Storing information — Mirai Apps

What this document covers

This page explains the practical side of handling information: where it is kept, who can see it, how it is protected, and when it is removed. It works alongside the privacy notice, which explains why we hold information in the first place. Where the two documents differ, the privacy notice describes the purpose and this page describes the mechanics.

Where information is held

We are a small company and we keep our systems small on purpose. Information reaches us through two routes, and each has a home:

Messages sent through this website. The contact form does not store your message in a database. It composes an email and hands it to our mail provider, so the message lives in the same mailbox as any other correspondence.
Messages sent to us directly. If you write to our email address or contact us through Discord, the message is held by that service and by us, in the mailbox or account we use to answer it.

Project material — documents, designs, code, and the working notes that go with them — is held in the tools we use to do the work. Access to those tools is given per person, not per company, and is removed when someone stops working with us.

Who can reach it

Access is limited to the people who need it to answer you or to do the work you asked for. In practice that means the developer or salesperson handling your enquiry, and whoever is covering for them when they are away.

We do not give suppliers access to your information beyond what their service requires. A hosting provider can read the files it serves; it is not given a list of customers. An email provider transmits and stores mail; it is not asked to analyse it.

How long each kind of record is kept

Retention is decided by what the record is for, not by a single blanket period. These are the periods we work to:

An enquiry that does not become a project: Kept while the conversation is live, and for up to twenty-four months afterwards in case you return with the same question. After that it is deleted.
An enquiry that becomes a project: Kept for the duration of the work and for the period afterwards that the contract or the law requires. Financial records are usually the longest lived part of this, because accounting rules set a minimum.
Server logs: Rotated on a short cycle and deleted automatically. They exist to keep the site available and to investigate abuse, not to be archived.
Contact form submissions: Not stored by the website at all. Once the message has been handed to the mail provider, it follows the same retention as any other correspondence.
Newsletter or marketing lists: We do not run one, so there is nothing to retain. If that changes, this page will say so before anything is collected.

Backups

Project material and correspondence are backed up so that a mistake or a failed disk does not destroy work you have paid for. Backups are encrypted, held by the same providers that hold the live copy, and kept for a limited window rather than indefinitely.

A deletion request is applied to the live system immediately. Removing a record from a backup takes longer, because backups are sealed and rotated rather than edited in place. In practice a deleted record disappears from backups as the backup window turns over, which is measured in weeks rather than months.

How it is protected

The measures are ordinary and proportionate to a company of our size:

Traffic to this website and to our mail provider is encrypted in transit.
Accounts that can reach project material require a password and, where the tool supports it, a second factor.
Access is granted to named people and reviewed when someone joins or leaves.
Software and dependencies are kept current, because most incidents begin with a known flaw that was never patched.
We keep the number of places information lives deliberately small, so there are fewer doors to lock.

No system is perfect. If we ever discover a breach that affects your information, we will tell you what happened, what we have done, and what we recommend you do, without waiting to be asked.

Deletion

When a retention period ends, or when you ask us to delete something we no longer need, the record is deleted or irreversibly anonymised. Deleting means the record is removed from the live system and from the working copies that people use. It does not mean the text is overwritten on every disk sector; that is not how modern storage works, and claiming otherwise would be misleading.

Some records cannot be deleted on request because the law requires us to keep them. Where that applies, we will tell you which record and which rule, rather than quietly keeping it.

Asking about a record

You can ask what we hold about you, ask for a copy, or ask us to correct or delete it. Write to [email protected] and describe what you are looking for. We may ask for enough information to confirm who you are before we act, which protects you as much as it protects us.

Changes to this page

If we change where information is held, who can reach it, or how long it is kept, this page changes with it. The date at the top is the date of the most recent revision.