MirageCHAT (“MirageCHAT”, “we”, “us”) provides a business messaging platform that lets customer‑support agents receive and reply to conversations from connected channels such as WhatsApp and Instagram. This Privacy Policy explains what information the MirageCHAT mobile application (the “App”) processes, why, and the choices you have. MirageCHAT is operated by Mirage Global Technologies LLC, a Wyoming limited liability company, United States.
MirageCHAT is a business‑to‑business tool. Agents access the App using credentials issued by their organization (the “Workspace”). The Workspace is the data controller of the end‑customer conversations processed through the platform; MirageCHAT acts as a data processor on the Workspace’s behalf, under our Data Processing Addendum.
| Category | Examples | Purpose |
|---|---|---|
| Account information | Agent name, email address, role, workspace, and the account permissions assigned by the administrator | Authenticate the agent and show only the accounts they are allowed to use |
| Messages & media | Conversation text, photos, videos, voice notes, and files exchanged with end‑customers through connected channels | Display conversations and let the agent reply. This content belongs to the Workspace. |
| Location — only when shared | The device’s location, read once at the moment the agent taps “Send location” in a chat | Send the location to the customer as a message. It is never read in the background, never tracked, and never stored beyond the sent message. |
| Contacts — only the one chosen | The name and phone number of a single contact the agent picks from the device’s address book | Send that contact card to the customer as a message. The address book is never read as a whole, never uploaded, and nothing is kept apart from the contact actually sent. |
| Device & push token | A push notification token and device model/OS version | Deliver new‑message notifications to the correct device |
| Diagnostics | Crash and error information | Keep the App stable and secure |
The App does not collect your location, contacts, calendar, SMS, or advertising identifier. Camera, microphone, and photo‑library access are used only when you choose to attach or record media inside a conversation.
We do not sell your personal information and we do not use conversation content for advertising.
MirageCHAT stores, accesses and reads information on your device and in your browser, using cookies and similar technologies (browser local storage, session storage and a service worker):
We do not use advertising cookies inside the MirageCHAT app or in your Workspace. On our public website we use cookies and similar technologies for advertising only if you accept them (see Website visitors and advertising below and our Cookie Policy). You can clear this information at any time in your browser or device settings; signing out removes the sign‑in token.
This section applies to people who visit our public website — not to the app, and not to the conversations of a Workspace. For website visitors, Mirage Global Technologies LLC is the controller.
What is collected. If you accept marketing cookies, two advertising pixels and Google Ads conversion tracking run on our public pages. The Meta Pixel records that a page was viewed, that you clicked to start a free trial and that you finished signing up. The TikTok Pixel records that a page was viewed, that you finished signing up and that your free trial started. Google Ads records that a page was viewed and that you finished signing up, and which Google ad you clicked to arrive. With each of these goes what the provider’s code reads from your browser: the page address, the ad or link that brought you, your browser and device type, your approximate location and your IP address. We never send the content of conversations, your email address, your phone number or any data from inside the app.
Who receives it. Meta Platforms and TikTok, and Google for Google Ads, to measure our ads and to show them to people with similar interests. Each acts as an independent controller under its own privacy policy. We do not sell personal information for money. Some US state laws describe this kind of sharing as “sharing for cross‑context behavioral advertising”; you can opt out as described below.
Why, and on what basis. To measure and improve our marketing and to advertise our service — only with your consent. Nothing from Meta or TikTok loads before you choose “Accept all”, and nothing from Google either, and you can withdraw your consent at any time on the Cookie Policy page.
Your choices. Accept or reject in the banner, and change your choice at any time on the Cookie Policy page. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale and sharing and neither pixel ever loads, nor Google Ads. Rejecting does not limit your use of the website. Depending on where you live you can also ask us to access, correct, delete or export your data, to object to or restrict how we use it, and to appeal a refusal, and you can complain to your data protection authority. Write to privacy@miragechat.io; we reply within 30 days.
How long. We keep no copy of these events on our servers. Your cookie choice is stored only in your browser, until you change it or clear your browser data. Meta, TikTok and Google keep the data they receive under their own policies.
International transfers. Meta Platforms, Inc. and Google LLC are in the United States; transfers rely on the EU–US Data Privacy Framework or on standard contractual clauses. TikTok may process the data outside your country under the safeguards its own privacy policy describes.
Children. The website is not directed to people under 16, and we do not knowingly collect their data for advertising.
