DRAFT — 19 October 2026. Factual preparation for the simplified MVP, not a compliance certification or approved final notice.
Identity and responsibilities
MirrorHQ is the trading name of ELPI CONSULTING LIMITED, company number 11850883, registered office 166 Nuns Way, Cambridge, England, CB4 2NS. Website: https://mirrorhq.co.uk. General enquiries: hello@mirrorhq.co.uk. Privacy enquiries: privacy@mirrorhq.co.uk. Mailbox operation requires owner verification.
For customer-entered workforce, visitor and contractor data, the business customer generally determines the purposes and acts as controller; MirrorHQ processes it to provide the service. MirrorHQ generally acts as controller for its own account, support and service-administration information. This allocation must be confirmed in the signed customer agreement and DPA.
Information and purposes
Registration requires administrator name, email, password, company name, company size and main-office text; company contact email is optional and otherwise defaults to the administrator email. Sign-in providers may supply account/identity information. Authentication stores credentials, identities and sessions; the normal company export never includes passwords or tokens.
Employee records include required name, department, job title and base location/default; optional email, team, reporting manager and account link; weekly working patterns; active/deactivated timestamps. Attendance records contain employee, date, one of eight neutral statuses and optional location. Locations require a name, with optional address; departments require a name. These support workforce planning, calendars, reporting relationships and occupancy, not continuous device/geolocation monitoring.
Visitor registration requires name, organisation, planned time/date, duration, host and location; email and operational notes are optional. The database also permits optional phone/contact information. Contractors require organisation, contact name, host, location and assignment dates; phone and operational notes are optional. Check-in/out times and status support workplace hosting and occupancy.
Server-generated new-company trial start/end dates support a 14-day trial countdown and informational expired-trial display. Existing Early Access is separately identified. Any future verified subscription record contains company, payment-event verification reference, paid dates/amount and founding allocation, not card details. Payments and trial enforcement are not active. Account closure requests contain company, requesting administrator, request time, status and review/confirmation fields. Export/closure/retention event records contain company, actor, event type and timestamp, not exported data or free-text reasons. Retention configuration contains proposed periods. Provider security/technical logs may include device, IP or request information; the complete provider inventory is unverified. Support messages are processed if you contact us.
Neutral planning, not health records
The eight statuses are Office, Home, Other Site, Annual Leave, Unavailable, Not Scheduled, Travel and Training. Confidential sickness reasons, medical appointment details and confidential absence notes are not collected through the simplified application. The retired confidential table is retained with no ordinary application-role privileges and currently contains zero records. Privileged operator handling and historical backups are separate. Do not enter medical, health or unnecessary personal details into location, visitor/contractor notes or directory fields. Free text and neutral dates can still reveal or imply sensitive information.
Access and security
Company colleagues can read company employee-directory fields and neutral schedules, not just names/statuses; this includes department, job title, team, manager, work pattern and base location, and stored work email where present. Employees may update their own weekly pattern and attendance. Managers may update assigned employees' neutral attendance, not unrelated employees' attendance; they can view company-visible neutral schedules. HR/company administrators manage workforce records. Visitor and contractor details are restricted to host, creator and HR/company administrators; other members receive anonymous occupancy counts.
Only active company administrators can request company-wide CSV exports, save proposed retention settings or request closure. Exports omit free-text visitor/contractor notes and confidential absence data; directory/attendance/location text may still contain personal information. Administrators must store downloads securely. Cross-company isolation is enforced in database policies and export checks. Deactivation blocks company data access and clears application cached views when detected. Network transport uses HTTPS; no system is risk-free, and cached/downloaded copies outside the application cannot be remotely erased. The narrow event trail is not a comprehensive record of every access or edit.
Lawful basis and recipients — approval required
Each relevant controller must document purpose-specific lawful bases and provide notices to its workers, visitors and contractors. MirrorHQ's own controller purposes/legal bases, any special-category implications and ICO registration status require owner/legal review; none is asserted here. Do not use the tool for health-data collection. No Article 9 condition has been chosen.
Verified: Lovable Cloud supplies the managed database and authentication service; Lovable serves the application, with Cloudflare evidenced by published delivery headers. Configured Google and Microsoft sign-in use external identity providers when selected. The backend connection metadata indicates eu-west-1 (Ireland), but this does not establish every copy, log, support-access location or contractual residency guarantee. Auth emails originate through Cloud Auth; the underlying delivery provider and current sender configuration require confirmation. Application visit/schedule emails are not enabled. Platform-injected traffic/event scripts were observed; their data flows, recipients, retention and controls require assessment. The final subprocessor schedule and international transfer safeguards are NOT verified. Do not assume UK-only or EEA-only access.
Retention, closure and backups
Proposed defaults, subject to legal review: active employee directory for the employment/workspace relationship with controlled review after removal; workforce attendance 12 months; visitors 90 days after the visit; contractors 12 months after assignment end; unused expired invitations 30 days after expiry; application-controlled event records 90 days. Company administrators can save proposed periods. These are NOT active deletion deadlines: automatic deletion is disabled, no deletion schedule is enabled, and existing data is not purged. Actual information remains until an authorised, reviewed process is completed. Legal holds and necessary exceptions must be documented before activation.
Company administrators can prepare CSV exports and record a closure request in Company & members. A request does not revoke access or delete information. An authorised operator must verify authority, review retention/legal holds, obtain a separate explicit confirmation and execute an approved process. Auth accounts, provider logs, backups and copies require separate handling. No guaranteed deletion-completion period is established.
Lovable documents daily database snapshots, retained for up to roughly 14 days, covering database schema and data, not storage files. Point-in-time recovery is not offered: restore uses daily snapshots and reverts the same database in place. Project backup timestamps and restore effectiveness have not been verified. The application cannot selectively erase provider backups or provider-controlled logs. Restoring an earlier snapshot can reintroduce removed records and old access policies; reviewed migrations and any deletion register must be reapplied before service resumes.
Rights and contact
Individuals may have rights of access, correction, erasure, restriction, objection and portability, subject to the applicable law and exceptions. Employees, visitors and contractors should normally contact the business customer/controller first. The customer verifies identity and scope; MirrorHQ assists through privacy@mirrorhq.co.uk. An administrator's company export is not an automatic individual subject-access response and should not be shared wholesale with an individual. Most formal rights requests must be handled within one month, with any permitted extensions explained. ICO complaints can be made at https://ico.org.uk. Final rights procedures and mailbox coverage require approval.
Cookies, storage and analytics
Essential sign-in state uses browser local storage. A short-lived session-storage flag supports recovery from an outdated page. The source includes a reusable sidebar preference-cookie facility, although the active custom sidebar does not use it. Published responses have shown Cloudflare/deployment cookies (__cf_bm and __dpl) and injected /~flock.js and /__l5e/events scripts; presence does not prove exemption from consent. No app-authored advertising analytics was found. Fonts are served locally in the prepared version, and the app's manual forwarding of raw errors to optional telemetry is disabled. Platform-injected scripts are outside this code control and require platform/owner assessment before launch. The applicable PECR exception, consent or objection arrangement must be confirmed; no blanket cookie exemption is asserted.