MirutoLegal
Privacy Policy
This policy explains how random forest OÜ (“Miruto”, “we”) handles personal data as a controller: data about merchants who use Miruto, people who visit miruto.app and people who contact us. For shoppers of stores that use Miruto, the store is the controller and we are its processor; see section 7 and the Data Processing Agreement.
1. Who we are
random forest OÜ, registry code 14743851, VAT EE102321933, Telliskivi tn 60/5, 10412 Tallinn, Estonia. Contact for privacy questions: hello@miruto.app.
2. Data we collect
- Merchant account: name, email address and WordPress role of the person who connects a store or is invited to the account, interface language, sign-in times.
- Store technical data: store name and address, plugin version, WordPress, WooCommerce and PHP versions, theme and active plugins, time zone, currency, and summary statistics (for example the number and value of abandoned checkouts). These are business data; they become personal data only if they identify a person.
- Early access form on miruto.app: email address, store address, language and country you choose.
- Emails and support: what you write to us and our replies.
- Security logs: IP address and time when a one-time sign-in link is requested or used (to prevent abuse), and error logs of the console.
3. Why we use it and legal basis
- To provide the service you signed up for: create the account, sign you in, show your stores and send service emails (contract, GDPR Art. 6(1)(b)).
- To keep the service secure, prevent abuse and fix errors (legitimate interest, Art. 6(1)(f)).
- To answer early-access sign-ups and support emails (steps before a contract or legitimate interest).
- To keep accounting records and invoices (legal obligation, Art. 6(1)(c)).
We do not sell personal data and we do not use merchant or shopper data for advertising.
6. Transfers outside the EEA
Some providers (for example Cloudflare and Anthropic) are based in the United States or process data globally. We rely on the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.
7. Shoppers of Miruto stores
If you shopped at a store that uses Miruto, the store decides why your data is used and is responsible for it. Miruto processes it only on the store’s instructions: to show the store its reports and, if the store has switched it on, to send you a short reminder or answer you about your order. You can stop messages at any time by replying STOP or by saying in your own words that you do not want them. For other requests, contact the store; we help the store to answer.
8. How long we keep it
- Account data: while the account is open, and deleted within 30 days after it is closed.
- Early access sign-ups: until the service starts for you or you ask us to delete them, at most 24 months.
- One-time sign-in records: 30 days. Console error logs: 90 days.
- Invoices and accounting records: 7 years, as required by the Estonian Accounting Act.
9. Your rights
You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on legitimate interest. Write to hello@miruto.app; we answer within one month. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the authority in your country.
10. Security
Data is sent only over HTTPS. Every request between a store and the console is signed with a store-specific key. Each conversation is stored separately and the agent can only see the data of the store it works for. Access to the superadmin area requires Cloudflare Access sign-in with a one-time code.
11. Changes
We update this policy when our processing changes. The date at the top shows the latest version; for material changes we also tell merchants by email.