Privacy Policy

Mirific Technologies Inc.

Version 3.0. Effective October 23, 2026.

1. Who we are

Mirific Technologies Inc. (“Mirific,” “we,” “us,” or “our”) is a company incorporated in British Columbia, Canada. We provide an execution intelligence platform that helps organizations connect their strategic plans to the operational and financial systems where their work happens.

This Privacy Policy explains what information we collect, how we use it, who we share it with, how we protect it, how long we keep it, and the rights and choices you have. It applies to the Mirific platform at mirific.ai and its associated applications and services (the “Service”).

Data controller. For the purposes of applicable data protection law, the controller is Mirific Technologies Inc., 6620 East Boulevard, Vancouver, BC V6P 5R1, Canada. Where your organization uses the Service, your organization decides what it records in its workspace, and we process that content on its behalf.

Contact. Privacy questions and product support: support@mirific.ai.

2. Information we collect

Account and profile information. When you create an account or accept an invitation, we collect your name, email address, job title, role, and organization. If you sign in with Google, we receive the basic profile information Google shares to establish your identity. If you turn on two-step sign-in, we keep the secret your authenticator app uses, encrypted, and your recovery codes in a form that cannot be read back.

Information you provide about your business. The Service works from what your organization tells it: its purpose, values, goals, Strategic Projects and their Thesis and Stop Criterion, deliverables, people and departments, decisions recorded in sessions, documents attached to work, and the financial figures you choose to enter, such as revenue, cash on hand, operating burn and people cost. This is the core of what the Service reasons over.

Information from systems you connect. If your organization connects a supported third-party system, we read a defined, limited set of information from it, described in Section 3.

Meeting notes and transcripts. If your organization pastes the notes of a meeting, or connects a meeting tool so that transcripts can be proposed to a session, we keep that text in your workspace for the period your organization sets (90 days unless it chooses otherwise).

Conversations with Ask Mirific. Questions asked of Ask Mirific and its answers are kept in your workspace so you can return to them, unless your organization sets a retention period, after which they are deleted.

Usage and technical information. We record how the Service is used, for security, reliability and product improvement: sign-ins (with the role held at the time), items created and completed, decisions on proposals and findings, and connection activity, together with standard technical data such as IP address, browser type and timestamps. We also count which areas of the Service each role opens and what words people search for in Help; those two records are kept without any name, email, organization, session, IP address or browser attached.

We do not intentionally collect special categories of sensitive personal information, and we ask that you do not enter such information into the Service.

3. Connected systems

Your organization can connect supported third-party systems so that the Service can read the work and the money as they move, instead of relying only on what people type. A connection is always started by someone in your organization with the authority to do so, and can be disconnected at any time from within the Service. On disconnection we stop reading, and the connection’s credentials are cleared.

Most connections only read. For each system, the Service reads only what is listed below, and the permission Mirific requests is the narrowest the provider offers.

Connections that can write. Two parts of the Service send information out, and we name them here so nothing about them is a surprise:

• Slack. When your organization connects Slack, Mirific can send direct messages to people in your workspace, such as notifications they have chosen to receive. It posts nothing to channels.
• Mirific Work in Microsoft Teams. When your organization saves a Teams webhook for Mirific Work, Mirific posts cards to that channel: a proposed change to a Strategic Project, its approval or rejection, the change being carried out, and its reversal. The changes themselves are made inside Mirific, never in another system, and only after an Owner or Admin who is neither the proposer nor an owner named in the change approves them; each can be reversed.

Connection credentials are encrypted at rest using envelope encryption under a dedicated key management service key, isolated per environment; every decryption is logged. Figures and evidence already read stay in your workspace after you disconnect, labelled with their source and date, until your workspace is deleted or you ask us to remove them.

Our use of information received from Google, Microsoft, Intuit, Xero and other providers’ APIs complies with those providers’ applicable developer and API policies, including their limited-use requirements.

4. How we use information

We use the information we collect to:

• provide, operate and maintain the Service;
• produce the readings, findings, proposals, summaries and reports that are the Service’s core function;
• authenticate you, including two-step sign-in, and secure your account and your organization’s data;
• send the communications the Service sends: invitations, password resets, and the notifications you can manage in your settings;
• monitor, measure, improve and secure the Service; and
• comply with legal obligations.

We do not use your business or financial information for advertising, and we do not sell it.

5. Automated reasoning and our model provider

The Service uses large language models to produce some of its reasoning, drafts, summaries and reports. To do this, relevant information from your workspace, which can include the business and financial figures described above, is sent to our model provider, Anthropic (in the United States), to be processed into the output you see.

Information sent for processing is governed by Anthropic’s commercial API terms, under which data we send is not used to train Anthropic’s models and is deleted by Anthropic within 30 days of processing. We do not use your data to train third-party models, and our agreements with our providers prohibit them from doing so.

Every draft the Service produces on your behalf, such as a drafted Thesis or Stop Criterion, stays labelled as a draft until a person in your organization confirms it.

