Mirate

Privacy Policy

Last updated: 30 September 2026

This policy explains how Elleve AS processes personal data when you use Mirate. We only process what is needed to give you the assessment, the workshop and the report, and we never sell your data.

1. Who is the data controller

Elleve AS (org. no. 927 034 425, Ryfylkegata 9, 4014 Stavanger) is the data controller for personal data in Mirate. Privacy questions go to hallo@elleve.no.

2. What data we process

We do not ask you to provide sensitive data such as health, religion or political views, and you should not enter it in the workshop. Mirate is a reflection tool about leadership and AI and does not need it.

  • Account data: your name and work email address. Your organisation is derived from the email domain.
  • The assessment: your answers, score, the phase you are placed in, and your chosen language.
  • The workshop: the messages you write, the replies from the AI thinking partner, and the suggestions you pick.
  • The report: the personal synthesis generated from your conversations.
  • Technical data: cookies for sign-in and language, and log data such as IP address and timestamps for troubleshooting and security.

3. Purposes and legal basis

  • To deliver Mirate to you: assessment, workshop and report. The basis is our contract with you, GDPR Article 6(1)(b).
  • Sign-in, security and abuse prevention, for example allowing work email addresses only. The basis is our legitimate interest, Article 6(1)(f).
  • To improve Mirate and produce anonymised or aggregated analysis across customers and industries. The basis is our legitimate interest, Article 6(1)(f). Results we share externally are anonymised and cannot be traced back to you.
  • To meet legal obligations, such as accounting and security requirements. The basis is Article 6(1)(c).

4. Who can see your data

Elleve staff who operate and develop Mirate can access answers, conversations and reports across customers, sessions and industries.

If you take part through an organisation, the organisation's administrator can see aggregated results for participants in the organisation's session. The administrator does not see individual answers, conversations or reports. You are told this before you start.

When you share your result yourself, for example with colleagues, only the message and link you choose are shared. Your result is not included.

5. Processors and AI

We use providers that process data on our behalf under data processing agreements:

  • Supabase: database and sign-in. Region: Frankfurt, Germany (EU).
  • Vercel: application hosting.
  • Anthropic: the AI model (Claude) that runs the workshop and generates the report. Your messages are sent to Anthropic to produce replies. Anthropic does not use content sent through its API to train its models.
  • Resend: sends the sign-in link.

6. Transfers outside the EEA

Some providers may process data in the United States or other countries outside the EEA. We then rely on a valid transfer mechanism, such as the EU Standard Contractual Clauses or the recipient's certification under the EU-US Data Privacy Framework.

7. How long we keep data

We keep your account and results while you use Mirate, and for up to 36 months after your last activity. After that they are deleted or anonymised. You can ask for earlier deletion, see section 9. Security logs are deleted after 180 days.

8. Cookies

Mirate only uses necessary cookies: one to keep you signed in and one to remember your language. We use no advertising or tracking cookies and share nothing with ad networks. Because these cookies are necessary for the service, we do not need consent for them.

9. Your rights

You have the right to:

  • access the data we hold about you
  • have inaccurate data corrected
  • have your data erased
  • restrict or object to processing
  • receive your data in a common machine-readable format (data portability)

10. How to use your rights

Email hallo@elleve.no. We reply within 30 days. If you disagree with how we process your data, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no).

11. Security

Data is stored encrypted and protected with row-level access control, so you only see your own data. Access for Elleve staff is limited to those who need it. If a breach affects you, we will notify you and Datatilsynet as the law requires.

12. Changes

We may update this policy. The date at the top shows the latest version. For material changes we will notify you in Mirate or by email.