Privacy Policy
Last updated: January 2026
We're Mirret. We help businesses find and eliminate brand impersonation threats. This policy explains what data we collect, why, and what we do with it.
Plain English. No legalese.
Who we are
Mirret is a brand protection service. We monitor for threats, verify them, and handle enforcement on behalf of our clients.
For data protection purposes, we are the data controller for information collected through this website and about our business operations. When processing data on behalf of clients, we act as a data processor under their instructions.
Contact: hello@mirret.co.uk
Information we collect
From website visitors
When you use our website, we collect:
- Contact form submissions — name, email, company, and your message. We use this to respond to your enquiry and assess whether we can help.
- Basic analytics — page views, referral source, device type. No personal identifiers. We use this to understand how people find us.
We don't use tracking cookies. We don't sell your data. We don't run retargeting ads.
From clients
When you become a client, we collect:
- Business information — company name, contact details, billing information.
- Brand assets — logos, domain names, social media accounts, trademarks, and information about your legitimate partners, resellers, and campaigns. We need this to identify what's yours and what isn't.
- Communication records — emails, calls, and messages between us. We keep these to maintain service continuity and resolve disputes.
During threat monitoring
When we monitor for brand impersonation, we collect information about potential threats:
- Infringing content — screenshots, URLs, domain registration data (WHOIS), hosting information, and evidence of impersonation.
- Infringer data — where publicly available or provided by platforms during enforcement, this may include names, email addresses, IP addresses, or payment information associated with infringing activity.
This data is collected and processed under legitimate interest — specifically, our clients' legitimate interest in protecting their brand and customers from fraud. We do not use this data for any other purpose.
How we use your information
- To respond to enquiries — when you contact us, we use your information to reply and assess fit.
- To provide our service — monitoring, verification, escalation, and reporting for clients.
- To enforce against threats — sharing evidence with platforms, registrars, hosting providers, payment processors, and ad networks to remove infringing content.
- To improve our service — understanding what works and what doesn't.
- To comply with legal obligations — responding to lawful requests from authorities.
Who we share data with
We share data only when necessary:
- Platforms and services — when filing takedown requests, we share evidence with social media platforms, domain registrars, hosting providers, payment processors, and advertising networks. This is essential to the service we provide.
- Our clients — we report findings and actions to the brands we protect. This includes information about threats we've identified and resolved.
- Service providers — we use a small number of tools to operate (email, cloud storage, analytics). All are bound by data processing agreements.
- Legal requirements — if required by law, court order, or to protect against fraud or security threats.
We never sell personal data. We never share client data with other clients. We never use infringer data for marketing.
International transfers
We operate globally and serve clients in the United States, United Kingdom, Australia, and elsewhere. Data may be transferred between these jurisdictions.
When we transfer data from the UK or EU, we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- UK International Data Transfer Agreement where applicable
- Adequacy decisions where they exist
We take reasonable steps to ensure your data is treated securely wherever it is processed.
How long we keep data
- Contact form submissions — 2 years, or until you ask us to delete it.
- Client data — duration of the engagement plus 7 years (for legal and accounting purposes).
- Threat evidence — retained for the duration of the client relationship plus 3 years. This allows us to demonstrate patterns, support ongoing enforcement, and respond to any disputes.
- Analytics — aggregated data retained indefinitely. No personal identifiers.
Your rights
Depending on where you are, you may have the right to:
- Access your data — request a copy of what we hold about you.
- Correct inaccurate data.
- Delete your data — subject to legal retention requirements.
- Object to processing based on legitimate interest.
- Port your data to another service.
- Withdraw consent where processing is based on consent.
To exercise any of these rights, email us at hello@mirret.co.uk. We'll respond within 30 days.
If you've been identified as an infringer
If you believe we've incorrectly identified you or your business as a brand impersonator, contact us. We take accuracy seriously and will review any disputed identification. If we've made an error, we'll correct our records and notify any platforms we've contacted.
Note: if you are engaged in brand impersonation, contacting us will not stop enforcement. We will continue to act in our clients' legitimate interest.
Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encryption in transit and at rest
- Access controls and authentication
- Regular security reviews
- Limited access on a need-to-know basis
No system is perfectly secure. If we experience a breach affecting your data, we'll notify you and relevant authorities as required by law.
Cookies
We use minimal cookies:
- Essential cookies — required for the website to function (e.g., form submissions).
- Analytics cookies — anonymous usage data to understand traffic patterns. No personal identifiers.
We don't use advertising cookies, tracking pixels, or third-party marketing tools.
Regional specifics
European Union & United Kingdom (GDPR)
Our lawful bases for processing are:
- Contract — to provide services to clients.
- Legitimate interest — to respond to enquiries, protect brands from fraud, and improve our services.
- Legal obligation — to comply with applicable laws.
You have the right to lodge a complaint with your local supervisory authority (e.g., ICO in the UK, CNIL in France).
California (CCPA)
California residents have specific rights under the CCPA. We do not sell personal information. We do not share personal information for cross-context behavioural advertising. You can request disclosure of data collected, request deletion, and will not face discrimination for exercising these rights.
Australia
We comply with the Australian Privacy Principles under the Privacy Act 1988. You can access your information, request correction, and lodge complaints with the Office of the Australian Information Commissioner (OAIC).
Changes to this policy
We may update this policy from time to time. Significant changes will be communicated to clients directly. The "last updated" date at the top reflects the most recent revision.