Privacy Policy

Section 1: Introduction and Key Definitions

1.1 Our Commitment to Your Privacy

Welcome to DA592 LTD, trading as Masheev. Our mission is to provide best-in-class Software-as-a-Service solutions while upholding the highest standards of data privacy and security. We believe that trust is the foundation of our relationship with our users, Customers, and the global community. To earn and maintain that trust, we are committed to being transparent about how we collect, use, and protect your information.

This Privacy Policy ("Policy") explains our practices concerning the personal data we process. It is designed to be comprehensive, robust, and written in clear, accessible language to help you understand your rights and our responsibilities. We encourage you to read this Policy in full to ensure you are fully informed.

1.2 Applicability of This Policy

This Policy applies to all individuals who interact with our Services. This includes:

• Website Visitors: Individuals who browse our websites or interact with our online content.
• Marketing Recipients: Individuals who receive marketing communications from us.
• Customers: Business entities that have entered into an agreement with us to use our Services.
• Users: Individuals, including employees or agents of our Customers, who are authorized to access and use our Services.
• Prospects and Website Chat Users: Individuals who contact us, book a demo, or chat with the AI assistant on our website.
• End-Users: Individuals who communicate with our Customers through the Services (for example by web chat, phone, SMS, email or messaging apps). Our Customer decides how their data is used and is responsible for telling them about it. We use a small amount of End-User data for our own purposes, described in Section 3.4.

This Policy governs the processing of Personal Data across all our platforms and services. Our Customers are responsible for their own privacy policies governing the collection and use of data belonging to their End-Users.

1.3 Key Definitions

To ensure clarity and transparency, we have defined the key terms used throughout this Policy. Understanding these terms is essential to understanding your rights and our obligations.

Section 2: Privacy at a Glance (A Plain-Language Summary)

In line with our commitment to transparency, this section provides a high-level summary of our privacy practices. This is a "layered approach" recommended by data protection authorities to help you quickly understand the most important points. For complete details, please read the full Policy.

• What data do we collect? We collect information you provide to us directly, such as your name and email when you sign up for an account or contact us. We also automatically collect technical and behavioral data when you use our Services, like your IP address and which features you interact with. In some cases, our business Customers provide us with data about their users to set up accounts.
• Why do we use your data? Our primary purpose is to provide, maintain, and improve our Services. We also use your data to communicate with you, ensure the security of our platform, prevent fraud, and comply with legal obligations. We may also send you information about our own products where the law allows, and you can opt out at any time. We do not use advertising cookies or show you targeted advertising.
• Who do we share your data with? We do not sell your Personal Data for monetary gain. We use service providers to host and secure the Services, process payments, deliver communications, and provide features that you or your organization enables. You can see our current provider inventory in Section 8 and on our Sub-Processor List.
• What are your key privacy rights? You have fundamental rights over your data, including the right to access, correct, or request the deletion of your Personal Data. Depending on your location, you have additional rights. For example, residents of the UK have the right to object to certain types of processing, and we honor equivalent requests from residents of US states. You can learn more and exercise your rights in Section 12.
• How can you control your data? We provide you with tools to manage your data. You can update your account information directly within our Services. For cookies and similar storage, see Section 7.
• How can you contact us? For any privacy-related questions or to exercise your rights, please see our "Contact Us" section (Section 16) for our dedicated contact information.

Section 3: The Roles We Play: Controller and Processor

In the context of data protection law, particularly the UK General Data Protection Regulation (UK GDPR), it is crucial to understand the different roles a company can play. As a B2B and B2B2C SaaS provider, our role changes depending on the context of the data processing. This section clarifies our responsibilities in each role to provide full transparency to our Customers and their Users.

3.1 When We Act as a Data Controller

The Company acts as a Data Controller when we determine the "purposes and means" of processing Personal Data. This means we make the decisions about why and how the data is processed. We are the Data Controller for the following categories of data :

• Customer Account and Administrative Data: Information we collect to manage our relationship with our Customers, including contact details, billing information, and communication records of their administrative staff.
• Website and Marketing Data: Information collected from visitors to our website (e.g., via cookies and contact forms) and data used for our own marketing and sales activities, such as lead generation and promotional communications.
• Our Own Employee Data: Personal Data related to our own employees and contractors.

In all these cases, we are directly responsible for ensuring that the processing complies with applicable data protection laws, including having a valid lawful basis for processing and upholding your data subject rights.

