Google, only if you accepted). Each gets only what its job needs. They are named, with what each does and where, at /subprocessors.
• Naridon, Inc., which collects card payments for us through Stripe (section 09).
• The business you dealt with.A conversation with a business's agent belongs to that business, and it sees it in its workspace.
• Carriers, registries and regulators, for the business verification in section 10.
• Authorities, when the law requires it. We disclose personal data to courts, police or regulators only when the law requires us to, and where the law allows, we tell the business or person concerned first.
• Advisers — lawyers, accountants, auditors and insurers, under a duty of confidentiality, when we need their advice.
• A buyer or successor. If Aikolumi Software Pvt Ltd is merged, acquired, or sells the part of its business that runs Mirakash, personal data may pass to the new owner, which will be bound by the promises in this policy for the data it receives. We will tell you before your data becomes subject to a different policy.
• Anyone, with your permission, when you ask us to share something.

Business customers get advance notice before we add or replace a provider that processes their data — 30 days — and can object; how that works is in the Data Processing Addendum. Customers can ask to be told of changes at /contact.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We do not give it to data brokers or advertising networks, and there is no arrangement under which anyone gets a copy in exchange for anything.

Our own infrastructure is in AWS region eu-central-1, in Frankfurt, Germany: the database, the call recordings, the access logs and the servers that run Mirakash. That is where the data described on this page is stored.

Some of it is also processed elsewhere:

• the AI model and speech providers that handle a conversation process its content outside the European Economic Area, including in the United States — they are not pinned to EU locations;
• Stripe, Google, Meta and our telephony and messaging providers run global services, and a call or message is processed where the networks carrying it are;
• Aikolumi Software Pvt Ltd is a company in India, and the people who build, support and run Mirakash may access data from outside the EEA. Naridon, Inc., which collects card payments for us, is a US company.

Where the law requires a safeguard for a transfer out of the EEA, the UK or another country with such rules, we put one in place before the transfer. Which provider is in which country is on the sub-processors page. You can ask us through /contact for a copy of the safeguard that applies.

We keep personal data only as long as we need it for the purpose we collected it for, or as long as a law requires. Where a machine enforces the period, the table says so. Where nothing deletes the data automatically yet, the table says that too, rather than printing a number nobody enforces.

Deletion, and backups. When we delete something on request, it is gone from the live systems within 30 days of the verified request, or sooner where a law requires. It remains in database backups for up to 14 days after that, until they roll off; backups are used only to recover from a disaster.

What we actually do, stated as facts rather than adjectives:

• Connections to this website and the console are encrypted in transit (HTTPS).
• The database is encrypted at rest. Call recordings are stored encrypted (AES-256), and a deleted recording is gone: the storage keeps no older versions.
• The most sensitive values — two-step sign-in secrets, WhatsApp access tokens, and verification documents — are encrypted again by the application before they are stored.
• Passwords are stored only as scrypt hashes. Accounts can use two-step sign-in with an authenticator app, and a workspace can require it of every member.
• Sessions can be revoked, and expire after 8 hours without use and 7 days at most.
• Access in a workspace follows roles — owner, admin, member, viewer — checked on the server, not only in the browser.
• An append-only audit trail, chained with hashes so that an edited or deleted entry shows, records what is done in each workspace. A business can stream it to its own security monitoring.
• Card numbers, bank details and national ID numbers are masked in transcripts before they are stored, and an agent is stopped from reading a card number aloud.
• Rate limits, spend limits and a web application firewall stand in front of the service.

No system is perfectly secure, and we do not claim ours is. If a personal-data breach is likely to put your rights and freedoms at high risk, we will tell you without undue delay. We notify the authorities the law requires — under the GDPR, within 72 hours of becoming aware, where that rule applies — and we tell affected business customers without undue delay, and within 72 hours, as the Data Processing Addendum sets out.

If you find a security problem, please report it through /contact.

We do not make decisions about you that are based solely on automated processing and that have legal or similarly significant effects on you, except the ones listed here. Each is needed to provide the service safely, and each can be reviewed by a person.

• The demo call. A number is called only once while its demo entry is kept (12 months after its last use); each connection and the site as a whole have daily limits; calls go only to countries we serve; numbers on a do-not-call list are refused. Software applies these rules.
• Sign-in and sign-up. Too many failed attempts are refused for a while, and disposable email addresses are not accepted.
• Limits. A workspace that reaches a spend or usage limit stops placing calls until the limit is raised or topped up.
• Disputed payments. If a card payment for a workspace is disputed, the workspace is suspended automatically until the dispute is dealt with.

Our agents also score conversations automatically — whether a call did what it set out to, its quality, a summary. Those scores judge the agent's work, not you, and nothing is decided about you because of them.

If one of these decisions affects you, you can ask a person to look at it, tell us your side, and contest it, through /contact. A business's own agent may make other decisions — booking you in, routing your call — and that business is responsible for them.

Wherever you live, you can ask us to do any of the following with the data we hold as controller. If you are in the EU, the European Economic Area or the UK, these are your rights under the GDPR and the UK GDPR, and they are the baseline we apply to everyone.

