Effective Date: February 2026
At MIXR ("we", "us", or "our"), your privacy is our priority. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you use our website, applications, AR features, and related services (collectively, the "Services"). If you do not agree with this policy, please do not access or use the Services.
When you create an account, we collect: full name, email address, job title, company name, phone number, profile photo (optional), username, category of use, and timezone. If you use Google OAuth, Google provides your name and email address to us.
When you build a digital card or microsite, we store the content you input: text, images, videos, 3D model files, links, VCF contact card data, experience configuration settings, passwords for password-protected experiences (stored in plaintext — see Security section), NFT metadata (token IDs, transaction hashes, blockchain network), and contact form field configuration.
When you use Card Scanning, we receive the image you capture and transmit it to third-party AI services as described in Section 2.
When any person visits a public microsite or digital card page (a "Visitor"), we automatically collect and store in our database, without requiring authentication or consent:
This data is written directly to our database in an unauthenticated operation. No persistent tracking cookie is set; uniqueness tracking uses the Visitor's browser localStorage.
If a User has enabled a contact form on their microsite, Visitors who submit it provide: name, email address, phone number (optional), company (optional), job title (optional), and notes (optional). This data is:
Visitors submitting a contact form are not MIXR Studios customers. MIXR Studios processes this data as a processor on behalf of the card owner (the controller). See Section 7.
When you use the Studio dashboard, we collect standard server logs via Firebase and our hosting infrastructure, including IP addresses, browser type, pages visited, and timestamps. Firebase Auth uses HttpOnly session cookies for authentication.
We use OpenRouter, Inc. (openrouter.ai) as an API intermediary to access AI model capabilities. When you use Card Scanning:
The image (which may include the personal information of a third party) is processed by OpenRouter and Google per their respective privacy policies. We do not use images submitted through Card Scanning to train our own models.
We share data with the following third parties as necessary to operate the Service:
| Provider | Purpose | Data Shared |
|---|---|---|
| Google LLC (Firebase) | Database, authentication, file storage | All user and visitor data |
| OpenRouter, Inc. | AI API routing for Card Scanning | Card images (base64 JPEG) |
| Google LLC (Gemini) | AI model for Card Scanning | Card images via OpenRouter |
| Zappar Limited | AR experience delivery | Experience config, asset URLs, card owner contact info encoded in AR payload |
| ipapi.co | Country geolocation for analytics | Visitor IP addresses |
| QuickChart.io | QR code generation | QR code content strings (your microsite URL) |
| Gmail SMTP (Google) | Transactional email delivery | Recipient email, name, card links |
We do not sell personal data to third parties for advertising purposes.
We may also share data in connection with a merger, acquisition, or sale of company assets, and when legally required (e.g., court order, subpoena, legal process).
If you are located in the European Economic Area, United Kingdom, or Switzerland, we rely on the following lawful bases under GDPR Article 6:
| Processing Activity | Lawful Basis |
|---|---|
| Creating and managing your registered account | Contract (Art. 6(1)(b)) |
| Sending welcome and account communications | Contract (Art. 6(1)(b)) |
| Analytics tracking of Visitors to public microsites | Legitimate interests (Art. 6(1)(f)) — providing card owners with engagement metrics. Visitors may object by contacting privacy@mixrstudios.com. |
| Storing CRM contact data you add | Contract (Art. 6(1)(b)) — stored as your processor to operate the CRM feature |
| Card Scanning (transmitting images to AI APIs) | Legitimate interests (Art. 6(1)(f)) — the User is responsible for obtaining any required consent from the scanned party |
| Sending Visitor confirmation emails | Legitimate interests (Art. 6(1)(f)) — transactional communications following Visitor's own form submission |
| Fraud prevention and security | Legitimate interests (Art. 6(1)(f)) |
Any User Content you explicitly add to your published MIXR Site will be publicly accessible to anyone on the internet who possesses your unique URL or scans your custom QR code. This includes search engines, which may index your public MIXR profile. Please do not place sensitive, highly confidential, or privately identifiable information on your public profile that you do not wish to share publicly.
If you are a Visitor who accessed a MIXR microsite and wish to exercise any rights, contact us at privacy@mixrstudios.com or use our Data Request Form.
MIXR Studios does not serve a cookie consent banner. The following storage mechanisms are in use:
mixr_view_{experienceId}_{date} to the Visitor's browser localStorage to determine whether a view should be counted as "unique" for that day. This data is not transmitted to MIXR Studios servers.We do not use third-party advertising cookies. Zappar's iframe may use cookies governed by Zappar's own cookie policy.
We implement reasonable technical and organizational measures to protect your data, including Firebase security rules, HTTPS for all data in transit, rate limiting on public API endpoints, constant-time password comparison for experience access passwords, and allowlisted domains for asset proxying.
Passwords for password-protected experiences are stored in plaintext in our database. Do not use a password for a protected experience that you use for any other service.
No internet transmission or electronic storage is 100% secure. We cannot guarantee that hackers or unauthorized third parties will not be able to defeat our security measures.
Data Breach Notification: In the event of a breach likely to result in a risk to your rights and freedoms, MIXR Studios will notify affected Users within 72 hours of becoming aware of the breach. If you are in the EU/EEA, we will report qualifying breaches to the relevant supervisory authority. Notification will be sent to the email address associated with your account.
Depending on your location, you may have the following rights regarding your personal data:
To exercise any of these rights, contact us at privacy@mixrstudios.com or use our Data Request Form. We will respond within 30 days (GDPR) or 45 days (CCPA). We will not charge a fee for your first request per 12-month period.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), as described in Section 12 above.
To submit a verifiable consumer request, email privacy@mixrstudios.com or use our Data Request Form. We will respond within 45 days.
California residents may also submit a Do Not Sell or Share My Personal Information request at any time.
MIXR Studios is headquartered in the United States. Your information may be transferred to, stored, and processed in the U.S. or other countries where our servers or service providers are located. When we transfer data originating from the EEA, UK, or Switzerland, we utilize standard contractual clauses or other legally approved transfer mechanisms.
Our Services are not directed to children under the age of 13 (or under 16 in certain jurisdictions). We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information without your consent, contact us immediately. If we become aware that we have collected such information, we will take steps to securely delete it.
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page, updating the "Effective Date," and (where applicable) sending a notification to the email address associated with your account.
If you have questions, comments, or concerns about this Privacy Policy or our data practices, or wish to exercise your privacy rights, contact us at:
MIXR Studios, LLC, 1143 Vine St., Los Angeles, CA 90038
Or use our Data Request Form for structured requests (access, deletion, correction, opt-out).