El Mirador

Privacy Policy

Last updated: 26 September 2026

1. At a glance

This policy explains what personal data we process when you visit this website, create an account, buy a license, or when the El Mirador software verifies its license. We process data in line with the EU General Data Protection Regulation (GDPR) and applicable national data protection law. We don't use advertising or analytics trackers.

2. Controller

[Company legal name]
[Street and number], [Postal code] [City], [Country]
Email: privacy@mirador.app

3. Data we process

Website visits

When you visit the site, our hosting provider automatically processes technical data such as your IP address, browser type, requested page and time of access in server logs. This is needed to deliver the website and keep it secure (Art. 6(1)(f) GDPR). Logs are deleted after at most 30 days unless needed to investigate an incident.

Account

When you register we store your email address, a hashed password (we never see your password in plain text), optional name, the date you joined and the time you accepted these terms and this policy. We send you transactional emails, such as the account confirmation link and password reset links. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Licenses and activation

For each license we store the key, plan, status and validity period. When the El Mirador software verifies a license it sends the license key and a machine identifier, and we record the bound machine identifier and the time of the last check. We use this to deliver the license, bind it to one machine and prevent misuse (Art. 6(1)(b) and (f) GDPR).

Payments

Paid plans are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland ("Stripe"). You enter your payment details directly on Stripe's checkout page; we do not receive or store your full card details. We store the Stripe customer, checkout and subscription identifiers to link payments to your licenses. Stripe may transfer data to Stripe, Inc. in the USA. See Stripe's privacy policy. Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for statutory accounting obligations.

Contacting us

If you email us or use the contact form, we process your message, your contact details and any files you attach to answer your request (Art. 6(1)(b) or (f) GDPR).

4. Cookies

We only use cookies that are strictly necessary for the site to work, so no consent is required:

  • mirador_access, mirador_refresh - keep you logged in (up to 14 days).
  • mirador_pending_plan - remembers the plan you chose while you confirm your email (up to 3 days).

Stripe sets its own cookies on its checkout pages to process payments and prevent fraud.

5. Recipients and processors

We share data only as needed with the following service providers, bound by data processing agreements:

  • Hosting: [Hosting provider, country]
  • Email delivery: [Email delivery provider, country]
  • Payments: Stripe (see above)

We do not sell your data.

6. International transfers

Where data is transferred to countries without an adequate level of data protection (such as the USA), we rely on the EU Standard Contractual Clauses or, where available, the provider's certification under the EU-US Data Privacy Framework.

7. Retention

  • Account and license data: for as long as your account exists. After deletion, data is removed unless we must keep it by law.
  • Invoices and payment records: for the statutory retention period for accounting records (typically 10 years).
  • Unconfirmed accounts may be deleted after 30 days.

8. Your rights

You have the right to:

  • access the personal data we hold about you (Art. 15 GDPR);
  • have inaccurate data corrected (Art. 16);
  • have your data erased (Art. 17) or its processing restricted (Art. 18);
  • receive your data in a portable format (Art. 20);
  • object to processing based on legitimate interests (Art. 21);
  • lodge a complaint with a data protection supervisory authority.

To exercise these rights, email privacy@mirador.app.

9. Security

The site is served over encrypted HTTPS connections. Passwords are stored only as salted hashes. Access to personal data is limited to people who need it to run the service.

10. Changes

We may update this policy when our services or the law change. The current version is always available on this page.