Supplementary Privacy Notice for Users in the EU/EEA, the United Kingdom and Switzerland (GDPR)
Version 1.1 · Updated October 10, 2026
This notice is for people who use I'm Miri while living in the European Union, the European Economic Area, the United Kingdom or Switzerland. It gives, in one place, the information required by the General Data Protection Regulation (GDPR) and the equivalent UK and Swiss rules: who is responsible for your data, why and on what legal basis we use it, who receives it, how long we keep it, and your rights. It does not start any new processing. It supplements our full Privacy Policy (miri.im/privacy-en), which describes each processing in detail; where this notice gives you more information or more protection, it applies.
1. Who is responsible for your data
Controller: I'm Miri (business name: Immeari; registered in the Republic of Korea, business registration no. 310-16-64260).
Contact for privacy matters: the I'm Miri Operations Team, our personal information protection officer under Korean law (PIPA) — cristina@miri.im. You can write in English or French. You may first receive an automatic reply; your request is still recorded and answered.
2. What we process
Account: sign-in with Apple or Google (account identifier, email address and name).
Birth details and readings: the name, gender, date, time and place of birth you enter, and the readings calculated from them.
Conversations: your messages and the oracles' replies, conversation summaries and the information remembered to keep context, and psychological survey results if you take them.
Mood records (optional): the mood you record in check-ins and the 21-day journey, only with your separate consent.
People you add (optional): information you enter about another person for compatibility readings. Only add someone if you are allowed to share their information.
Invitations and connections (optional): what is shared with people who accept your invitation (nickname, compatibility summary and, for connections, summary chart indicators, the relationship label you both confirm and daily relationship content), invite codes and reward records.
Purchases: plan, amount, date, transaction number and status of App Store or Google Play purchases.
Support: the email address, subject, text and attachments of messages you send through the in-app support chat or by email.
Technical data: device and system information, usage and access records, app error logs (linked to your random account identifier), the device token used for notifications, IP address, cookies and install origin (store install referrer).
Usage statistics: in-app events and usage attributes (Google Analytics for Firebase), linked to a pseudonymous account identifier — see section 3 for when we ask for your consent.
Your birth date is needed to calculate readings, and an account is needed to use the app; without them we cannot provide those features. Everything marked optional is up to you. More detail: section 2 of the Privacy Policy.
3. Why we use your data and our legal basis
Purpose
Legal basis (GDPR)
Your account, readings and the oracles' replies, invitations and connections, purchases, the pre-sign-in conversation trial, and support
Performance of a contract with you, or steps you ask for before entering into one (Art. 6(1)(b))
Compatibility readings using information about people you add
Our and your legitimate interests (Art. 6(1)(f))
Proactive messages from the oracles and other optional notifications
Consent (Art. 6(1)(a))
Usage statistics (Google Analytics for Firebase)
Consent (Art. 6(1)(a)) — asked in recent iOS and Android versions on devices set to a European region or time zone. The web version and older app versions do not ask yet, and a few invitation, referral and sign-up events are sent from our servers under a pseudonymous identifier, on the basis of our legitimate interest in measuring how the service is used (Art. 6(1)(f)).
Mood records in check-ins and the 21-day journey
Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)), because mood may be health-related
Conversation safety (detecting risks of suicide, self-harm or violence and showing crisis contacts)
Our legitimate interest in keeping users safe (Art. 6(1)(f)) and, where a risk is detected, the protection of vital interests (Art. 6(1)(d))
Security, preventing fraud and abuse (including invitation rewards and the trial), fixing errors, install attribution, and checking the quality of AI replies and support replies with AI analysis tools
Legitimate interests in running a safe and reliable service (Art. 6(1)(f))
Keeping purchase, contract and complaint records for the periods required by Korean law, and handling App Store refund reviews
Legitimate interests in complying with the laws that apply to us and defending our rights (Art. 6(1)(f))
You can withdraw a consent at any time; this does not affect the lawfulness of processing based on that consent before its withdrawal (section 7). If you refuse or withdraw a consent, only the feature that depends on it stops: without notification consent you do not receive proactive messages; without usage-statistics consent the app does not send usage statistics; without mood-record consent you cannot use check-in mood records. The rest of the service is unchanged.