A Workspace connects its own business accounts. Each connection is made on the platform’s own sign-in screen; we never see or ask for a platform password, and we request only the permissions listed here.
We receive the messages, comments, mentions and reviews sent to the WhatsApp numbers, Facebook Pages and Instagram accounts a Workspace connects, with the name and picture of the person who wrote, so its team can answer them. We publish only the posts the Workspace chooses, and read the numbers of its Pages and posts live, without storing them.
| Permission | Data received | Purpose |
|---|---|---|
| public_profile | The connecting administrator’s Meta user ID, name and profile picture | Identify who is signed in |
| business_management | The business portfolio assets the administrator selects: WhatsApp Business Account, phone numbers and Pages | Connect those assets to the Workspace |
| pages_show_list | The list of Facebook Pages the Workspace manages | Let the Workspace choose which Page to connect |
| pages_manage_metadata | Page subscription to webhooks | Receive the Page’s messages, comments, mentions and reviews in real time |
| pages_messaging | Messenger conversations and message content with the Page | Show the conversation in the inbox and let the agent reply |
| Business Asset User Profile Access | The name and profile picture of a person who writes to the Page | Show who wrote, in the inbox |
| pages_read_engagement | The Page’s posts with their reactions and comment counts, and read receipts on Page conversations | Show each post next to its comments, show delivery and read receipts |
| pages_read_user_content | Comments, mentions and reviews that people leave on the Page and its posts, with the person’s name and ID | Show them in the Comments screen so staff can answer them, and send one private reply to a person who commented when the Workspace has set this up |
| pages_manage_engagement | — | Reply to, hide, unhide, like or delete comments on the Page’s posts when staff, or an automation the Workspace set up, does so |
| pages_manage_posts | The ID and link of each post MirageCHAT publishes | Publish the posts, photos, videos, reels and stories the Workspace chooses in Instant Post (Social Studio) to its own Page, and edit or delete them when the Workspace asks |
| read_insights | Views, reach, clicks and reactions of the Page and its posts | Insights and Analytics. Read when the screen is opened and not stored |
| instagram_basic, instagram_business_basic | The linked Instagram Business account ID, username and profile picture | Identify the Instagram account inside the inbox |
| instagram_manage_messages, instagram_business_manage_messages | Instagram Direct conversations sent to the connected Business account | Show Instagram DMs and allow replies inside Meta’s messaging window |
| instagram_manage_comments, instagram_business_manage_comments | Comments and mentions on the Instagram account’s posts, with the commenter’s username | Show them in the Comments screen so staff can reply, hide or delete them, and send one private reply to a person who commented when the Workspace has set this up |
| instagram_content_publish, instagram_business_content_publish | The ID and link of each post MirageCHAT publishes | Publish the posts, carousels, stories and reels the Workspace chooses in Instant Post (Social Studio) to its own Instagram account |
| instagram_manage_insights, instagram_business_manage_insights | Reach, views, saves and shares of the Instagram account and its posts | Insights and Analytics. Read when the screen is opened and not stored |
| instagram_manage_contents | — | Delete a post, story or reel of the Workspace’s own Instagram account when an owner or admin of the Workspace asks |
| instagram_manage_engagement | Which posts and comments MirageCHAT liked for the Workspace | Like or unlike posts, comments and replies on the Workspace’s own Instagram account when staff, or an automation the Workspace set up, does so |
| whatsapp_business_messaging | Inbound and outbound WhatsApp Business messages, phone-number IDs, and the templates the Workspace approved with Meta | Two-way WhatsApp messaging with the Workspace’s own clients |
| whatsapp_business_management | WABA ID, phone-number assets, template list and status | Let the Workspace view and pick approved templates |
We do not request user emails, friend lists, ads or audiences. Posts, comments, mentions, reviews and insights are read only for the Pages and Instagram accounts the Workspace itself connected, and only to show them to the Workspace’s staff and act on them at their request. We store the comments, mentions and reviews the Workspace manages in MirageCHAT, like its messages, and the record of each post it published; Page and Instagram numbers are read live and not stored.
Only for the business’s own TikTok account, after it approves each permission on TikTok’s own screen. We publish the videos and photo posts the business chooses, show the comments and direct messages it answers, and read its numbers live, without storing them. We never re-publish TikTok content or share TikTok data with third parties.