6. Derived and aggregated information

Derived information about your organization is yours. From what your organization records and connects, the Service derives readings: pace, findings, proposals and their outcomes, predictions and how they were graded, reports, and the record of decisions. These are part of your organization’s workspace content. They are shown only to the people your organization’s roles allow, and they are deleted with your workspace.

Benchmarks are opt-in. In Mirific Portfolio, a company may choose to join a benchmark comparison. If it joins, its readings are combined with those of other companies that joined, into bands that cover at least five companies. A band never names a company, never shows how many companies are in the comparison, and cannot be read back to any one company. A company that has not joined contributes nothing to these bands, and a company can leave the comparison at any time.

Aggregated, de-identified information. We may use information that has been aggregated and de-identified, so that it does not identify you, your organization or any individual, to operate, secure, measure and improve the Service. We do not attempt to re-identify such information, and we do not sell it.

7. How we share information

We do not sell personal or financial information, and we do not share it for advertising. We share information only as follows.

Within your organization. Information in your organization’s workspace is visible to other members of that organization according to their roles. Financial figures are visible only to Owners, Admins and people your organization has given Financials access.

With an investment firm your organization chooses. If your organization accepts an invitation from an investment firm in Mirific Portfolio, the firm reads exactly what your organization’s sharing switches allow, as listed beside each switch, and every read is recorded in an access log your organization can see. Your organization can pause or end sharing at any time.

With sub-processors. We use a small number of service providers to operate the Service. They process information only on our instructions and only to provide services to us:

Systems your organization connects (Section 3) are not our sub-processors: your organization chooses them, and its use of them is governed by its agreements with their providers.

We keep this list on this page. If we add a sub-processor that processes customer business or financial information, we will give notice through the Service before the change takes effect.

For legal reasons. We may disclose information if required by law, regulation, legal process, or enforceable governmental request, or where necessary to protect the rights, safety or property of Mirific, our users or the public.

In a business transfer. If Mirific is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this policy’s protections.

8. Security

We treat connection credentials and customer financial data as the most sensitive information we hold:

• encryption in transit for all Service traffic, with strict transport security, and encryption at rest for stored data;
• envelope encryption of connection credentials and two-step sign-in secrets under dedicated key management service keys, with every decryption logged;
• organization isolation enforced by the application: every request is resolved to the signed-in person’s own organization on our servers, never from what a browser sends, and every read and write is scoped to that organization, with automated tests that try to cross organizations and must be refused. All organizations’ data is held in one database, separated by these controls;
• two-step sign-in required for Owners, Admins and Mirific’s own operators, and available to everyone;
• role-based access within each organization, enforced on our servers;
• minimum-scope access to connected systems, as described in Section 3; and
• audit logging of sign-ins, operator access and sensitive actions.

We maintain a security program aligned with recognized industry frameworks. We do not currently hold an independent security certification. No method of transmission or storage is perfectly secure, but we design our systems so the most sensitive data receives the strongest available protection.

9. Retention

We keep your organization’s information for as long as its account is active, except where a shorter period applies:

• meeting transcripts: the period your organization sets, 90 days unless it chooses otherwise;
• Ask Mirific conversations: kept until your organization sets a retention period, then deleted on that schedule;
• words searched in Help: 180 days, with no identity attached;
• accounts that have been disabled: deleted after 90 days.

When an organization deletes its workspace, its content, including synced financial figures and everything derived from it, is deleted from the live database at once. Encrypted backup copies, including snapshots taken before each release, are kept for up to 90 days, so a deleted workspace may remain in a backup for that long before it is gone. Operational logs are kept on a limited schedule. Longer retention applies only where required by law or necessary to resolve disputes or enforce agreements.

You may request earlier deletion of specific information at any time via support@mirific.ai.

10. Your rights and choices

Depending on where you are located, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact support@mirific.ai. We respond within the timeframe required by applicable law, and in any case within 30 days.

An Owner can export the organization’s workspace and delete it from within the Service. Any person can turn two-step sign-in on, and the people your organization allows can disconnect any connected system at any time.

Canada. Canadian users have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation, including the right to access personal information we hold and to challenge its accuracy, and the right to complain to the Office of the Privacy Commissioner of Canada.

Elsewhere. The Service is used by organizations in more than one country. Where the law of the place you are in gives you rights over your personal information, including data protection laws in Nigeria, Ghana and other jurisdictions, contact us at support@mirific.ai and we will respond as that law requires.

11. Where information is processed

Our infrastructure is hosted in the United States, in Amazon Web Services’ US West (Oregon) region, and our model provider and other sub-processors process information in the United States. If you use the Service from outside the United States, your information is transferred to and processed in the United States. We rely on contractual commitments from our sub-processors to protect information transferred in this way. We do not currently offer hosting in another region.

12. Children

The Service is not directed to individuals under the age of majority in their jurisdiction, and we do not knowingly collect their personal information.

13. Changes to this policy

We may update this policy from time to time. Each version carries a version number and an effective date at the top. When we make material changes, we tell the Owners of every organization through the Service before or when the change takes effect. Your continued use of the Service after an update means you accept the revised policy.

14. Contact

Mirific Technologies Inc. 6620 East Boulevard, Vancouver, BC V6P 5R1, Canada Privacy and support: support@mirific.ai