Privacy Policy

Summary in Hindi (संक्षेप में)

Miraal.ai आपका नाम, ईमेल, आपकी चैट और आपके अटैच किए गए फ़ाइल लेते हैं ताकि जवाब दे सकें। आपके सवाल AI और सर्च सेवाओं को भेजे जाते हैं। हम आपका डेटा बेचते नहीं हैं और ऐप में विज्ञापन या एनालिटिक्स ट्रैकर नहीं हैं। आप कोई भी चैट खुद डिलीट कर सकते हैं। अकाउंट या डेटा डिलीट कराने, सुधारने या शिकायत के लिए support@miraal.ai पर लिखें। हम 48 घंटे में जवाब देते हैं और 30 दिन में समाधान करते हैं। नीचे पूरी नीति अंग्रेज़ी में है।

1. Who we are

Miraal.ai is operated by Miraal.ai (company incorporation in progress), based in Pune, Maharashtra, India ("Miraal", "we", "us"). Registered office: Pune, Maharashtra, India.

For the DPDP Act, we are the Data Fiduciary for the personal data described here. You can reach us at support@miraal.ai.

We are in the process of forming a company. We will update this page when incorporation completes.

2. What data we collect

We collect only what the service needs:

• Account: your first and last name, your email address, and your password. Your password is stored only as a salted bcrypt hash; we cannot read it. The sign-up form does not ask for your phone number or address.
• Google sign-in (optional): if you choose "Continue with Google", Google gives us your Google account ID, your name, your email address and whether Google has verified that email. We ask for the openid, email and profile permissions only. We do not receive your contacts, files, calendar or mail, and we do not store your profile picture.
• Chats: the messages you send, the replies you get, chat titles, which AI model answered, timestamps, and whether a chat is pinned or archived.
• Files you attach: the file itself, its name, type and size, and the text we extract from it to answer your question.
• Settings: your tone and response-length choices, custom instructions, display name or nickname, and work type, if you set them.
• Scheduled tasks: the task title and instruction, the schedule, whether you chose to receive results by email, each run's saved result and source links, and run history.
• Usage records: counts of requests and tokens, estimated cost, web searches, characters read aloud, and spending alerts, used to apply fair-use limits.
• Activity records: events such as sign-up, login (with the email used), logout, file upload and which AI model handled a request.
• Technical data: your IP address and basic request details, used for rate limiting, abuse prevention and security, and in short-lived server logs. We try to keep message content out of logs and we mask email addresses in them.
• Email delivery records: when an email we send to you cannot be delivered, we keep the address, subject and error so we can retry or fix the problem.

3. Why we use your data

We process your personal data with your consent, given when you create an account and use the service, and for the limited legitimate uses the DPDP Act allows (such as security and legal compliance). We use it to:

• create and secure your account and sign you in;
• generate replies, read answers aloud, and run scheduled tasks you create;
• apply usage limits, prevent abuse, and keep the service reliable;
• send emails you need (welcome, email verification, password reset) and, only if you turn it on for a task, that task's result;
• respond to your requests and complaints, and comply with the law.

We do not sell your personal data. The app does not use advertising or analytics trackers. At present we do not train or fine-tune our own AI models on your chats or files, and we do not show ads. If we ever want to do this in the future, we will first ask for your separate, explicit opt-in consent and update this policy.

4. AI replies, live search and read aloud

Replies are generated by AI and can be wrong, incomplete or out of date. Please check anything important before relying on it.

• Live search: when a question needs current information, a search query made from your message is sent to our search provider, Tavily. Replies then cite the sources found. Search results may be kept briefly (about 5 minutes) to avoid repeating the same search.
• Read aloud: when you tap Read aloud, the text being read (in pieces of up to 600 characters, with links and code removed) is sent to Google Cloud Text-to-Speech to make audio. We keep the audio for up to 7 days so the same text is not converted again; the cache stores a hash of the text, not the text itself.
• Scheduled tasks run your saved instruction on a schedule, using the same AI and search services, and save the result in your account.