TikTok — only for the business’s own TikTok account, after the business approves each permission on TikTok’s own authorization screen. A post reaches TikTok only in a way the business chose: a person publishes or schedules it from Instant Post and chooses TikTok’s settings for it; or, when the business turns on “TikTok direct” for one of its API keys, the business’s own system publishes through the MirageCHAT Publishing API and sends TikTok’s settings with each post. Without “TikTok direct”, a post sent through the API waits for a person to approve it in MirageCHAT, or goes to the creator’s TikTok inbox as a draft. MirageCHAT never chooses TikTok’s settings itself.
| Scope | Data received | Purpose |
|---|---|---|
| user.info.basic, user.info.username | Display name, username and avatar of the connected account | Show which account a post goes to and which account a message or comment belongs to |
| user.info.profile | Profile picture, display name, verified badge, bio and profile link | The connected-account card and the Insights profile |
| user.info.stats | Followers, likes, following and total videos of the business’s own account | TikTok Insights. Read live each time the panel is opened and never stored |
| user.account.type | Whether the connected account is a Business or a personal account | Tell the business which TikTok features its account can use |
| user.insights, video.insights | Profile and video analytics of the business’s own account (views, watch time, audience) | Insights and Analytics. Read live and not stored |
| video.list | The videos already published to the connected account, with cover image and link | Show what actually went live, and list the videos whose comments the business answers |
| video.publish | — | Publish the video or photo post the business chose in Instant Post or sent through the Publishing API, with the privacy, comment, Duet and Stitch settings chosen for that post |
| video.upload | — | “Send to TikTok inbox”: a draft the creator finishes in the TikTok app |
| comment.list, comment.list.manage | Comments and replies on the business’s own videos, with the commenter’s username | Show them in the Comments screen so staff can reply, hide or delete them |
| message.list.read, message.list.send, message.list.manage | Direct messages that people send to the business’s TikTok Business Account, and the business’s replies | Show the conversation in the inbox and let staff reply within TikTok’s messaging rules. MirageCHAT never starts a conversation |
| biz.brand.insights | Public videos and comments that mention the business’s account | Show the business where it is mentioned so it can answer |
We store the account’s TikTok identifier, username and display name, the access and refresh tokens needed to act on its behalf, the record of what was posted and when, and — like any other channel — the messages and comments the business manages in MirageCHAT. Profile and video numbers are not stored. We do not download or re-publish TikTok content to other platforms, do not build profiles of the people who write to the business, and do not share TikTok data with third parties. TikTok messaging is being rolled out and requires TikTok’s approval of MirageCHAT.
This Service uses YouTube API Services. Through them a business publishes videos to its own YouTube channel, answers the comments on them and the live chat of its own live streams, and sees how they did. A business connects only its own channel, on Google’s own consent screen, where it sees and can decline each permission. By connecting a YouTube channel the business agrees to be bound by the YouTube Terms of Service, and the data Google holds about it is governed by the Google Privacy Policy. MirageCHAT’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
| Scope | Data received | Purpose |
|---|---|---|
| youtube.readonly | The connected channel’s ID, name, handle and picture; its uploaded videos with title, thumbnail and link; its playlists | Show which channel a video or a reply goes to, and list the videos whose comments the business answers |
| youtube.force-ssl | Comments and replies on the channel’s videos, with the commenter’s channel name and ID; while the channel is live, the messages of its live chat, with each viewer’s channel name, picture and ID | Upload the video the business chose in Instant Post, with the title, description, visibility (Public, Unlisted or Private), “made for kids” answer and time it set, and add it to a playlist it picked; show the comments in the Comments screen so staff can reply as the channel, hold a comment for review or remove it; show a live stream’s chat in the shared inbox so staff can answer it as the channel; on a channel whose owner allowed automations, reply under a comment or hold it for review by the rules the business set; when the business asks, delete a video MirageCHAT uploaded, change its title, description or visibility, or set its thumbnail |
| yt-analytics.readonly | Views, watch time, likes, comments, shares and subscribers of the channel and its videos, and where the views came from (countries and traffic sources) | YouTube Analytics, shown on its own and never added to the numbers of other platforms. Read when the screen is opened, kept in memory for at most 15 minutes and not stored |
We store the channel’s YouTube ID, name and handle, the access and refresh tokens needed to act on its behalf (encrypted), the record of each video MirageCHAT uploaded for the business (its ID, link and status), and the comments the business manages in MirageCHAT, with each commenter’s channel name and ID. A stored comment is read again from YouTube before it is 30 days old; if YouTube no longer has it, we delete it. The messages of a live chat, with each viewer’s channel name, picture and ID, cannot be read again once the live stream is over, so we empty them 30 days after they were written. We do not download or re-publish YouTube videos, do not sell YouTube data or use it for advertising, and do not share it with third parties other than the sub-processors listed below that host, protect and back up the Service. A YouTube comment is answered automatically only on a channel whose owner or admin has allowed automations on it in MirageCHAT, after reading what they do: then an automation the business set up may reply under the comment or hold it for review, at most 20 times a day. Who allowed it and when are recorded; it can be withdrawn at any time, and disconnecting the channel withdraws it. Otherwise every reply is written and sent by a person. A live chat is never answered by a rule or AI.