Ads. We do not send ad measurement data (Google Ads) for installs that came from the EEA, the United Kingdom or Switzerland, and we never use your data to personalize ads.
Sensitive information in conversations. The app only asks for one kind of sensitive data, in an optional feature: mood records, collected with your explicit consent. Conversations are free text. If you choose to write about your health, beliefs or other sensitive matters, that text is handled like the rest of the conversation — used to reply to you, to summarize and remember context, and for the conversation safety analysis below — and is never used for advertising. If you do not want such information processed, please do not write it. You can delete a conversation, clear what the oracles remember, or delete your account at any time (section 7). Please avoid writing sensitive information about other people.
Conversation safety. If a message you send contains expressions related to suicide, self-harm or violence, an AI automatically analyzes that message and part of the preceding conversation. If there is a risk to the life or physical safety of you or someone you mention, we may make the reply safer, show verified crisis and emergency contacts, and pause fortune notifications for 72 hours. The analysis does not receive your account identifier, name, date of birth or Saju information, and its result is not stored with your account — we keep only daily statistics that identify no one. Crisis contact cards shown to you are kept with that conversation. No person reads your conversations in real time.
4. Who receives your data
Google LLC (USA): cloud storage and hosting (Firebase), app error logs and Google sign-in; usage statistics (Google Analytics for Firebase, if you allow them); generating AI replies (Gemini API) and backup conversation safety analysis; drafting support replies and store review replies with Anthropic's Claude models on Google Cloud (Vertex AI), which is not used for model training.
OpenAI, L.L.C. (USA): the first greeting of a conversation (without your name or birth date; from October 18, 2026 we may send one ongoing matter remembered from your conversations with that oracle, such as an upcoming interview or exam — never birth information or sensitive information — but no other conversation content); organizing what each oracle remembers from your conversations with it, using your conversation history with that oracle and what it already remembers, without storing birth information or sensitive information as memories (from October 18, 2026); automatic replies to in-app support inquiries; proactive messages for the oracles and languages we designate (otherwise only as a backup); AI consultation replies in certain countries and plans we designate; conversation safety analysis. We use OpenAI's option that disables response storage; under OpenAI's policy, data may be kept for up to 30 days for abuse monitoring and is then deleted. It is not used to train AI models.
Anthropic, PBC (USA): investigating support inquiries the in-app support AI could not resolve and drafting replies. It receives the inquiry (names and contact details masked), subscription, payment and refund records (including transaction numbers), sign-up date and platform, past inquiries, the usage and error records needed to find the cause and, if you agreed to it being viewed, part of your recent conversations — but not your account identifier or email address. It is not used for model training.
Plus Five Five, Inc. — Resend (USA): sending the app's emails (support replies, billing, cancellation and refund notices).
Apple: Apple sign-in, and — if you ask the App Store for a refund — purchase and usage information Apple requests to review it. You can object by writing to cristina@miri.im.
AI analysis tools: to check the quality of AI replies and support replies, investigate incidents and errors, and compare AI models, we analyze part of our conversation and support records with tools from OpenAI, Anthropic and Google, without email addresses and, except for incident investigations, without account identifiers; content sent to these tools is not used to train models (section 3-3-9 of the Privacy Policy).
Other users: only what you agreed to share through invitations and connections.
Authorities: where the law requires it.
More detail on what each provider receives: sections 4 and 5 of the Privacy Policy.
5. International transfers
We are established in the Republic of Korea. The European Commission has recognized Korea as providing an adequate level of protection for personal data (Commission Implementing Decision (EU) 2022/254), and the United Kingdom has made a similar decision (The Data Protection (Adequacy) (Republic of Korea) Regulations 2022). Our providers listed in section 4 process data mainly in the United States (and, for Google Cloud, in other Google processing regions). These transfers are needed to provide the service, for example to store your account and generate AI replies, and data is sent encrypted. Google's data processing terms with us provide for the European Commission's standard contractual clauses where EU data protection law applies. For our other providers: where a provider's terms with us include safeguards such as the European Commission's standard contractual clauses, or the provider is certified under the EU–U.S. Data Privacy Framework, those safeguards apply. To get more information about the safeguards for a given provider, write to cristina@miri.im.
