Privacy Policy

We, Mirelo AI GmbH (“Mirelo” or “we” “us”), would like to thank you for visiting our website and for your interest in our services.

We offer a platform that enables users to generate and edit audio, such as sound effects and music, through a web-based application powered by AI technology (our “AI Model/s”), making it easier to create powerful audio content (“Platform” and/or our “Service/s”).

When you visit and use our website and our Platform and when you enter into or are interested in a contractual relationship with us, your personal data may be processed. The protection of your personal data is important to us, and we would like to inform you with this privacy policy in accordance with Art. 13 of the EU General Data Protection Regulation (“GDPR”) about how we handle your personal data (hereinafter also referred to only as “data”).

Last updated: 2 October 2026

A. General information

I. Definitions

Our privacy policy should be easy to read and understand for our website visitors, our Platform users and customers, business partners and interested parties. To ensure this, we would like to explain the most important terms:

• “personal data” means any information relating to an identified or identifiable natural person (hereinafter “Data Subject”), e.g. name, address, email addresses, user behaviour;
• “Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
• “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
• “Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
• “Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person.

II. Controller

The Controller within the meaning of Art. 4 (7) GDPR is Mirelo AI GmbH, Eisenbahnstraße 1, 72072 Tübingen, legal@mirelo.ai

B. Processing activities

I. Customers, business partners and interested parties

If you are already a customer, business partner or prospective customer of our Services and a contractual, quasi-contractual or pre-contractual business relationship exists with us, we process the following data where necessary:

• Inventory data (e.g. first and last name, address, company, location)
• Contact details (e.g. e-mail address, telephone number)
• Payment data (e.g. bank details, billing information, payment history)

We process this data in particular to communicate with you, to respond to your enquiries, to fulfil our contractual obligations and to safeguard our rights.

The legal basis for this processing results from Art. 6 para. 1 sentence 1 lit. b GDPR (contract fulfilment and pre-contractual measures), Art. 6 para. 1 sentence 1 lit. c GDPR (legal obligation) and Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest).

II. Visiting our website

1. Log files

When using the website for information purposes, we process the following personal data that your browser transmits to our server:

• IP address
• Date and time of the enquiry
• Country/City/Region
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (page visited)
• Access status/HTTP status code
• Amount of data transferred in each case
• Previously visited page
• Browser type
• Operating system used
• Language and version of the browser software
• Host name of the accessing computer

This data is technically necessary for us to display our website to you and to ensure stability and security. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR.

III. Use of our Online Offer and Platform

1. Joining our Waitlist

To join our waitlist, we require you to provide your email address. We collect and process this data when you request to be placed on our waitlist to use our Services.

The processing of your data is based on Art. 6 para. 1 sentence 1 lit. b GDPR and Art. 6 para. 1 sentence 1 lit. f GDPR.

2. Contacting us

If you contact us (e.g. via an online contact form, email or social media), your data will be processed insofar as this is necessary to answer your contact enquiry.

The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR and Art. 6 para. 1 sentence 1 lit. b GDPR.

3. Creating an Account, Registration and Login

To create an account and sign-in to the Platform, you can register using e.g. your Google, GitHub, LinkedIn account. You may also be offered the option to sign up with your email address.

We process the following data in connection with registration, login, and your user account:

• Inventory data (e.g. name, address)
• Contact data (e.g. email address, telephone number if applicable)
• Content data (e.g. entries in the online form)
• Device data (device name, country code if applicable, language, name of operating system and version)
• Connection data (IP address, mail provider)
• Date and time of registration and confirmation

Legal basis: Art. 6 para. 1 sentence 1 lit. b GDPR and Art. 6 para. 1 sentence 1 lit. f GDPR.

4. User Questionnaires

We may process your data when you provide such information in our questionnaires. We rely on Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interests).

5. Use of our Platform

Our Service is designed to process user-provided input, which may include code, videos, images, text, software, music, sound, other audio, photographs, graphics, messages, and various other materials (collectively referred to as “Input”). Based on this Input, the Service generates and delivers audio output (“Output”).

