Privacy policy
Last updated 13 October 2026
Mirai Technologies Pty Ltd ACN 703 187 008 ABN 73 703 187 008, Perth, Western Australia ("Mirai", "we", "us") runs Mirai Flow at flow.mirai.com.au. This policy explains what personal information we collect through Mirai Flow, why, where it goes, and your choices.
Questions or requests: mirai@mirai.com.au · 08 6300 4000 · Unit 5, 10 Geddes Street, Balcatta WA 6021.
1. What we collect
| Information | Why we need it |
|---|---|
| Your name, email address and a scrambled (hashed) form of your password. We can't read your password. | To create your login and let you sign in |
| Workspaces you belong to and your role | To control who can see and change what |
| Your diagrams and their names | This is the service you use |
| Sign-in times, internet (IP) address and browser type | To keep accounts secure and investigate misuse |
| Invitations, password resets and access requests, including the email address and the note you write | To invite people and recover accounts |
| A record of important actions, such as sign-ins, password resets and deleted diagrams | Security and support |
| Copies of the emails Mirai Flow sends you | To show delivery status and support you |
| How much the AI assistant is used: when, by whom, which model and how long. We don't keep the text of AI conversations. | Plan limits and costs |
| Your own AI provider key, if your workspace owner adds one (stored encrypted) | To use the provider your business chose |
We don't sell personal information, use it for advertising, or collect payment card details. When billing starts, card and bank payment details will be handled by our payment provider, Revolut, not by Mirai Flow.
2. Who can see it
- People in your workspace, according to their role. Viewers can see shared diagrams but can't change them. Private diagrams are visible only to the person who made them and the workspace owners and admins.
- Other businesses can't see your workspace. We test this regularly.
- Mirai staff who run the platform can see workspace names, member names and email addresses, roles, usage and activity records. They can help with your account.
- Support access. With your request, or when urgently needed to protect the service or your data, a Mirai operator can temporarily see Flow exactly as you do. It ends automatically within 60 minutes, is recorded, and we'll tell your workspace owner afterwards.
3. Where it is stored
- Mirai Flow runs on Mirai's own servers in Perth, Western Australia.
- Backups are kept on a separate Mirai backup server in Perth and copied daily to a second Mirai site in Perth.
Some information leaves Australia in two cases:
| Service | What it receives | Where |
|---|---|---|
| Fastmail (sends Mirai Flow emails) | Recipient address and email content | United States (Fastmail is an Australian company; its mail servers are in the United States) |
| xAI (the AI assistant's default provider) | When someone uses the assistant: the diagram's name and contents, selected shapes and the chat messages | United States |
The AI assistant is part of every plan and only sends information when someone in your workspace uses it. If you don't want diagram content to leave Australia, don't use the assistant, or ask your workspace owner to set your business's own AI provider.
4. How we protect it
- Passwords are hashed, sign-in sessions expire, and password-reset links work once and expire after 2 hours.
- Each business's workspace is separated from every other business's.
- Staff actions in the admin console are recorded.
- Two independent monitors check the service every 5 minutes and alert Mirai staff to problems.
- Backups are tested by restoring them, including at the off-site location.
- Servers and backups are Mirai-owned, in Mirai-controlled locations, with access limited to Mirai's platform staff.
5. How long we keep it
- Your workspace: kept while you're a customer. After you cancel, it's read-only for 30 days so you can export your diagrams, then deleted from the live service.
- Backups: deleted data disappears from all backups within 90 days.
- Security and activity records: 12 months.
- Email copies, invitation and password-reset records: 90 days.
- Unconverted access requests: 12 months.
- Invoices and billing records: 5 years, as Australian tax law requires.
6. Your choices and rights
- Access and correction: you can see and change your diagrams at any time. To ask for the personal information we hold about you, or to correct it, email us. We'll reply within 30 days.
- Export: workspace members can download diagrams as JSON, Mermaid, text or image files at any time.
- Deletion: your workspace owner can delete diagrams. To close a workspace or delete your login, email us.
- Complaints: contact us first. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
7. Data breaches
If a breach is likely to cause serious harm, we'll tell affected customers and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
8. Changes
We'll post updates here and email workspace owners about important changes.