3.2 When We Act as a Data Processor

The Company acts as a Data Processor when we process Personal Data on behalf of our Customers in the course of providing our Services. When a Customer subscribes to our Services, they upload and manage data related to their own business, employees, and End-Users. This data is referred to as "Customer Data".

In this capacity:

• Our Customer is the Data Controller: The Customer determines the purposes and means of processing the Customer Data they input into our Services. They are responsible for the legality, accuracy, and quality of this data, and for ensuring they have a lawful basis for its collection and processing.
• We Process on Instruction: We only process Customer Data in accordance with the documented instructions of our Customer. These instructions are primarily outlined in the contractual agreement between us and the Customer, including our Data Processing Addendum (DPA), available at masheev.com/legal/dpa.
• End-User Relationship: If you are an End-User of one of our Customers (for example, an employee of a company that uses our Services), your primary data protection relationship is with that Customer. Any requests to exercise your data rights regarding Customer Data should be directed to the Customer (the Data Controller). If we receive such a request directly, we will forward it to the relevant Customer to handle.

3.3 A Note on Sensitive Personal Data

Our Services are not designed for the intentional collection or processing of Sensitive Personal Data (as defined in Section 1.3) for our own purposes. However, we recognize that our Customers may use the Services to process data that they deem sensitive.

In such instances, the Customer remains the Data Controller and is solely responsible for complying with any additional legal obligations associated with processing Sensitive Personal Data, such as obtaining explicit consent from the data subjects. We act strictly as a Data Processor, processing such data only upon the Customer's instruction and protecting it with the robust security measures detailed in Section 11. Customers must not intentionally submit special categories of data, criminal-offence data, or similarly sensitive information except as allowed by Section 4.2 of our Data Processing Addendum (which permits limited health information needed to book or route an appointment) or by our express written agreement, and with an appropriate legal basis. We do not sign HIPAA Business Associate Agreements, and the Services must not be used for protected health information. A customer’s legal basis alone does not authorize a restricted use of the Services.

3.4 Limited Processing of End-User Data for Our Own Purposes

Although we process End-User communications as a Processor, we act as a Controller for a small set of our own purposes:

• Security and abuse prevention: we use technical data such as IP address, device and browser signals, request timing and security-check results (including Cloudflare Turnstile) to protect the Services, prevent spam and fraud, and enforce rate limits. Our lawful basis is legitimate interests, and where the processing is to detect or prevent crime, the recognised legitimate interest in Annex 1 of the UK GDPR.
• Service metering and billing: we count usage (such as conversations, messages and call minutes) to bill our Customer. These records identify the Customer and the conversation, not the content.
• Service statistics: we create aggregated statistics about how the Services perform. We do not use the content of End-User communications to build profiles of End-Users or to train our own AI models.

Questions about this processing can be sent to privacy@masheev.com.

This clear delineation of roles is a cornerstone of our privacy program. It ensures that responsibilities are correctly assigned, protecting both our Company and our Customers, and providing clarity for all Users.

Section 4: The Personal Data We Collect and Its Sources

To fulfill our transparency obligations under laws like UK GDPR and the CCPA/CPRA, this section provides a detailed account of the categories of Personal Data we collect and the various sources from which we obtain it. We are committed to the principle of data minimization, meaning we only collect data that is necessary for specified purposes.

4.1 Information You Provide Directly to Us

This is Personal Data that you actively and voluntarily provide when you interact with our Services.

• Account and Profile Information: When you register for an account, subscribe to our Services, or create a user profile, we collect identifiers and professional information such as your full name, email address, phone number, password, company name, and job title.
• Workspace Setup Information: When you create a workspace, you give us your business website (or, if you do not have one, your business name, city and type), the business details you confirm or edit, your country and, optionally, your role. When you accept our terms or confirm statements about how you will use the Services, we record what you accepted, the document versions, the time, your IP address and your browser's user agent, as evidence of that acceptance.
• Payment Information: When you purchase a paid subscription, you must provide payment and billing information. This may include your billing address and payment method details. To ensure maximum security, we do not store your full credit card number or other sensitive payment credentials ourselves. Instead, this information is sent directly to our third-party payment processors (e.g., Stripe) who are compliant with the Payment Card Industry Data Security Standard (PCI DSS).
• Communications and Support Information: If you contact us for customer support, participate in a survey, register for an event, or otherwise communicate with us, we will collect the information contained in those communications. This can include your contact information, the content of your messages, and any files you choose to share with us.
• Website Chat and Demo Requests: If you chat with the AI assistant on our website or ask for a demo, we collect what you type or say, any contact details you give us, and technical data about the session. Your messages are processed by our AI providers (see Section 6) to generate replies, and a member of our team may read the conversation to follow up.

