GDPR · Article 9 special-category processing.

What it requires

1. 01Article 9(1): Default prohibition on processing special-category personal data, including biometrics used for unique identification.
2. 02Article 9 requires an applicable exception for special-category processing. Explicit consent is one such condition, not the only one; an Article 6 lawful basis is also needed.
3. 03Article 13: Transparency, data subjects must be told the lawful basis, the purposes, the recipients, retention period, and their rights.
4. 04Article 17 provides a right to erasure in specified circumstances, subject to exceptions such as legal obligations and the establishment or defence of legal claims.
5. 05Article 28: Where Mirai acts as processor on behalf of a brand, a written Data Processing Agreement is required.
6. 06Penalties up to €20M or 4% of global annual turnover for breaches of Article 9.

Current implementation and gaps

1. 01Mirai obtains explicit consent for likeness processing as a heightened safeguard, captured at sign-up via a separate, ticked-box consent screen with a plain-language description of every processing purpose. Where the technical processing constitutes biometric data used for unique identification under applicable law, Mirai relies on an applicable Article 9 condition, including explicit consent where appropriate.
2. 02Models can withdraw consent at any time by written request to legal@mirai.inc. We commit to deleting your AI likeness, your recordings, and the underlying photos within 30 days, today each request is processed manually by our team; self-serve erasure from the dashboard is in progress. Earnings already accrued remain payable; deletion does not affect contractual rights.
3. 03Mirai's role depends on the activity: generally controller for talent onboarding, roster administration, consent, licensing, safety and payouts, and processor where it handles data solely on a customer's documented instructions. A DPA template is available. The parties must complete its processing schedule and execute appropriate terms before a processor engagement begins; ordinary platform terms do not replace this requirement.
4. 04Our sub-processors: FAL.ai (image generation), OpenAI (reference selection and image generation), Cloudinary (image storage and delivery), Supabase (database and authentication), Stripe (payments), Anthropic and Google Gemini (auxiliary AI for prompt and brand-reference processing).
5. 05International transfers require an appropriate legal mechanism and assessment where applicable. Request the relevant vendor and transfer documentation for your workflow; this page does not certify that every vendor agreement or transfer assessment has been completed.
6. 06A DPIA (Data Protection Impact Assessment) for the registry processing activity is in progress, it has not been completed yet. Enterprise customers can request its current status under NDA.

The standard DPA is not yet operative. Check its current status on the Data Processing Addendum status page.

What this means for brands

Identify each party's role and the data involved before work begins. Where Mirai acts as processor, agree the applicable processing instructions, security measures, retention and transfer terms. A public policy or a signed likeness release alone is not a completed data-protection assessment.

Source: GDPR, Articles 6, 9, 17 and 28

For the current status of the DPA and DPIA program, email info@mirai.inc.