← Regulatory register

Jurisdiction · European Union

GDPR · Article 9 special-category processing.

Where a person's likeness is processed as biometric data used for unique identification, it is special-category personal data under GDPR Article 9. Mirai obtains explicit consent as a heightened safeguard and relies on an applicable Article 9 condition where the processing falls within it. Mirai's role depends on the activity — generally controller for the registry, consent, approvals, licensing and payouts, and processor where it handles a brand's data on documented instructions.

In force — Last reviewed · 15 July 2026

What it requires

  1. 01Article 9(1): Default prohibition on processing special-category personal data, including biometrics used for unique identification.
  2. 02Article 9(2)(a): Lawful processing requires explicit, freely given, specific, informed, unambiguous consent.
  3. 03Article 13: Transparency — data subjects must be told the lawful basis, the purposes, the recipients, retention period, and their rights.
  4. 04Article 17: Right to erasure — the data subject can withdraw consent and demand deletion at any time.
  5. 05Article 28: Where Mirai acts as processor on behalf of a brand, a written Data Processing Agreement is required.
  6. 06Penalties up to €20M or 4% of global annual turnover for breaches of Article 9.

How Mirai complies

  1. 01Mirai obtains explicit consent for likeness processing as a heightened safeguard, captured at sign-up via a separate, ticked-box consent screen with a plain-language description of every processing purpose. Where the technical processing constitutes biometric data used for unique identification under applicable law, Mirai relies on an applicable Article 9 condition, including explicit consent where appropriate.
  2. 02Models can withdraw consent at any time by written request to legal@miraitalent.ai. We commit to deleting your AI likeness, your recordings, and the underlying photos within 30 days — today each request is processed manually by our team; self-serve erasure from the dashboard is in progress. Earnings already accrued remain payable; deletion does not affect contractual rights.
  3. 03Mirai's role depends on the processing activity. Mirai generally acts as controller for talent onboarding, roster administration, consent, approvals, licensing, safety and payouts. Where Mirai processes customer data solely on a brand's documented instructions, the applicable order form or DPA identifies the relevant processor obligations. A standard, signable DPA for brands is in progress; until it ships, processing terms are governed by our Terms of Service.
  4. 04Our sub-processors: FAL.ai (image generation), Cloudinary (image storage and delivery), Supabase (database and authentication), Stripe (payments), Anthropic and Google Gemini (auxiliary AI for prompt and reference processing).
  5. 05We rely on EU Standard Contractual Clauses for any necessary international transfers to our sub-processors.
  6. 06A DPIA (Data Protection Impact Assessment) for the registry processing activity is in progress — it has not been completed yet. Enterprise customers can request its current status under NDA.

The full subprocessor register, with roles and regions, is published in the trust center.

What this means for brands

Where Mirai processes biometric data on your behalf, our Terms of Service govern the relationship today; a standard signable DPA is in progress. You remain the data controller for any uses you make of the resulting imagery in your own marketing — Mirai cannot indemnify you against your downstream advertising obligations, but the upstream consent chain is in order.

For the current status of the DPA and DPIA programme, email info@miraitalent.ai.