The data processing is based on Art. 6 para. 1 sentence 1 lit. b GDPR.

6. Development and Improvement of our Services

We may use your Input and Output to develop and improve our Services, including to train the AI Models that power them, under the Training License in section 7.4 of our Terms. We do this by copying content into a separate training data store.

We rely on legitimate interest (Art. 6 para. 1 sentence 1 lit. f GDPR).

On a paid plan, you can switch this off at any time in Studio under Settings, Profile, “AI training on your content”. From then on, we stop adding your content to the training data store. Content already added stays there until you delete your account, when we erase it, and training that has already used it is not undone. You can switch it back on at any time. On the free plan, the Training License is a condition of using the Services free of charge (section 7.4 of our Terms), so the setting is not available.

You can also object to this processing under Art. 21 GDPR (see section E) by emailing legal@mirelo.ai. If we uphold your objection, we switch training off for your account, with the same effect as the setting.

7. Newsletter / E-mail Marketing

You have the option to subscribe to our newsletter. Our newsletter is sent based on your prior explicit consent (Art. 6 para. 1 sentence 1 lit. a GDPR). You can unsubscribe at any time.

8. Job Application

You can apply for open positions by e-mail. The legal basis is Art. 6 para. 1 sentence 1 lit. b and Art. 88 para. 1 GDPR in conjunction with Section 26 para. 1 sentence 1 Federal Data Protection Act (BDSG).

IV. Use of Third-Party Tools

As part of our business operations and to offer certain services, we work with service providers who act as Processors. We have entered into Data Processing Agreements (DPAs) with these service providers.

1. Stripe (Payment Processing)

We use the payment service provider Stripe to process payments on our Platform. Stripe is offered by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Legal basis: Art. 6 para. 1 sentence 1 lit. b GDPR and Art. 6 para. 1 sentence 1 lit. f GDPR.

2. Authentication Providers

We offer the option to authenticate using third-party providers including Google, GitHub, and LinkedIn. Legal basis: Art. 6 para. 1 sentence 1 lit. b GDPR and Art. 6 para. 1 sentence 1 lit. f GDPR.

3. PostHog (User Analytics)

We use PostHog provided by PostHog Inc, San Francisco, CA, USA for user behaviour analytics. Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR and Section 25 para. 1 TDDDG.

4. Google Analytics (Website Analytics)

We use Google Analytics provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (and Google LLC, USA) to understand how visitors use our website. Google Analytics is delivered through Google Tag Manager and loaded only after you consent to analytics cookies. Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR and Section 25 para. 1 TDDDG.

5. Providers that process your Input and Output

To provide the Services, we send Input, Output and related text (such as prompts) to the following Processors. Each receives only what the feature you use needs. Legal basis: Art. 6 para. 1 sentence 1 lit. b GDPR and Art. 6 para. 1 sentence 1 lit. f GDPR.

• Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg): hosting, file storage and media processing.
• Convex (Convex, Inc., San Francisco, CA, USA): our application database and backups.
• Modal (Modal Labs, Inc., New York, NY, USA): running our own AI Models on your Input.
• Google Cloud (Vertex AI, Gemini) (Google Cloud EMEA Limited, Dublin, Ireland): analysing uploaded video and audio, and prompts, to plan generations and describe sounds.
• ElevenLabs (Eleven Labs Inc., New York, NY, USA): generating sound effects and music from prompts or video, isolating voices, and dubbing.
• fal (Features & Labels, Inc., San Francisco, CA, USA): separating individual sounds from audio.
• AudioShake (AudioShake, Inc., San Francisco, CA, USA): separating audio into stems and aligning lyrics.
• Apify (Apify Technologies s.r.o., Prague, Czech Republic): fetching a video from a link you paste, so it can be imported.

Amazon Web Services and Convex store content for us and follow the periods in section C. The other providers receive content for a single request and keep their copies for the periods set out in their own terms and our agreements with them, which may be longer than the periods in section C.