4.2 Information We Collect Automatically

When you access or use our Services, we automatically collect certain technical and behavioral information about your device and your interaction with our platform.

• Device and Usage Data: We collect information about the features you use, the pages you visit, the links you click, and the duration and frequency of your activities within the Services. We also collect data about the device and network you use, including your IP address, browser type and settings, operating system, device identifiers, and referring URLs. This information is crucial for providing, improving, and securing our Services.
• Approximate Location Data: We automatically detect your approximate country based on your IP address (using our infrastructure provider's standard geolocation headers) to help our support team provide regionally appropriate assistance, such as timezone-aware responses and language support. Only the country code is stored (e.g., "GB", "US"): we do not collect or store precise geolocation, city-level, or coordinate-based location data. This country-level data is retained with your contact information and can be requested, corrected, or deleted upon request.
• Log Data: Like most websites and technology services, our servers automatically record information in log files. This log data may include your IP address, system configuration information, the date and time of your request, and information about any errors or crashes that occur ("Crash Reports"). We use this data for security analysis, system administration, and to improve service stability.
• Cookies and Similar Storage: We use a small number of cookies and browser storage items to keep our websites and the Services secure, keep you signed in, run the chat, and remember choices you make. We do not use advertising cookies or tracking pixels. On app.masheev.com we count page views with a cookieless measurement service, and in our apps we monitor errors and performance. See Section 7 for details and your choices.

4.3 Information We Receive From Other Sources

We may also obtain Personal Data from third parties and other sources.

• Our Customers (in a B2B context): Our business Customers may provide us with Personal Data about their authorized users (e.g., their employees' names and email addresses) in order to create accounts and grant them access to the Services.
• Third-Party Integrations: If you choose to connect a third-party service or application to our Services, we may receive Personal Data from that service. We will only connect with such services at your direction.
• Public Company Registers: When a Customer sets up an organization, we may look up its company record at Companies House. This can include the names and roles of company directors and officers. We use it only to prefill and check business details during onboarding. If you are a director and want to know more, contact privacy@masheev.com.
• Public Business Directories and Map Listings: When you create a workspace, we look up public information about the business, such as its name, address, phone number, opening hours, ratings and directory listings, so we can prefill your business details and check that the business is genuine. We send our business-data enrichment provider, Treg, the business website domain (or the domain of your work email address) and, to find the map listing, the business's public name and city or country. We do not send your email address, your name or other personal details, although a sole trader's business name can include a person's name. Treg obtains the results from its data providers, which compile public business directories, map listings and company databases. The results are about the business, but they can include personal data where, for example, a sole trader's name or phone number is listed. We use them only for workspace setup and checks, and you can edit or remove any detail before you save it.
• Sanctions Lists: When a workspace is created, we compare the business name and the owner's name with the UK sanctions list and the U.S. OFAC Specially Designated Nationals list, which are published by government authorities.
• Customer-Enabled Business Data Integrations: When a Customer connects a business-data integration (for example a reservations system), we receive the data needed for the workflow the Customer requested.

By categorizing our data collection by source, we aim to provide a complete and accurate picture of our data ecosystem, ensuring you are fully informed about how your Personal Data comes into our possession.

Section 5: How and Why We Process Your Personal Data (Our Purposes and Legal Bases)

Under the UK GDPR, we are required to have a specific purpose and a valid lawful basis for every data processing activity we undertake. This section details these purposes and the legal grounds we rely upon, primarily focusing on Performance of a Contract, Legitimate Interests, and Consent. We are committed to the principle of "purpose limitation," meaning we will only process your data for the specific, explicit, and legitimate purposes outlined below, and will not process it in a way that is incompatible with those purposes without your further consent.

The table below provides a comprehensive overview of our data processing activities, the types of data involved, the legal basis for processing under UK GDPR, and our general approach to data retention for that purpose. This format is designed to provide maximum transparency and accountability.

Table 5.1: Our Data Processing Activities and Lawful Bases

Where we rely on Legitimate Interests, we identify the interest, check the processing is necessary, and balance it against your interests, rights and freedoms. Where UK law lists a purpose as a recognised legitimate interest (such as preventing crime), that balancing test does not apply, but the processing must still be necessary. You can object to processing based on legitimate interests (Section 12).

Where we rely on Consent, you can withdraw it at any time, for example by using the unsubscribe link in an email or by contacting us. Withdrawing consent does not affect processing that took place before you withdrew it.

