ATRA
Privacy policy
Last updated 25 September 2026 · applies to the Atra app, the web planning desk, and this website
1. Who is responsible (controller)
MiraiTech, established in Belgium, is the data controller for all processing described here. Contact for anything privacy-related: info@miraitech.be. We will confirm requests within 72 hours and answer within 30 days as the GDPR requires.
2. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email, display name, credentials | Creating and securing your account (authentication runs on Supabase) | Contract, Art. 6(1)(b) |
| Swipes, saves, trip edits (your “travel DNA”) | Personalising recommendations and itineraries, the core of the service you sign up for | Contract, Art. 6(1)(b) |
| Trips, bookmarks, imported links, notes | Building and displaying your itineraries; sharing them when you choose to | Contract, Art. 6(1)(b) |
| Early-access email (this website’s form) | Inviting you to Atra, in order of signup | Consent: Art. 6(1)(a), withdraw any time |
| Technical logs (IP, timestamps, errors) | Keeping the service secure and working | Legitimate interest, Art. 6(1)(f) |
| Product analytics (screens opened, actions taken, error reports; a random account id, never your email) | Understanding which features work and fixing crashes | Web app: consent, Art. 6(1)(a), withdraw any time. iPhone app: legitimate interest, Art. 6(1)(f), switch off in Settings. |
| Payment status (when paid plans launch) | Billing, invoices, tax records | Contract + legal obligation, Art. 6(1)(b)/(c) |
3. Profiling, in plain terms
Atra builds a taste profile from your swipes (128 dimensions across vibe, pace, food, light, stays and company). It is used for one thing: choosing which places and plans to show you. It is private by default, blends with your crew’s only inside trips you plan together, and produces no decisions with legal or similarly significant effects (GDPR Art. 22). It is never used for advertising and never sold.
4. Cookies and trackers
This website sets no cookies and runs no analytics. The Atra app and web app use the storage needed to keep you signed in and, to understand how Atra is used and to fix errors, product analytics by PostHog on servers in the EU. Analytics record which screens you open and what you do in Atra, with a random account identifier, never your email address. In the web app analytics start only after you agree; in the iPhone app you can switch them off at any time in Settings. Nothing is used for advertising and nothing follows you across other sites or apps.
5. Who touches the data (processors)
We use a small set of processors, each bound by a data-processing agreement: Supabase (sign-in and database), Railway (API hosting), Cloudflare (media storage and delivery), Netlify (our websites and the signup form), Google (AI processing for itinerary text and place details, and Google Maps place data), PostHog (product analytics and error reports, EU hosting), Mapbox (maps), Serper (web search for facts about places), Bright Data (fetching public web pages you ask Atra to save), Sentry (server error reports), Nuitee / liteAPI (hotel search and, once booking is available, your booking; you enter your card directly with them) and Travelpayouts (links to flight partners). We share data with no one else, and never for their own purposes.
6. International transfers
Some providers process data in the United States. Transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses, with the data minimised to what the provider needs to do its job.
7. How long we keep things
- Account and trip data: until you delete your account (self-service in Settings); backups roll off within 30 days.
- Early-access emails: until you receive your invite or withdraw, and at most 12 months after signup.
- Security logs: up to 90 days.
- Product analytics: up to 12 months.
- Billing records: as long as Belgian tax law requires.
8. Your rights
Under the GDPR you can, at any time and free of charge:
- Access a copy of your data (Settings → export, or ask us);
- Rectify anything inaccurate;
- Erase everything (“right to be forgotten”): account deletion is self-service;
- Restrict or object to processing based on legitimate interest;
- Take your data with you (portability, machine-readable);
- Withdraw consent (e.g. the early-access list) without affecting past processing.
Write to info@miraitech.be. If you are not satisfied, you can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données) or with the supervisory authority of your own EU country.
9. Age
Atra is for people aged 16 and up. We do not knowingly process data of anyone younger; if that happens, we delete it.
10. Changes
If this policy changes in a way that matters, we tell you in the app or by email before it takes effect, never silently.