AI customer support and GDPR: trust you can explain.
Mira Omnia is the processor for your customer data. That data is processed and stored in the EU/EEA, in an isolated data area for each customer. We build trust not on broad promises but on limited access, clear stop rules, a documented data flow and your team staying in control.
We'll send you the full documentation whenever you ask.
Security built into the workflow.
The controls cover every enquiry, from access to deletion, and every decision can be traced in the control panel. The specific setup and retention period are agreed with you before going live.
- Customer separation
- Each customer has its own data area, its own knowledge base and its own log files. Data is not shared between customers.
- Limited access
- Mira only gets the permissions needed for the agreed workflow. Your administrator can revoke access.
- EU/EEA
- Processing and storage are limited to the EU/EEA. AI processing is handled by Amazon Web Services (AWS) on servers in the EU. The region may vary depending on load, but it is always within the EU.
- Encryption and minimal logging
- Communication with external services is protected with TLS. Operational logs outside the customer's area must not contain the email body.
- Fixed stop rules
- Angry customers, legal matters, payment disputes, GDPR requests and other agreed topics are handed over to your team. Customer text is treated as data, not as instructions to the system.
- Documented operations
- Decisions can be traced back to category, source and rule, so quality and compliance can be reviewed on an ongoing basis.
- No training on your data
- Your data is not used to train AI models. Mira logs what she can't answer. If the same questions keep coming up, she takes the initiative at the end of the month and asks for the gaps in her knowledge base to be filled.
How data moves through Mira.
The enquiry is received
Mira only gets access through the connection and to the areas the business has approved.
The content is understood
The enquiry is classified according to the business's categories. Certain topics are handed straight to a team member.
Knowledge is retrieved
Mira searches the business's approved sources. If the answer can't be backed up, she doesn't answer at all — not on her own and not as a draft.
The next action is chosen
Mira replies herself or prepares a draft in the existing system — following the business's rules for each category — or hands the enquiry over with the relevant context.
The decision is documented
Category, sources used and the chosen action are recorded in an audit trail in the customer's isolated data area.
Data is deleted as agreed
The retention period is agreed with the customer. Deletion can be carried out across the active data stores and documented.
GDPR in practice: data processing agreement, EU/EEA and deletion.
The customer is the controller, and Mira Omnia acts as the processor on the customer's documented instructions. Before any personal data is processed, a data processing agreement (DPA) is signed, covering the purpose, data types, sub-processors, security measures, retention and deletion. Your data is not used to train AI models.
We assist with data subjects' rights and with documenting deletion. When the contract ends, data is returned or deleted, as the customer chooses and in line with the agreement.
How we process personal data ourselves — on this website, in the chat and in emails to Mira — is described in our privacy policy.
Before Mira goes live
- Purpose, data types and the agreed systems have been described.
- Access and the administrator's ability to revoke it have been tested.
- Sub-processors and the processing location have been documented.
- Retention period, deletion procedure and responsibilities have been agreed.
- Categories, handover rules and approval flow have been reviewed.
- You have a clear basis for ongoing oversight.
Last updated 27 September 2026.
This page describes Mira's technical and organisational baseline. The specific customer agreement and setup always take precedence. This page is not a substitute for legal advice.