Privacy Policy

The data controller is the MIRA team. To learn the controller’s full name and contact details, and for any request about your data, write to privacy@mirajob.cloud: we reply within a few days.

Account. First and last name, email, university and level of study. Your password is stored encrypted. If you sign in with Google, we receive your name, email and profile picture from Google.

MiraCard. What you put in the card: availability, studies, experience, skills, languages, personal profile, career plan, photo and phone number. If you upload your CV, or the PDF of your LinkedIn profile, we keep the file and the information we read from it. If you upload your transcript, we keep exams, grades, credits and average.

Use of the service. Applications to associations and answers to their forms, with their outcomes; scheduled interviews; messages exchanged on MIRA with associations and companies; contact requests you receive; applications to a Talent Pool and their outcome.

Associations and companies. The information on the association’s or company’s page, and the name, email and role of the people who manage it. For companies, the searches they create and the data needed for payments and accounting documents. Card details are handled by Stripe: we never receive them.

Technical data. Access and operation logs, including the log of processing done with artificial intelligence. If you turn on notifications, we keep the technical address your browser assigns to the device and the keys used to encrypt them: they are deleted when you turn notifications off. If you add MIRA to your Home screen, we record that you use it as an app.

You decide what to write in your card. Only your account details and your university are required to use the service.

While you build your card, nobody. A MiraCard in progress is visible only to you.

Companies, anonymously. When you publish your card, you agree to be found by registered companies. They see the card without your name, photo and contact details. If a company writes to you, you decide whether to reply and whether to share your name and contact details. Turning off “I am available” in Availability stops companies from finding you.

Associations, when you reach out to them. An association sees your card, with your name, email and CV if you uploaded one, when you apply to one of its selections, send it an open application, answer one of its forms or are a member. Your phone number, if you added it, is visible to the associations you apply to. Your average and grades follow the setting you choose in the Education section.

Anyone with your public link. The public link is off until you turn it on. When it is on, anyone with the link sees the card with your name and contact details, without average and grades. You can turn it off whenever you want and the link stops working.

The MIRA team. Authorised team members can access account data for support, security, reviewing Talent Pool applications and verifying associations and companies.

We do not sell your data and we do not pass it to anyone for marketing purposes.

To provide the service (performance of a contract, Art. 6.1.b GDPR): creating your account and MiraCard, handling applications, interviews and messages, handling companies’ searches and payments.

To let companies find you (consent, Art. 6.1.a): you give it when you publish your card and you can withdraw it at any time by turning off your availability or writing to us. Withdrawal does not affect what happened before.

For security, operation and improvement of the service (legitimate interest, Art. 6.1.f): technical logs, abuse prevention, internal statistics on how the platform is used, service communications.

For legal obligations (Art. 6.1.c): keeping accounting records. Any promotional communications will only be sent with your consent.

We use artificial intelligence models to: read your CV and transcript and copy their data into your card; correct the texts of your card and translate them into English, without adding information; read cards to compare them with companies’ searches and write a compatibility report; help associations read applications; write the messages of the assistant that guides companies.

The model providers, currently Google and OpenAI, process data on our behalf and, under their terms for API use, do not use it to train their models. No decision with significant effects on you is taken by an automated system alone: who to admit, who to contact and who to hire is always decided by people. We do not produce psychological assessments or personality profiles: what your card says about your character is what you wrote. You can ask for human review of any outcome by writing to privacy@mirajob.cloud.

Supabase (database, sign-in and file storage, in the European Union), Vercel (website hosting), Google (artificial intelligence models and Sign in with Google), OpenAI (artificial intelligence models), Resend (sending emails), Stripe (company payments). Notifications go through the notification service of your browser or operating system (Apple, Google, Mozilla). We have data processing agreements with these providers under Art. 28 GDPR. The up-to-date list is available on request.

Sometimes we point you to partner services, for example for tutoring or selling second-hand books. We do not pass your data to them: if you follow the link, their privacy policy applies.

The database and files are stored in the European Union. Some providers may process data in the United States: in those cases the transfer relies on the European Commission’s adequacy decisions, including the EU-U.S. Data Privacy Framework where applicable, or on Standard Contractual Clauses.

We only use technical cookies: the ones that keep you signed in, remember your language and, if you came from one of our campaigns, remember which one. Some preferences, such as the card view you prefer, stay in your browser’s storage. We do not use profiling cookies or third-party tracking tools, which is why you do not see a cookie banner.

We keep your data as long as your account is active. Whatever you remove from your card immediately stops being visible to others. If you ask us to close your account, we delete your personal data within 30 days, except what the law requires us to keep, such as accounting records for ten years, and data made anonymous in aggregate form. Associations and companies that have already received your card or contact details process them as independent controllers: you can ask them directly to delete it, and we will help if needed.

You can access your data, correct it, delete it, restrict its processing, receive it in a portable format, object to its processing and withdraw your consent (Arts. 15-22 GDPR). Much of this you can do yourself: you edit your card from your page, and availability, public link and notifications are turned off from there. For everything else, including closing your account, write to privacy@mirajob.cloud. You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

MIRA is for adults only. If you are under 18, do not sign up.

We may update this policy. If a change is substantial, we will let you know on the platform or by email. The date of the last update is at the top of the page.