5. Who we share data with

We share data only with service providers (data processors) that help us run Miraal.ai, and only as needed for the purpose shown:

• AI model providers, to write replies: Groq is used first. If it is unavailable, Google (Gemini), Z.ai (GLM) or OpenRouter may be used. The provider that handles a reply receives your message, the recent conversation and any instructions you set. Follow-up suggestions shown under a reply are generated by a model on Groq.
• Your files: requests from the Miraal app that include text from your attached files, or excerpts from your uploaded documents, are sent only to Groq and Z.ai. They are not sent to Gemini or OpenRouter.
• Messages without files may be answered by Gemini or OpenRouter if Groq is unavailable. Each provider's own terms and privacy policy apply to the data it receives, and we do not control them. Providers may keep content for some time or have it reviewed under their terms, so please do not put sensitive personal information into chats.
• Tavily: live web search queries.
• Google: Google Cloud Text-to-Speech for read aloud; Google sign-in if you use it; and Google Fonts, which loads fonts in your browser (so Google can see your IP address).
• Resend: delivery of our emails, so it receives your email address and the email content.
• Cloudflare: hosting and delivery of the app and website, and storage of our encrypted database backups (Cloudflare R2).
• Railway: hosting of our API, database and cache, in the United States (US East, Virginia).

Your data is stored and processed outside India. Our servers and database are in the United States (US East, Virginia), and our AI, search, read-aloud and email providers may also process it in the United States and other countries. By using Miraal.ai you consent to this transfer. The DPDP Act allows transfers abroad unless the government restricts a country. We also disclose data if the law or a court requires it.

6. Cookies and browser storage

• Sign-in cookies: two HttpOnly cookies keep you signed in. miraal_token lasts 30 minutes and miraal_refresh lasts 7 days. A short-lived cookie is also used during Google sign-in to protect against forged requests.
• Browser storage: your browser also stores sign-in tokens, a local copy of your chats for speed, and your settings. Signing out and clearing the site's data removes them.
• We do not use advertising cookies or analytics trackers.

7. How long we keep data

• Chats, settings, scheduled tasks and their results: until you delete them or your account. You can delete a chat or a scheduled task yourself in the app. When you ask us to delete your data or account, we remove it within 30 days.
• Attached files: kept on our application server's temporary storage, not permanently, and removed when the server is updated. Deleting a chat does not yet delete the files attached to it; write to us if you want a file removed sooner.
• Read-aloud audio cache: 7 days. Search cache: about 5 minutes.
• Account and activity records: until your account is deleted.
• Backups: our database is backed up in encrypted form. Daily backups are kept for 7 days and weekly backups for 4 weeks (about 30 days). Data you delete can remain in these backups until they expire, and is not restored except to recover from a failure.
• Server logs: kept for 30 days.
• After you ask us to delete your account, we delete your data from our live systems within 30 days. We may keep what the law requires us to keep.

8. Your rights

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you and who we shared it with;
• ask us to correct, complete or update your data;
• ask us to erase your data, including your account;
• withdraw your consent at any time (we will stop using your data, though this may mean we can no longer provide the service);
• nominate someone to exercise these rights if you die or cannot do so yourself;
• complain to us, and if you are not satisfied, to the Data Protection Board of India.

To use a right, write to support@miraal.ai from the email address on your account. Account deletion and data summaries are handled by us on request at the moment; there is no self-service button yet. You can delete individual chats and scheduled tasks in the app at any time.

9. Grievance Officer

Name: Neha Singh, Director, Miraal.ai (company incorporation in progress), Pune, Maharashtra, India.

Email: support@miraal.ai

We acknowledge every complaint within 48 hours and resolve it within 30 days of receiving it.

10. Children

Miraal.ai is for people aged 18 or over. We do not knowingly collect data from anyone under 18. If you think a child has given us data, write to support@miraal.ai and we will delete it.

11. Security

We use HTTPS, hashed passwords, HttpOnly sign-in cookies, per-user access checks on your chats and files, rate limits, and encrypted backups. No system is completely secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

12. Changes to this policy

We may update this policy. The date at the top shows the latest version. For important changes we will tell you in the app or by email before they apply.

13. Contact

Questions, requests and complaints: support@miraal.ai. Miraal.ai (company incorporation in progress), Pune, Maharashtra, India.