Privacy policy

Who we are

Mira is a platform for event organisers, operated by Giant Steps, Lisbon, Portugal. It is used by an organisation — a promoter, a festival, a venue — to run an event: tickets, access, marketing. This policy covers the data Mira holds and what we do with it.

Two roles matter throughout. For the people who useMira — an organisation's staff — we are the controller of their account data. For the data an organisation puts into Mira about its own audience — ticket buyers, contacts — the organisation is the controller and Mira is the processor acting on its instructions.

What we hold

• Account data. Name, email address, the organisations you belong to and your role in them. Needed to sign you in and to decide what you may see.
• Event data. Everything an organisation creates: events, ticket types, sales imported from its ticketing platform, budgets, campaigns, brand and strategy documents, calendars, files uploaded to Content.
• Customer data. People who bought tickets or gave an organisation their contact details: email address, name, phone number, marketing consent, and what they bought. Supplied by the organisation or imported from its own ticketing platform — never bought, never scraped, never collected by us from anywhere else.
• Connected platform data. When an organisation connects an ad account or a ticketing platform, the access tokens it granted, encrypted, plus which account was chosen and the id of the person who authorised it.
• Operational logs. Requests, errors and audit records of who changed what, kept so a mistake can be traced and undone.

We do not use cookies for advertising or analytics. Inside the platform, the only cookies Mira sets are the ones that keep you signed in. The public website adds one more, mira_site_lang, which remembers the language you chose for 12 months.

The website and demo requests

When someone asks for a demo on the Mira website, we keep what they typed (name, work email, company and the optional details on the form) together with how they reached us (referring page and campaign tags) in our own CRM, to reply and prepare the demo. It is never used for advertising or sold. The details, including how long we keep it, are on the website privacy page.

Ad platforms: Meta and Google

An organisation can connect its own Meta (Facebook and Instagram) and Google Ads accounts so that campaigns written in Mira can be created on those platforms. When it does:

• What we read. The list of ad accounts the person can use, and — on Meta — the Facebook Pages ads may be published as. We do not read posts, messages, friends, followers or any content on those platforms.
• What we write. Campaigns, ad sets, ad creatives and ads, always created PAUSED. Nothing is ever switched on except by someone pressing the button in Mira.
• What we store. The access or refresh token, encrypted with AES-256-GCM; the chosen ad account and Page; and the platform's own id for the person who authorised the connection, so that a deletion request from that platform can be matched to the right connection.
• Customer lists. If an organisation chooses to target its own customers, their email addresses are hashed with SHA-256 inside Mira and only the hashes are sent to the platform, which matches them against its own users. The plain addresses never leave Mira for this purpose. The organisation is responsible for having a lawful basis — normally consent — for that use, and Mira defaults to the consented segment only.

Mira's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through the Google Ads API is used only to provide the features described here, is never sold, never transferred for advertising by us, and never used to build profiles for any purpose other than the organisation's own campaigns.

Why we are allowed to hold it

• Contract. We hold account and event data to provide the service the organisation asked for.
• Legitimate interest. Security logs and audit records, so the platform can be operated safely.
• The organisation's own basis. Customer data is held on the organisation's instructions, under whatever basis it relies on — usually its contract with the ticket buyer, and consent for marketing.

Who else sees it

Nobody buys it, because we do not sell it. The companies that process data on our behalf are limited to what running the platform requires:

• Supabase. Database, authentication and file storage, hosted in the European Union.
• Vercel. Application hosting.
• Mailgun. Transactional email — invitations and password resets.
• Meta and Google. Only when an organisation connects its own ad account, and only the campaign and audience data it chose to send.

How long we keep it

Event and customer data stay for as long as the organisation keeps its account, because an event two years old is still the evidence for how the next one should be planned. When an organisation leaves, its data is deleted within 30 days. Access tokens are deleted as soon as a connection is removed. Deletion records are kept so that we can answer, later, that a deletion happened.

Your rights, and how to use them

Under the GDPR you can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, object to processing, or ask us to hand it to someone else. Write to jorge@giantsteps.co and we will answer within 30 days.

If you are a ticket buyer rather than a Mira user, the organisation that sold you the ticket is the right first stop, because the data is theirs — but write to us either way and we will make sure the request reaches them and is honoured.

You can complain to the Portuguese data protection authority, the CNPD, at any time.

Deleting a Facebook or Google connection

Removing Mira from your Facebook settings tells us immediately: the stored tokens are destroyed and the connection is marked as needing to be reconnected. Asking Facebook to delete your data goes further — the whole connection, tokens and chosen account with it, is deleted and you are given a confirmation code you can check on our data deletion page.

What is not deleted by that request, and deliberately: the campaigns, budgets and customer records belonging to the organisation. Those are the organisation's data, not yours as an individual platform user, and erasing a company's marketing because an employee disconnected their Facebook account would destroy work that was never in question. To have organisation data deleted, the organisation asks us.

Changes

When this policy changes in a way that matters, we say so in the product before it takes effect. The date at the top is always the date of the version you are reading.