Privacy Policy

This Policy describes how Mirror Apparel collects and uses personal information through this website — browsing, creating an account, placing a Mirror Collection order, submitting a Mirror Custom request, submitting a Mirror Teams / Bulk request, and contacting us.

This Policy describes our own current data practices as implemented in this website. It does not, by itself, constitute a representation that we have completed every assessment or registration a particular privacy law may require — see docs/LEGAL_REVIEW_FLAGS.md for what remains open.

We collect the following categories of information, only where the relevant part of the site is actually used:

• Account information — email address, and optionally full name and phone number, if you create a Mirror account.
• Checkout / contact information — email, phone, name, and (for the payment step once a real processor is integrated) payment details handled by that processor — see Section 8.
• Shipping information — the delivery address you provide for an order.
• Order history — what you ordered, quantities, prices, and order status.
• Mirror Custom reference photos — images you upload describing what you want made.
• Mirror Custom artwork — logos, artwork, or images you upload for placement on a garment.
• Mirror Teams / Bulk branding files — logos, artwork, badges, crests, or reference images you upload for a bulk/organizational order, plus any typed branding text.
• Communications — messages you send us (e.g. a support request), and messages we send you about a specific request (e.g. a mockup-approval message from our team).
• Authentication information — your account credentials, managed by our authentication provider (Supabase Auth), and session information needed to keep you signed in.
• Transactional email records — for each order-related email we send (e.g. order confirmation, shipping update), we keep a record of the event type, recipient address, delivery status, and timestamps — not the email's full content.
• Technical/security information — standard technical information (such as IP address and browser/device information) that our hosting and infrastructure providers process as part of operating this website.
• Cookies / similar technologies — see our Cookie Policy for exactly what we use today.
• Payment information — once a live payment processor is integrated, that processor will process your payment details directly; see Section 8.

• To create and manage your account.
• To process, fulfil, and communicate with you about an order, Custom request, or Bulk/Teams request.
• To provide customer support and respond to your messages.
• To send transactional emails about your own order (confirmation, shipping, delivery, and similar updates).
• To detect and prevent fraud, abuse, and security issues.
• To operate, maintain, and improve the website.
• To meet legal and accounting obligations.

Where a privacy law that requires a stated legal basis applies to our processing of your information (for example, EU/UK GDPR), we generally rely on: performance of a contract with you (processing your order), our legitimate interests (fraud prevention, site security, improving our service), your consent (e.g. optional marketing emails, and non-essential cookies where applicable — see our Cookie Policy), and compliance with a legal obligation (e.g. accounting/tax records).

Whether GDPR or another specific legal-basis-requiring law applies to a given processing activity is a legal determination pending confirmation — see docs/LEGAL_REVIEW_FLAGS.md.

We share information with the following categories of service providers, only as needed for them to provide their service to us:

• Supabase — our database, authentication, and file-storage provider. Account information, order records, Custom/Bulk request details, and uploaded reference/artwork/branding files are stored here.
• Resend — our transactional email delivery provider, used to send order-related emails (e.g. order confirmation, shipping updates) once email sending is enabled.
• Hosting/infrastructure providers — the underlying infrastructure that runs this website and processes standard technical/security information as part of doing so.
• A payment processor — once integrated; see Section 8.

We do not sell your personal information to third parties for money, and we do not share it with third parties for cross-context behavioral advertising.

Mirror operates from Pakistan and sells worldwide, so your information will generally move internationally as part of us providing our service to you — for example: from your country, to the infrastructure our service providers use to run this website, to our own business operations in Pakistan, and, where needed to produce and ship your order, to our fulfilment supplier(s) in Pakistan and/or China.

Where we send Custom or Bulk order details to a fulfilment supplier so they can produce and ship your order, we aim to share only what's needed for that purpose (e.g. the specification, size, and delivery address) — not your full account or payment information.

The specific legal transfer mechanism(s) that may be required for moving personal data out of the UK/EU/EEA to Pakistan or elsewhere (for example Standard Contractual Clauses, the UK International Data Transfer Addendum, or an applicable adequacy decision) are pending legal confirmation and are not yet documented here — see docs/LEGAL_REVIEW_FLAGS.md. This Policy does not represent that such a mechanism has already been put in place.

We keep account and order information for as long as your account is active and as needed to meet legal, accounting, and dispute-resolution obligations after that. Uploaded Custom/Bulk reference and branding files are kept for as long as needed to produce, fulfil, and support your order, and to support any warranty, return, or dispute process afterward.

Where you make a valid deletion request (see Section 10 and our Privacy Requests page), we delete or anonymize your information except where we are legally required or permitted to retain it — for example, order and financial records we must keep for accounting or legal purposes.

This store does not currently have a live payment processor integrated — checkout runs on a mock/demo payment flow, and no card number is transmitted anywhere or stored by Mirror.

Once a real payment processor is integrated, your payment card details will be sent directly to and processed by that processor under its own privacy policy — Mirror will receive confirmation of payment and a limited payment reference, not your full card number.

We use reasonable technical and organizational measures to protect personal information — including database access controls (Row Level Security on our database, restricting each customer's data to their own account and restricting bulk/administrative access to authorized Mirror staff only) and private file storage for uploaded reference/artwork/branding files (not publicly accessible by default).

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

Depending on your location, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing, or (in some US states) to opt out of the sale or sharing of your personal information.

You can submit a request through our Privacy Requests page. We will need to verify your identity before acting on a request, and some requests may be limited where we have a legal basis to retain the relevant information (see Section 7).

We do not automatically delete database records purely because a request form was submitted — every request is reviewed by a person before action is taken, and legally-required records are preserved. See our Privacy Requests page.

This website is not directed at children, and we do not knowingly collect personal information from children below the age applicable in their jurisdiction without appropriate consent.

If you have a concern about how we handle your personal information, please contact us first using the details on our Contact page. Depending on your location, you may also have the right to lodge a complaint with your local data-protection authority.

We may update this Policy from time to time. See 'Legal Document Versions' below for how we track which version applied when.

UK GDPR and the Data Protection Act 2018 may apply to our processing of UK residents' personal information.

Whether a UK GDPR Article 27 representative is required for Mirror, and if so who that representative is, is pending confirmation — see docs/LEGAL_REVIEW_FLAGS.md.

EU GDPR may apply to our processing of EU/EEA residents' personal information.

Whether an EU GDPR Article 27 representative is required for Mirror, and if so who that representative is, is pending confirmation — see docs/LEGAL_REVIEW_FLAGS.md.

Some US states have their own comprehensive privacy laws (for example California's CCPA/CPRA) that apply once certain thresholds are met, and may give residents rights such as access, deletion, correction, and opting out of the "sale" or "sharing" of personal information, including recognizing an opt-out signal such as Global Privacy Control.

We do not assume any specific state privacy law currently applies to Mirror. Where and when a threshold is met, the applicable controls (including Do Not Sell or Share, and Global Privacy Control recognition) will be enabled — see our Privacy Requests page for the opt-out-sale request option, provided in advance of confirmed applicability.

PIPEDA and applicable provincial privacy law may apply to our processing of Canadian residents' personal information.

The Privacy Act 1988 (Cth) and the Australian Privacy Principles may apply to our processing of Australian residents' personal information.

Applicable Pakistani data-protection obligations are pending review — see docs/LEGAL_REVIEW_FLAGS.md.

If your country isn't listed above, any mandatory privacy right that applies to you under your local law is not affected by this Policy.