Withdrawing YouTube access. The business can withdraw MirageCHAT’s access at any time: in MirageCHAT, with “Disconnect” on the channel, which revokes the access at Google at once and deletes the stored tokens; or in its Google Account, at security.google.com/settings/security/permissions. Everything we stored from YouTube for that channel — its comments, its name, handle and channel ID, and the YouTube IDs and links of the videos it published — is then deleted: after a Disconnect in MirageCHAT, as soon as possible and in any case within 7 days; after access is withdrawn at Google, within 30 days. Its live chat messages lose their words and each viewer’s name, picture and channel ID by the same deadlines. The channel’s card stays in the Workspace without a name, so that it can be connected again or removed.
We do not sell or rent personal data. We do not use platform data to build advertising profiles or to train foundation models. Data is shared only with the providers needed to run the service:
Our own infrastructure. MirageCHAT runs on infrastructure that Mirage Global Technologies operates itself: its own network (AS403001), its own IP addresses and routers, and the servers at each of its points of presence in the European Union and the United States. The application, the PostgreSQL database and stored media run on these servers, and the encrypted database backups are kept on a separate MGT server in Germany.
The advertising providers named in Website visitors and advertising (Meta and TikTok) are not sub‑processors of any Workspace: they never receive Workspace data or conversations.
The companies that process data for the service are the platforms a Workspace connects (Meta, TikTok, Google for YouTube, Telegram), Cloudflare for DNS and encryption in transit, Apple and Google for push notifications, Stripe for card payments and, only when a Workspace turns them on, the AI providers Anthropic, OpenAI and Google (Gemini).
| Sub-processor | Purpose | Region |
|---|---|---|
| Meta Platforms, Inc. | Inbound and outbound messaging over WhatsApp, Messenger and Instagram; publishing, comments, reviews and insights of the Facebook Pages and Instagram accounts a Workspace connects | EU / US (with SCCs) |
| TikTok (ByteDance Ltd.) | Publishing, messages, comments, mentions and insights of a connected TikTok account, when the Workspace connects it | EU / US (with SCCs) |
| Google LLC — YouTube | Publishing, comments and analytics of a connected YouTube channel, when the Workspace connects it | US (with SCCs) |
| Telegram | Inbound and outbound messages of a Telegram bot, when the Workspace connects its own bot | Global |
| Cloudflare, Inc. | DNS, TLS encryption in transit and content delivery for miragechat.io | Global (with SCCs) |
| Google LLC | Firebase Cloud Messaging — push notification delivery to Android devices | EU / US (with SCCs) |
| Apple Inc. | Apple Push Notification service — push delivery to iOS devices | EU / US |
| Stripe, Inc. | Card payment processing for Workspace subscriptions | EU / US (with SCCs) |
| Anthropic PBC | Claude API for optional AI features (draft replies, summaries, translation) — only when the Workspace turns them on | US (with SCCs) |
| OpenAI, L.L.C. | OpenAI API for optional AI features (draft and automatic replies) — only when the Workspace turns them on | US (with SCCs) |
| Google LLC | Gemini API for optional AI features (searching the Workspace’s knowledge library, draft replies, photo descriptions) — only when the Workspace turns them on | US (with SCCs) |
When a Workspace connects its own messaging accounts, messages travel through that platform because the Workspace chose it. When a Workspace supplies its own API key for an AI provider, that provider processes the request under the Workspace’s own agreement with it. We notify Workspaces at least 14 days before adding or replacing a sub-processor, as set out in the Data Processing Addendum.
