Privacy policy

Last updated: June 10, 2026 - GDPR (EU) 2016/679 - Spanish Organic Law 3/2018.

White Mirror Lab processes personal data in accordance with the GDPR and applicable Spanish data protection law. If you have questions, contact support@whitemirrorlab.com before providing data.

1. Controller

• Controller: White Mirror Lab
• Email: support@whitemirrorlab.com
• Location: Spain, European Union
• Website: whitemirrorlab.com

2. Purposes, legal bases and retention

2.1. Waiting list and newsletter

• Data: email address, subscription date and source.
• Purpose: send informational communications about White Mirror Lab and its experiments.
• Legal basis: consent. You may withdraw it at any time.
• Processor: Brevo.

2.2. WML 1.0 account and participation

• Registration data: email, encrypted password, username, display name, age, country and preferred language.
• Participation data: voluntarily published photos, stories and text pulses, votes cast internally, votes received, karma score, consent version, account creation date and activity.
• Purposes: manage access, calculate karma and rankings, secure the platform, moderate abuse, analyze aggregated behavior and comply with legal duties.
• Legal bases: explicit informed consent, performance of the participation agreement, legitimate interest for security and legal compliance where required.
• Retention: active account data is kept during the experiment; post-experiment data is kept for up to 90 days unless deletion is requested earlier; security logs may be kept for up to 12 months; published results are anonymized or pseudonymized.

2.3. Product analytics

PostHog may process page views and interaction events only according to the user's analytics consent. Analytics are used to improve the experiment and publish aggregated results. White Mirror Lab does not sell, rent or transfer personal data to third parties for commercial purposes.

3. Recipients and international transfers

We use processors such as Supabase, PostHog, Brevo and Vercel. Where data is transferred outside the European Economic Area, appropriate safeguards such as Standard Contractual Clauses or EU-hosted services are used.

4. Your rights

You may exercise access, rectification, deletion, restriction, portability, objection, withdrawal of consent and rights relating to automated decisions by emailing support@whitemirrorlab.com. We will answer within one month, extendable where legally permitted.

You may lodge a complaint with the Spanish Data Protection Agency at www.aepd.es.

5. Minors and safety

WML 1.0 is restricted to adults aged 18 or older. We apply technical and organizational security measures including TLS, secure password handling, row-level security and restricted production access.

6. Cookies

For detailed information, read the Cookie Policy.