• Access — tell you what we hold about you, why, where it came from and who has it, and give you a copy.
• Correction — fix it if it is wrong, or complete it if it is incomplete.
• Deletion — delete it, unless we have to keep it (see section 26).
• Restriction — keep it but stop using it, for example while we check a correction.
• Portability — give you what you gave us, in a common machine-readable format, or send it to someone else, where we process it on the basis of consent or a contract.
• Objection — stop processing we do on the basis of legitimate interest, unless we have compelling grounds; and stop any direct marketing, always.
• Withdraw consent — at any time, as easily as you gave it. For analytics, that is the button at the bottom of this page. Withdrawal does not undo what was lawful before.
• A person, not a program — ask for a human review of a decision made solely by software (section 21).
• Complain — to a data protection authority (section 26).

Where we rely on legitimate interests, you can ask us how we balanced them against yours. The legal basis for each activity is in its section above.

For data a business controls — its calls and messages with you — these rights are exercised through that business; we will help (section 02).

If you are in India, the Digital Personal Data Protection Act, 2023 and its Rules apply. For the processing on this page, Aikolumi Software Pvt Ltd is the Data Fiduciary and you are the Data Principal.

• Notice. This page is our notice: it says what we collect, why, and how to use your rights and complain.
• Consent, and withdrawing it. Where we rely on your consent, you can withdraw it at any time, as easily as you gave it — for analytics with the button at the bottom of this page, for anything else through /contact. We then stop, and ask our processors to stop, unless the law allows or requires us to continue. Withdrawal does not affect what was done before.
• Access. A summary of the personal data we process about you and what we do with it, and the identities of the other fiduciaries and processors we have shared it with, with a description of what was shared.
• Correction and erasure. Correct, complete or update it, or erase it when it is no longer needed or you withdraw consent, unless a law requires us to keep it.
• Grievance redressal. Complain to us through /contact. We will respond within the period the DPDP Rules prescribe.
• Nomination. Name another person to exercise your rights if you die or become unable to. Tell us through /contact whom you nominate.
• The Data Protection Board of India. If you are not satisfied with our answer to your grievance, you can complain to the Board.

You can ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India, through /contact.

If you live in a US state with a consumer privacy law — including California (the CCPA, as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas and Oregon — this section applies where that law does. Business contact information, such as a work email given to us in a business context, is covered by some of these laws and not others; we answer requests either way.

What we collect (notice at collection)

In the past 12 months we have collected these categories of personal information, from the sources and for the purposes in sections 03 to 15, and kept them for the periods in section 19:

We do not collect precise geolocation for our own purposes. We use sensitive personal information only for purposes the law permits without offering a right to limit — to provide the service, to verify businesses, and for security — and not to infer characteristics about you.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, and have not in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16. If your browser sends a Global Privacy Control signal, we treat it as a no to analytics unless you deliberately turn analytics on (section 04); because we neither sell nor share, there is nothing else for it to switch off. We do not disclose personal information to third parties for their direct marketing (California "Shine the Light"), and we do not sell covered information as Nevada law defines it.

Your rights

• Know and access — the categories and specific pieces of personal information we hold, its sources, our purposes, and whom we disclose it to.
• Delete and correct.
• Opt out of sale, sharing, targeted advertising and profiling with significant effects — none of which we do.
• Limit the use of sensitive personal information — which we already use only for the permitted purposes above.
• Portability — a copy in a usable format.
• No discrimination — we will not deny service, charge a different price or give a worse service because you used a right.

Authorised agents. Someone can make a request for you if you give them signed, written permission. We may ask you to confirm your identity with us directly, and to confirm you gave the permission, unless they hold a power of attorney.

Appeals. If we decline your request, in whole or in part, you can appeal through /contact: choose "Appeal a decision on my privacy request". A different person reviews it, and we will tell you the outcome and our reasons within the period your state's law sets. If you disagree with the outcome, you can contact your state's Attorney General.

The UAE.Mirakash is not yet available in the United Arab Emirates. Where the UAE's Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies to data we hold about you, you can ask us for information about how we process it, for a copy in a portable form, to correct or erase it, to restrict or stop processing, and to object to decisions made solely by automated processing; and you can complain to the UAE Data Office. The DIFC and ADGM free zones have their own data protection laws with similar rights, and you can use them the same way.

Everywhere else. Mirakash is available only in some countries, and that list changes. Wherever you are, you can use the rights in section 22. We answer under the law that applies to you, and where no law gives you a right, we will still consider your request and tell you what we decided.

How to ask

Use the form at /contact. It has five privacy options: "See the data you hold on me", "Delete the data you hold on me", "Correct it, or object to how it is used", "Another request about my data" (a portable copy, restriction, withdrawing consent, nominating someone) and "Appeal a decision on my privacy request". There is no charge.

It helps to tell us where we would find you: the email address you used on a form, the number you entered for a demo call, or, for a Guide conversation, the day and roughly what time, and the page you were on. A Guide conversation is not stored against your name or email, so without those details we may not be able to find it.