Several of these providers are based in the USA, and Google runs its AI models on infrastructure worldwide, so content may be processed outside the EU/EEA. For these transfers we rely on the EU-U.S. Data Privacy Framework where the provider is certified under it (Art. 45 GDPR), and otherwise on the EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR).

6. Slack (Internal Communication)

We use Slack, provided by Slack Technologies Limited, Dublin, Ireland, for internal communication. Feedback you send us in Studio, answers to our questionnaires and the reason you give when you delete your account are posted to our Slack workspace together with your name and email address, so our team can read and act on them. These messages have no fixed deletion period and are not deleted when you delete your account. Legal basis: Art. 6 para. 1 sentence 1 lit. f GDPR.

7. Roblox (at your request)

If you use our Roblox integration to publish a sound to Roblox, we upload that sound, the name you give it and your Roblox creator ID to Roblox Corporation, San Mateo, CA, USA. Roblox then processes it as a separate controller under its own terms. Legal basis: Art. 6 para. 1 sentence 1 lit. b GDPR.

V. Our Online Presence on Social Media

We operate pages on the following platforms:

• Instagram (Meta Platforms Ireland Limited)
• X / Twitter (Twitter International Unlimited Company)
• Discord (Discord Inc.)
• LinkedIn (LinkedIn Ireland Unlimited Company)
• TikTok (TikTok Technology Limited)

The legal basis for processing your data on social media is Art. 6 para. 1 sentence 1 lit. f GDPR.

C. Storage and deletion of data

The data processed by us will be deleted in accordance with the statutory provisions as soon as your consent to data processing is revoked or if the purpose for processing this data no longer applies or the data is no longer required for the purpose. For Input, Output and your account, the following periods apply:

• Content you keep in Studio (projects, generations, transcriptions and the files you upload for them): until you delete it or your account.
• Files uploaded through our API or plugins: usable for 24 hours after upload, then deleted automatically.
• API results: available through the API for 24 hours. Sound effects generated through the API or our plugins, including their entries in your account’s generation history, are deleted 7 days after they are made, and at the latest after 14 days. Other API results are deleted from our result storage within 7 days.
• Content you delete: removed from our live systems straight away. Older stored versions of the files are kept for 7 days and then deleted automatically.
• Backups: we keep daily backups of our database for 7 days.
• Training data (see B.III.6): kept until you delete your account.
• Account deletion: when you ask us to delete your account, we wait 7 days so you can change your mind. We then delete your account and content. Remaining copies, including older file versions, backups and training data, are gone within 30 days after that.
• Billing and credit records: kept after account deletion for as long as tax and commercial law require.

Copies held by the providers that process a single request (B.IV.5) are kept for the periods those providers set. Messages in our Slack workspace (B.IV.6) have no fixed deletion period.

D. Your Rights as a Data Subject

You have the right to:

• Access your personal data in accordance with Art. 15 GDPR
• Rectification of inaccurate personal data in accordance with Art. 16 GDPR
• Erasure of your personal data in accordance with Art. 17 GDPR
• Restriction of processing in accordance with Art. 18 GDPR
• Objection to the processing of your data in accordance with Art. 21
• Data portability in accordance with Art. 20 GDPR

You also have the right to lodge a complaint with a data protection supervisory authority in accordance with Art. 77 GDPR.

E. Right to Object

You have the right to object, at any time and for reasons arising from your particular situation, to the processing of your personal data based on Art. 6 para. 1 sentence 1 lit. e or f GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms.

F. Data processing when accessing linked content

Our website may contain external links or hyperlinks to websites of other providers. This external content does not originate from us, and we have no influence on the content of third-party websites.

G. Automated decision making / profiling

No automated decision-making or profiling takes place.

H. Changes to this privacy policy

Due to the further development of our website and our online offer or due to changed legal and official requirements, it may become necessary to amend this privacy policy from time to time.

If you have any questions regarding the processing of your data, you can contact us at any time.