Legal

Privacy Policy

Last updated: August 31, 2026

Mirra ("we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, and protect information when you use our website (mirrabooth.com), admin dashboard (admin.mirrabooth.com), photo booth software, and related services.

Information We Collect

From booth purchasers and operators:

  • • Name, email address, phone number, company name, and mailing address
  • • Payment information (processed by our payment processors, we do not store credit card numbers)
  • • Login credentials (passwords stored as secure hashes, never in plaintext)
  • • Booth operational data: session counts, revenue, uptime, heartbeat status, error logs

From booth guests (people who use a Mirra booth at an event):

  • • Photos captured during the photo booth session
  • • No other personally identifiable information is collected from guests
  • • We do not collect guest names, email addresses, phone numbers, or payment card details

From website visitors:

  • • Standard web analytics (page views, referral source, device type)
  • • If you send us a message through the contact or venue form: your name, email address, phone number, company or venue name, and whatever you write in the message
  • • Form submissions are emailed to us and recorded in our server logs, so an enquiry is not lost if the email fails to send
  • • We do not use invasive tracking, fingerprinting, or sell visitor data to third parties

How We Use Information

Operator information is used to:

  • • Manage your account and provide access to the admin dashboard
  • • Process orders and payments
  • • Send transactional emails (order confirmations, status updates, credentials)
  • • Send onboarding and product education emails (you can unsubscribe at any time)
  • • Provide customer support
  • • Generate analytics and reporting for your booths

Guest photos are used solely to:

  • • Print photo strips at the booth
  • • Deliver digital copies via QR code (hosted on photos.mirrabooth.com)
  • • Photos are automatically deleted from our cloud storage after 36 hours

We never:

  • • Sell, rent, or share your personal information with third parties for marketing
  • • Use guest photos for training, or for any purpose beyond delivering your strip, a guest photo is only ever published or used in promotion with the permission of the people in it
  • • Store payment card numbers on our servers

Data Storage and Security

  • • Operator data is stored on secure servers hosted by Fly.io (Toronto, Canada region)
  • • Guest photos are stored on Cloudflare R2 (encrypted at rest) and auto-deleted after 36 hours
  • • All data in transit is encrypted via TLS/HTTPS
  • • Passwords are hashed using bcrypt with a cost factor of 12
  • • API keys are hashed and never stored in plaintext
  • • Access to production systems is restricted to authorized personnel

Third-Party Services

We use the following third-party services to operate Mirra:

ServicePurpose
Fly.ioServer hosting
VercelWebsite hosting and visitor analytics
CloudflareCDN, DNS, R2 storage
NayaxCashless payment processing
Gmail (Google Workspace)Transactional email
ResendDelivering website enquiries to us
SentryError monitoring
HubSpotCRM (if connected)
SlackInternal notifications

Data Retention

  • Operator accounts: Retained for the duration of your relationship with Mirra. You may request deletion at any time.
  • Guest photos: Automatically deleted 36 hours after the session.
  • Session analytics: Retained indefinitely in aggregate form (no personally identifiable information).
  • Backups: Database backups are retained for 30 days and then automatically overwritten.

Your Rights

Depending on your jurisdiction, you may have the right to:

  • • Access the personal information we hold about you
  • • Correct inaccurate information
  • • Request deletion of your information
  • • Object to or restrict certain processing
  • • Data portability (receive your data in a structured format)

To exercise any of these rights, email support@mirrabooth.com. We will respond within 30 days.

Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

International Users

Mirra is based in Ontario, Canada. If you access the Service from outside Canada, your information may be transferred to and processed in Canada. By using the Service, you consent to this transfer.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website. Your continued use of the Service after changes constitutes acceptance.

Contact

For privacy-related questions or requests, contact:
Mirra
Email: support@mirrabooth.com
Web: mirrabooth.com