Do you have to give us your data? You need to give us your name, email address and, for paid plans, billing details to create and pay for an account; without them we cannot provide the Services. We need some billing records to meet our legal obligations. Everything else, such as a profile photo, job title or connected integrations, is optional.

Section 6: AI and Automated Processing

6.1 AI/LLM Processing of Customer Data

Our Services include AI-powered features that process Customer Data using third-party large language model (LLM) providers. When a Customer enables AI features, Customer Data (such as conversation messages and contextual information) may be transmitted to these providers to generate automated responses, summaries, and other outputs.

We apply the principle of data minimization to AI processing. Only the minimum data necessary to generate a relevant response is transmitted to AI providers. This typically includes the End-User's first name and the relevant conversation context. Full contact details, account identifiers, and other unnecessary personal data are excluded from AI processing where possible.

Important disclosures regarding AI processing:

• AI-generated outputs are not guaranteed to be accurate, complete, or suitable for any particular purpose. Customers must review and validate all AI outputs before relying on them.
• We do not use Customer Data to train our own AI models, and we do not give Customer Data to AI providers for the purpose of training their models. We do not authorize model training where provider contracts or settings offer that control. Providers may keep data for a limited time for abuse monitoring and service operation under their terms. In our current configuration: OpenAI requests are sent with response storage turned off; Anthropic may keep a short-lived prompt cache (up to one hour) and its standard API logs; ElevenLabs keeps call transcripts, and call audio only when the Customer turns on call audio retention, for 30 days; Google Gemini is not used unless we have approved it for the specific use. We do not have zero data retention arrangements with these providers. See the Sub-Processor List for details.
• We also create AI-generated information about conversations for our Customers, such as a summary, topic, sentiment, likely satisfaction score, the language used and whether a conversation may need a person to step in. These help our Customers manage their support. They are not used by us to make decisions about End-Users.
• Our current AI sub-processors are listed in Section 8.2 of this Policy.

6.2 Voice AI Processing

For Customers using voice channel features, voice calls may be processed using AI-powered speech-to-text (STT) and text-to-speech (TTS) technologies provided by third-party voice AI providers.

• Voice data is processed in real time. Depending on the enabled feature and provider configuration, recordings, transcripts, call metadata and voice-cloning samples may also be retained by Masheev and its providers after a call. Customers must provide required AI and recording notices and obtain the necessary permissions. Deletion requests cover these retained records, subject to applicable retention obligations.
• Speech processing supports communications. We do not identify or verify people by their voice, and we do not create voiceprints of callers.
• Voice cloning is not currently available. If we make it available, we will update this Policy first. Synthetic voices created before it was switched off are deleted, together with their source recordings and the copy at our voice provider, when the Customer deletes them. A person whose voice was cloned can contact us at privacy@masheev.com.

6.3 AI Act Article 50: Transparency Obligations

Under Article 50 of the EU AI Act, providers and deployers of AI systems have separate transparency obligations when AI systems interact with natural persons.

• As a provider, we design AI features that talk directly with people so that they are told they are interacting with an AI system, for example through an AI identity statement at the start of AI voice calls and AI disclosures on supported messaging channels. We also describe our AI features in this Policy, our Terms of Service, and our platform documentation.
• Customers, as deployers, must keep these disclosures in place, must not configure an AI agent to claim to be human, and are responsible for any additional notices that apply to their own use of AI features, as set out in our Terms of Service.

6.4 Google and Microsoft User Data

If a Customer connects a Google account, Masheev requests only the access needed for the features the Customer turns on:

• Gmail (gmail.send): to send email replies from the connected address on the Customer's behalf;
• Google Calendar (calendar.events, calendar.freebusy): to check availability and to create, read, and update calendar events for bookings;
• Google Business Profile (business.manage): to read reviews and post replies for the connected business locations;
• Basic profile (openid, userinfo.email): to identify the connected account.

Masheev's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features the Customer has enabled. We do not use it for advertising, we do not sell it, we do not use it to train generalized AI or machine-learning models, and we do not allow humans to read it unless the Customer has given consent for specific messages, it is needed for security purposes, or it is required to comply with law. When a Customer disconnects a Google account, we revoke and delete the stored access tokens. Messages, bookings, and review replies that became part of the Customer's records are kept and deleted under Section 10.

The same commitments apply to Microsoft account data (Mail.Read, Mail.Send, Calendars.ReadWrite, User.Read) that a Customer connects for email or calendar features.

