Who receives your data: processors and recipients
Live list. Last updated 22 October 2026. Published at mirai.inc/legal/recipients. Page text version 5.3, 22 October 2026.
v5.3 change note: the US-person rule stated plainly; the face-comparison, image-safety and optional video partner rows; no affiliate named (R17). Added 22 October 2026: the AI vision checks, moderation, voice and Meta Pixel rows.
This is the live list that our Privacy Notice (section 6) and the Likeness Licence (clause 12.4 and Part 3, T4) refer to. Mirai Talent Inc. ("Mirai") is responsible for your data and stores it in the United States. Below is everyone else who receives it, what they get and where they process it.
- Processors act only on our written instructions, under contract.
- Generation engines may not train on your data.
- "Face data" in the tables below means your kit references, face data or both.
The US data rule
The face of a US person never goes to an engine, face check or partner developed or run by a company based in, or controlled from, China (including Hong Kong) or another country of concern. More precisely, US users' face data is processed only by engines that meet the US data rule. An engine meets it when no company or person restricted by the US Justice Department's rule on Americans' sensitive data (28 CFR Part 202) can access the data through it, and it keeps nothing after the job. If any signal says you are in the United States or a US territory, if you tell us at sign-up that you are a US citizen or US permanent resident, or if we are unsure, we treat you as a US user. Which engines serve which users can change; this list always shows the current choice.
1. Hosting, storage and database
| Name | Role | Where processed | Face data | Users | Since |
|---|---|---|---|---|---|
| Railway | Cloud hosting and compute | United States | Stores it, encrypted | All | 26 May 2026 |
| Cloudinary | Object storage for kits and media | United States | Stores it, encrypted | All | 7 April 2026 |
| Supabase | Database and queues | United States | Stores it, encrypted | All | 7 April 2026 |
| Cloudinary | Media delivery | United States | Delivers media, encrypted in transit | All | 7 April 2026 |
2. Generation engines
| Name | Developer | Where processed | Feature | Face data | Meets the US data rule | Users | Since |
|---|---|---|---|---|---|---|---|
| GPT Image 2 | OpenAI | United States | Images | References for each job only | Yes | All | 21 August 2026 |
| GPT Image 2.5 | OpenAI | United States | Images | References for each job only | Yes | All | 24 September 2026 |
| Nano Banana 2.1 | United States | Images | References for each job only | Yes | All | 21 August 2026 | |
| Seedream 5.0 Pro Edit | ByteDance | [to be added] | Images | References for each job only | No | Non-US users only | 21 August 2026 |
| FLUX.2 [pro] Edit | Black Forest Labs | [to be added] | Images | References for each job only | Yes | All | 21 August 2026 |
| Seedance 2.5 Reference to Video | ByteDance | [to be added] | Video | References for each job only | No | Non-US users only | 21 August 2026 |
| Kling v3 Pro Image to Video | Kuaishou | [to be added] | Video | References for each job only | No | Non-US users only | 31 August 2026 |
| Kling O3 Pro Reference to Video | Kuaishou | [to be added] | Video | References for each job only | No | Non-US users only | 28 September 2026 |
| Hailuo 3 Max Image to Video | MiniMax | [to be added] | Video | References for each job only | No | Non-US users only | 31 August 2026 |
| fal.ai | Inference host that runs models for us | United States | Hosting engines above | For each job only | Yes | All | 16 April 2026 |
Decentralised compute (0G). 0G decentralised compute network
- Serves non-US users only, for video generation.
- Node regions: [to be added].
- Its data terms: no training on your data; deletion after each job; node regions listed here; a transfer basis for each region. Signed (not yet).
- Until those terms are signed, no face data goes to it.