Transactional email is sent from our own mail servers, not through a third-party email provider. We may also disclose information if required by law, or to protect the rights, safety and security of our users and the service.
Conversation data is retained for as long as the Workspace keeps it in the platform, or until the Workspace requests deletion, and for 30 days after the Workspace is terminated. Operational logs are kept for security and audit purposes. Database backups are taken every night, encrypted (AES-256) and kept on our servers and on a separate backup server in Germany; only our administrators can decrypt them: daily copies for 30 days and one monthly copy for up to 12 months. Push tokens are removed when you sign out or when the device becomes unreachable.
A channel’s platform data — its stored tokens and the channel itself — is deleted when the Workspace removes the channel permanently or when the Workspace’s account is deleted, as described in section 6. Data tied to an end user is deleted within 30 days of a verified deletion request.
Disconnecting a channel. A Workspace can disconnect any connected account from inside MirageCHAT. The channel is switched off in MirageCHAT and posts scheduled for it are not published; its conversation history and its tokens are kept, encrypted, so that the Workspace can connect it again. Disconnecting does not withdraw the permission at the platform. Disconnecting a TikTok account is stricter: its stored tokens are deleted at once and its automatic schedules stop. Disconnecting a YouTube channel goes further, as YouTube requires: MirageCHAT withdraws its access at Google at once and deletes the stored tokens. Disconnecting a Google Business Profile goes as far, as Google’s policies ask: its stored tokens and the reviews read from it are deleted at once, and MirageCHAT withdraws its access at Google unless another profile connected through the same Google account is still connected. Disconnecting a Telegram bot also tells Telegram to stop sending its messages to us.
Removing a channel permanently. “Remove permanently” deletes the channel and its stored tokens at once. It is available for a channel that holds no conversations; a channel with conversation history can be disconnected, and its data is deleted together with the Workspace’s account.
Deleting the Workspace. When the owner of a Workspace asks us to delete it, we verify the request and then delete every channel, its tokens and all conversation data within 30 days, as described on our data deletion page.
Withdrawing the permission at the platform. Apart from YouTube and Google Business Profile (above), MirageCHAT does not withdraw a permission at the platform on the Workspace’s behalf. The Workspace can remove MirageCHAT in the platform’s own settings at any time — on TikTok at Profile → Settings and privacy → Security and permissions → Apps; on Google at security.google.com/settings/security/permissions. When Instagram or TikTok tells us that the permission was withdrawn, we switch the channel off at once.
End-user requests. Anyone can request deletion of the data tied to their Facebook user ID, Instagram account, WhatsApp number or TikTok account by writing to privacy@miragechat.io with the subject “Data Deletion Request” and the relevant Page ID, handle or number. We confirm deletion within 30 days. Full instructions, including what is erased and what is kept, are on our data deletion page.
Data is transmitted over encrypted connections (HTTPS/TLS 1.2+). The access tokens and keys that connect a Workspace’s accounts on other platforms are encrypted at rest (AES-256-GCM), with the key kept outside the database, and backups are encrypted (AES-256). Authentication uses short-lived tokens. Access is restricted to the accounts an administrator assigns to each agent, and every query is scoped to a single Workspace — one Workspace can never reach another’s data. Administrative actions are logged. The App offers an optional device-level lock (fingerprint/face and/or a 4-digit PIN); lock secrets never leave the device.
Depending on your location (for example under the EU/UK GDPR or the California CCPA), you may have the right to access, correct, or delete your personal data, to object to or restrict its processing, to data portability, and to lodge a complaint with your local data protection authority. Because conversation data is controlled by your Workspace, please direct such requests to your Workspace administrator, or contact us and we will assist the controller in responding. We respond within 30 days.
Residents of certain US states can opt out of the sale or sharing of personal information and of targeted advertising, and can use a Global Privacy Control signal for this; see Website visitors and advertising.
MirageCHAT is intended for use by businesses and their staff. It is not directed to children under 16, and we do not knowingly collect their data.
MirageCHAT is offered globally. Where data is transferred across borders, we rely on appropriate safeguards consistent with applicable law, including Standard Contractual Clauses with the sub-processors listed above.
This Policy is governed by the laws of the State of Wyoming, United States, without prejudice to the rights of European data subjects under the GDPR.
We may update this Policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where required, by notifying Workspaces by email at least 14 days before the change takes effect.
Questions about this Policy, and any privacy or data-deletion request, can be sent to privacy@miragechat.io.