6. How long we keep your data
Account and usage data: until you delete your account. After your request the account is blocked for 24 hours, then deletion runs automatically and is completed within 48 hours of the request.
A conversation you delete: its messages and summary are deleted immediately and cannot be recovered; technical processing logs are deleted within 30 days; from October 18, 2026, memory items based on that conversation are deleted too.
Mood records: 12 months, or earlier if you reset them or delete your account.
People you add: until you delete them or your account. Connections: shared summaries are deleted when you disconnect, block or delete your account.
Device token for notifications: deleted when delivery keeps failing or when you delete your account.
Usage statistics and app error logs: according to Google's retention policy and our retention settings for Google Analytics for Firebase and Firebase Crashlytics.
Pre-sign-in trial accounts that never sign in: deleted 7 days after creation.
Conversation safety: results are not stored with your account; crisis contact cards follow the conversation's retention; the notification pause is deleted after 72 hours.
Copies used for quality checks with AI analysis tools: deleted one year after the analysis.
Support inquiries: 3 years after the inquiry is resolved (pseudonymized after account deletion).
Purchase and contract records: 5 years; records of our advertising and labeling: 6 months; website access records: 3 months — periods set by Korean law. After account deletion these records are pseudonymized (your account identifier is replaced by an encrypted code).
Invitations: who-invited-whom records are kept for 1 year after the reward is confirmed or voided; an irreversible hash used only against invitation abuse is kept for 1 year after account deletion.
At our providers: as described in section 4 (for example, up to 30 days at OpenAI for abuse monitoring).
7. Your rights
You have the right to access your data, to have it corrected, to have it erased, to restrict its processing, and to receive the data you provided to us in a structured, commonly used and machine-readable format (portability). Where we rely on your consent, you can withdraw it at any time. These rights are free of charge.
Right to object. You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.
How to exercise them (Settings: open the menu, tap your name at the bottom of the menu — “You” if you have not set one — and choose “Settings”):
Correct your details: Settings › “My Info”.
Stop proactive messages: turn off “Every morning, a signal arrives” in Settings.
Usage statistics: turn “Usage statistics” on or off in Settings (shown on iOS and Android devices set to a European region or time zone).
Stop sharing with a connected person: on that person's details, “Disconnect” or “Block”.
Delete data without deleting your account: delete a conversation from the conversation list; use “Manage Memory” › “Clear” to erase what the oracles remember; or use “Reset Usage Data” to erase all conversations, memory, the people you added and mood records.
Delete your account: “Delete Account” at the bottom of Settings.
Everything else (access, a copy of your data, objection, restriction, withdrawing mood-record consent only): write to cristina@miri.im, preferably from your account's email address. We may ask for information to confirm your identity. We reply within one month of receiving your request; for complex requests this can be extended by up to two more months, in which case we tell you why within the first month.
Some requests may be limited by law, for example where we must keep purchase records. If you live in France, you can also give us instructions on what should happen to your data after your death. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where the alleged infringement took place — in France, the CNIL (www.cnil.fr); in the United Kingdom, the ICO (ico.org.uk); in Switzerland, the FDPIC (www.edoeb.admin.ch).
8. Automated decisions
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Two features act automatically: conversation safety (section 3) and checks against invitation-reward abuse, which may withhold a reward. If you disagree with an outcome, write to us at cristina@miri.im.
9. Security
We use technical and organizational measures such as encryption, access control and access logging (section 8 of the Privacy Policy).
10. Relationship with the full Privacy Policy
This notice is a supplementary summary of the Privacy Policy. Where it gives you more information or protection, it applies; otherwise the details are in the full Privacy Policy, in English (miri.im/privacy-en) and Korean (miri.im/privacy). Nothing in this notice limits the rights the law gives you. When this notice changes, we update the date at the top. Changes to the Privacy Policy that add new processing are announced on its page at least 7 days before they take effect (its section 13); corrections that add no new processing take effect when posted.