3. Face match and moderation
| Name | Role | Where processed | Face data | Since |
|---|---|---|---|---|
| Amazon Web Services (Amazon Rekognition) | Cloud face-comparison service for the two required face checks: your selfie, head turn and photos against each other, and outputs against your kit. Never searches across other people | United States | Yes | 18 October 2026 |
| Google Cloud (Cloud Vision SafeSearch) | Image-safety checks against our Community Standards, including whether a face is present. Compares no faces | United States | Content to check | 19 October 2026 |
| Anthropic (Claude) | AI vision and language model: scores how closely content made of you looks like your own kit, checks frames for quality and safety, and reads prompts and reference uploads to help make what you ask. Compares only with your own kit and may not train on your data | United States | Yes | 22 April 2026 |
| Hive (visual moderation) | Checks uploads and every output for unsafe content and child sexual abuse material, including AI-made material. Compares no faces | United States | Content to check | 27 May 2026 |
| Hive (CSAM Detection) | Matches content against known abuse hashes | United States | Hashes only | Not yet in use |
| [to be added] | Round-the-clock first response to urgent reports | [to be added] | Reported content | Not yet in use |
Our optional video partner
| Name | Role | Where processed | Face data | Users | Since |
|---|---|---|---|---|---|
| BytePlus | Our optional video partner: a short live face check, and a face reference it keeps to make video of you for Mirai. Our processor, on our written instructions. For the records the law requires it to keep, it decides for itself, under its own privacy notice | Malaysia | Only if you tick its own box. Deleted within 30 days of withdrawal, of your face sign-up not being approved, or of closing your account | Never US persons or Argentine residents | 18 October 2026 |
Voice, only if you add it
| Name | Role | Where processed | Face data | Since |
|---|---|---|---|---|
| ElevenLabs | Makes your voice for content of you from the voice sample you add with its own consent (Licence 12.3). Gets that sample and the lines to speak | United States | None | 17 July 2026 |
4. The partner model
| Name | Role | Where processed | Face data | Users | Since |
|---|---|---|---|---|---|
| [to be added] | Multimodal model that makes content, checks content and scores competition entries | [to be added] | Only once its data agreement is signed (not yet signed); for US users, only if it meets the US data rule | All | Not yet in use |
5. Payments and payouts
| Name | Role | Where processed | What it gets |
|---|---|---|---|
| A Partner App operator (named on request) | Partner App payments, in USDC (Terms §0.1A) | [to be added] | Purchase details. The operator is a controller under its own notice, not our processor. Payments are recorded on a public blockchain |
| Stripe | One-off card payments on the web | United States | Purchase details. We receive only the card brand and last four digits. Stripe is a controller for its own legal duties and our processor otherwise |
| [to be added] | Payout provider: the tax step, identity and sanctions checks, and payouts | [to be added] | Privacy Notice section 11. It holds tax forms as Mirai's agent |
| A public blockchain (USDC) | USDC payouts on a public blockchain | [to be added] | Wallet address and amount |
| [to be added] | Wallet and sanctions screening | [to be added] | Wallet address |
6. Analytics, email and support
| Name | Role | Where processed | What it gets |
|---|---|---|---|
| Sentry | Product analytics and error reports. Not used for advertising | United States | Device type, app version, feature use, a pseudonymous ID. No face data |
| Meta Platforms (Meta Pixel) | Measuring and showing our ads, on our public marketing pages only, and only if you tap Accept in the cookie notice. Never for visitors in the United States, never where you sign up, sign in, apply, add a face or sign, and never in a Partner App. A separate controller for its own use, under its own privacy policy | United States | The marketing pages you visit, device and browser details and a cookie ID. No face data |
| Resend | Email and push | United States | Contact details and messages |
| [to be added] | Support and appeals | [to be added] | Messages, reports and appeals |
7. Platform Partners
Other apps that show Mirai content under a Partner Agreement. They get your card, price, rules and licence rows, never your kit.
| Partner | Where processed | Named | US: decline open until | Outside the US: Allow needed |
|---|---|---|---|---|
| None at launch | Yes |
8. Training recipients
None. Mirai is not training today.
9. Affiliates
None hold your data. If we name a Mirai affiliate by notice (Terms §1.3), it never receives kits, face data or data about US persons.
10. Others who may receive data
Independent controllers we receive data from. Our identity-verification partner runs the Verified Human Check, and a Partner App operator runs the Partner App you use Mirai in, each under its own privacy notice (Privacy Notice 1.4, 3). They send us the check's result, your verification level, a code unique to you and Mirai, and your Partner App username and picture. We send them only what the check or the payment needs. The current list of these named providers is available on request at legal@mirai.inc.
Buyers of licences, the clients named on their licence records, and social platforms you connect (outputs, licence rows, your posts); insurers, advisers and auditors, under confidentiality; a company that takes over running Mirai (Privacy Notice section 12); and police, courts and child-safety bodies, including NCMEC, where the law requires.
How we announce changes
- A new processor or engine: added here, with 30 days' notice in the app, before it receives your data (Terms Schedule D2). Moving a feature between engines already on this list is not a change (Schedule D2A).
- A new Platform Partner: in the United States, named here and in the app 30 days ahead, with a one-tap decline. Outside the United States, it serves you only after your Allow tap.
- Argentina: any new recipient waits for your Allow tap.
- Training: a recipient gets your data only if it was named when you signed or after your Allow tap on a card naming it, and every run is announced 14 days ahead with a one-tap "Not this one".
- Earlier versions of this list are at mirai.inc/legal/versions.
Questions: legal@mirai.inc.