Businesses on Mirakash can also erase a person's conversations in their own workspace themselves, by phone number or email address, in the console under data settings.

Checking it is you

Before we hand over or delete anything, we check that the request comes from the person the data is about. Usually that means replying from the email address we hold, or proving you control the phone number. We ask only for what we need to check, and we use it only for that. We will never ask for your password or a two-step sign-in code. If we cannot verify a request, we will tell you why.

How long it takes

We answer within the shortest period the law that applies to you requires: within one month under the GDPR and UK GDPR (which can be extended by up to two more months for a complex request, and we will tell you if it is), within 45 days under US state laws (extendable by another 45), and within the period the DPDP Rules prescribe in India. Deletion is done by a member of staff within 30 days of a verified request; backup copies roll off within 14 days after that (section 19).

What we may keep

Even after a deletion request, we may keep:

• records a law requires us to keep, such as invoices;
• a record of your request and how we handled it;
• your number on a do-not-call list, if you asked not to be contacted — deleting it would undo that;
• a deletion receipt in the audit trail, which holds a salted hash of what was deleted, not the content;
• what we need to establish, exercise or defend a legal claim.

We may refuse, or charge a reasonable fee for, a request that is manifestly unfounded or excessive, where the law allows — and we will explain why.

Complaints

Please tell us first, through /contact, so we can try to put it right. You can also complain to a regulator at any time:

• in the EU or EEA, the data protection authority where you live, work, or where you think the problem happened;
• in the UK, the Information Commissioner's Office;
• in India, the Data Protection Board of India, after using our grievance process;
• in the US, your state's Attorney General, or in California the California Privacy Protection Agency;
• in the UAE, the UAE Data Office;
• elsewhere, your national data protection authority.

Mirakash is for businesses, and you must be 18 or older to use this site's forms, the demo call or the console. None of it is directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, tell us through /contact and we will delete it.

A business's own agent may talk to younger people — a college admissions line, for example. That business is the controller, and it is responsible for any parental consent or other protection the law requires (in India, for example, verifiable consent of a parent for anyone under 18).

Health data. We do not sign Business Associate Agreements, so Mirakash must not be used to create, receive, store or send protected health information under the US HIPAA rules. Businesses that need that should not put it on Mirakash.

Special categories. We do not ask for data about your health, religion, ethnicity, politics, sex life or sexual orientation, trade-union membership, or genetic or biometric data, and we do not use voices to identify people. The Guide and the demo call are not the place for any of it. If you tell them something like that anyway, it is kept in the transcript like everything else you say — the automatic masking does not catch it — and we will delete it if you ask.

Payment data. Card numbers are masked in transcripts before they are stored, and agents are stopped from reading a card number aloud. Please do not read your card number to an agent unless the business tells you that is how it takes payment.

Inside the console, businesses can see which HIPAA and PCI-related controls are in place, one by one. That page reports each control as it stands; it is not a claim about Mirakash as a whole.

We have no newsletter and no mailing list. If you ask for a demo or get in touch, we may follow up about what you asked for, by email or on the phone number you gave us. The number you give for a demo call is used for that call only, never for marketing.

To stop us contacting you, say so in reply, or through /contact, and we will stop. If we ever start sending marketing email, we will ask first where the law requires it, and every message will have a way to unsubscribe.

If you have an account, we will still send service messages — security alerts, billing, changes to the service or to these terms. Those are not marketing, and they continue while the account exists.

Our own agents. A voice conversation with the Guide, and the demo call, are always transcribed. The audio is kept only when the agent tells you it is recording — on screen for the Guide, at the start of the call for the demo. The demo call is one you asked for from an AI agent; the Guide is labelled as an AI assistant; and both say they are AI if you ask.

A business's agents.Mirakash lets a business set a recording notice that its agent says at the start of a call or shows in a chat, and the platform keeps the audio of a call only when such a notice is set up. Transcripts are kept either way, under the business's settings. Whether a call is recorded, what notice is given, and whether consent is needed — some places require everyone on a call to agree — are the business's responsibility under its own laws and our Acceptable Use Policy. If you did not hear a notice and want to know what was kept, ask the business.

This site links to other sites and services — Stripe's checkout, Google, Meta, a business's own website. What happens on them is governed by their own privacy policies, not this one. Read theirs before you give them anything.

This version takes effect on 5 October 2026. It replaces the version of 19 September 2026. What changed: the WhatsApp section now says that we keep delivery and read receipts, and for how long, and that photos and voice notes are passed to the AI provider answering the conversation. The earlier version said receipts were ignored and voice notes only transcribed, which had stopped being accurate. The 19 September version replaced that of 15 August 2026, which covered only this website.

When this policy changes, the date at the top changes with it, and anything material says what changed. If a change affects how we use data you have already given us, account holders will also be told directly before it takes effect. You can ask for an earlier version through /contact.

Related documents: Terms of Service, Data Processing Addendum, Acceptable Use Policy, Sub-processors, Data deletion and Cookie Policy. Everything on this page goes to one place: /contact.