MirrorFill — Privacy Policy

Last updated: 15 July 2026

1. Introduction

MirrorFill ("MirrorFill", "we", "us") operates the website mirrorfill.com and related application (the "Service"). We are established in the European Union, trading as MirrorFill. We are the data controller for personal data processed through the Service under the EU General Data Protection Regulation (GDPR). You can contact us at [email protected].

2. Data we collect

Identity and contact data: name, email, and details you give when registering or contacting us.
Marketing and early-access data: if you join our mailing list or request early access, we collect your email address and how you heard about us.
Account credentials: username, a hashed password, and authentication tokens.
Broker connection data: the API keys or account credentials you provide so we can connect to your trading accounts and copy trades on your instruction.
Billing data: subscription and billing details. Payments are processed by our payment processor; we do not store full card numbers.
Usage data: IP address, device and browser information, pages viewed and timestamps, and approximate location from your IP.
Trading data: orders, positions, and related data processed to provide copying, risk, and journaling features.

3. How we use your data

We use your data to provide and administer the Service (contract), take payment and prevent fraud (contract and legitimate interests), secure and improve the Service (legitimate interests), communicate with you (contract and legitimate interests), send marketing about our own products where permitted (consent or legitimate interests), and meet legal, tax, and accounting obligations (legal obligation). You can opt out of marketing at any time. We do not carry out automated decisions with legal or similarly significant effects.

4. Cookies

We use cookies and similar technologies as described in our Cookie Policy.

We share personal data with providers who help us run the Service, including our payment processor, our hosting and infrastructure providers, and our email, analytics, and support providers, as well as the brokers you choose to connect. We may also disclose data where required by law or to protect our rights, and in connection with a sale or reorganisation of the business. We do not sell your personal data.

Weekly Review (optional AI feature). If the Weekly Review is switched on for your account, we send a summary of your own trading week to Anthropic PBC, which generates the written review. What we send is aggregated weekly trading statistics — trade counts, profit and loss figures, instruments traded, per-day totals, the week's best and worst trade, and counts of behaviour such as re-entering after a loss. Before anything is sent, your account identifiers are replaced with generic labels ("Account 1", "Account 2"); we do not send your name, email address, account numbers, or broker credentials. The review describes trades you have already made and is not financial or investment advice. Every Weekly Review email carries an unsubscribe link, and if you would rather the review was not generated for your account at all, email [email protected] and we will switch it off — nothing is then sent to Anthropic.

6. International transfers

Some of the providers we use may be located outside the European Economic Area (EEA). Where we transfer personal data internationally, we rely on an appropriate safeguard, such as a European Commission adequacy decision or the EU Standard Contractual Clauses, so that your data receives an equivalent level of protection.

7. Retention

We keep personal data while your account is active and afterwards for as long as needed for legal, accounting, or legitimate business reasons. Broker credentials are deleted when you disconnect an account or close your account. Transaction records are kept for the period required by tax law (generally five years).

8. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, protection of broker credentials, and access controls. No system is fully secure, but we work to keep your data safe and will notify you and the competent supervisory authority of a breach where required.

9. Your EU/EEA rights

Under the GDPR you can access, correct, or erase your data, restrict or object to processing (including marketing), request portability, and withdraw consent where we rely on it. Contact us at [email protected] and we will respond within one month. You can also complain to your local data protection supervisory authority.

10. US state privacy rights (California and other states)

If you are in California or another US state with a privacy law, you may have the following rights over your personal information, which we honour where the law applies to us: - Know and access the categories and specific pieces of personal information we hold about you. - Delete personal information we hold about you. - Correct inaccurate personal information. - Opt out of the "sale" or "sharing" of personal information. - Limit the use of sensitive personal information to what is needed to provide the Service. - Non-discrimination — we will not deny you service, charge a different price, or give you lower quality service for exercising these rights.

Categories we collect. In the past 12 months we have collected identifiers (such as name and email), account and login information, commercial and transaction information (such as your subscription), internet and usage activity, and connection data you provide. We use these for the purposes in section 3.

Do Not Sell or Share, and Notice at Collection. We do not sell your personal information for money. We may share limited identifiers or usage data with analytics or advertising partners, which some laws treat as "sharing" for cross-context behavioural advertising. You can opt out using the "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information" links in our website footer, or by emailing [email protected]. A "Notice at Collection" is available next to our sign-up and contact forms.

Global Privacy Control. Where your browser sends a recognised opt-out signal such as Global Privacy Control (GPC), we treat it as a valid opt-out request.

How to request. Email [email protected]. We will verify your request and respond within the time the law allows (generally 45 days for CCPA requests), with an extension where permitted. You may use an authorised agent to submit a request for you.

Notice at Collection (US)

At or before the point we collect your information, this is our notice at collection. We collect the categories described in section 2 above — identifiers (such as your name and email), account and login credentials, commercial and transaction information (such as your subscription), internet and usage activity, approximate location from your IP, and the connection and trading data you provide. We collect this information to provide, secure, and improve the Service, take payment and prevent fraud, communicate with you, and meet our legal obligations, as set out in section 3. We retain it for the periods described in section 7. We do not sell your personal information for money. For full details and to exercise your choices, read this Privacy Policy or contact [email protected].

11. Children

The Service is not directed at children, and you must be at least 18 to use it (see our Terms). We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us with data, contact us and we will delete it.

12. External links

The Service may link to third-party sites. We are not responsible for their privacy practices; please review their policies.

13. Changes

We may update this Policy and will post changes here, notifying you if they are material. The "Last updated" date shows the latest revision.

14. Contact

Privacy enquiries: [email protected].