Section 7: Cookies, Analytics, and Advertising Technologies

This section provides detailed information about our use of cookies and other similar tracking technologies. These tools are integral to the functioning of modern web services, but their use requires transparency and provides you with specific choices, especially under regulations like the UK's Privacy and Electronic Communications Regulations (PECR) and the CCPA/CPRA in California.

7.1 What Are Cookies and Tracking Technologies?

Cookies are small text files that are stored on your device (computer, tablet, or mobile phone) when you visit a website. They are widely used to make websites work, or work more efficiently, as well as to provide information to the owners of the site. We also use similar technologies like web beacons (or "pixels") and local storage, which function in a similar way.

7.2 How We Use These Technologies

We categorize the cookies and trackers we use based on their purpose to give you clear and granular control.

• Strictly Necessary Cookies: These are essential for you to browse our website and use its features, such as accessing secure areas or managing your login session. These cookies do not require your consent, as the Services cannot function without them.
• Performance and Analytics Cookies: We do not currently load optional third-party analytics cookies. If we introduce them, they will remain off until you consent where required, and you may later withdraw that consent. The cookieless measurement and monitoring described below do not set cookies.
• Preference Storage: When you choose a setting on our website, such as theme, language or currency, we store that choice in your browser so the site remembers it. UK law allows this without consent when we tell you about it and give you an easy way to object. You can object by clearing the stored choice in your browser settings; the site then uses its defaults. We do not use this storage for analytics or advertising. If we introduce optional functional cookies beyond remembering your own choices, they will remain off until you consent where required.
• Chat Storage: The chat on our website, and the chat widget our Customers add to their websites, store a random visitor identifier and a session token in your browser so your conversation can continue if you reload the page. They are set only when you open the chat, and expire after 13 months without use. A security check (Cloudflare Turnstile) runs when a chat session starts, to block automated abuse.
• Sign-up and Referral Storage: When you arrive at app.masheev.com from a referral link, a campaign link or with a chosen plan, the app stores the campaign or referral tag and the plan name under onboarding_params, in session storage and in local storage, so they survive signing in with a code or link opened in another tab. The local copy expires after 7 days, and both copies are removed once you create your workspace. A referral code is also kept in local storage under masheev_ref_code so the person who referred you can be credited; the app removes it once the referral is recorded. These items hold only those tags and the plan name, and we do not use them for advertising or to track you across other sites.
• Sign-in Storage: The app keeps a masheev_had_session entry in local storage, holding only the time of your last signed-in visit and no identifier, to remember that this browser has signed in before, so a signed-out first-time visitor goes straight to the sign-in page. It is kept for up to 13 months after your last signed-in visit. The sign-in service also sets a better-auth.last_used_login_method cookie for 30 days that holds only the sign-in method you last used, so the sign-in page can show it. Both are needed to provide the sign-in you ask for. When you dismiss the cookies notice in the app, a consent cookie records for 12 months that optional categories are off.
• Payment Card Form (Stripe): When you open the form to add a card in the app, Stripe's payment script (Stripe.js) loads from Stripe and Stripe may set cookies, such as __stripe_mid and __stripe_sid, and collect device and browser signals. Stripe uses them to process the payment securely and to detect and prevent fraud. They are strictly necessary for the payment you ask for, and Stripe uses this data as described in the Stripe Privacy Policy and its cookie policy. Stripe.js is not loaded on our marketing website.
• Page View Measurement (Cloudflare Web Analytics): On app.masheev.com we use Cloudflare Web Analytics to count page views and measure how quickly pages load, so we can see where sign-up and setup work or fail. It does not set cookies, does not use browser storage and does not follow you across sites. Cloudflare processes the page address, the referring page, browser and device type, approximate country and page timing for us and gives us aggregated statistics. We rely on our legitimate interests in running and improving the Services. To opt out, you can block requests to static.cloudflareinsights.com in your browser or with a content blocker; the app keeps working.
• Error and Performance Monitoring (Sentry): Our website, web app and mobile app send error reports and a sample of performance measurements to Sentry. In the web app (in supported browsers) and the mobile app, this sample can include a performance profile: a record of which parts of our code were running and for how long. Reports contain technical details such as the page or screen (with search terms and other query text removed), browser or device type, operating system, timings and the error itself. We configure Sentry not to attach IP addresses, cookies or request headers, and we remove message content before reports are sent. Sentry does not set cookies. We use these statistics to find and fix faults and slow pages, relying on our legitimate interests in keeping the Services secure and reliable. You can object by contacting privacy@masheev.com (Section 12); in a browser you can also block requests to sentry.io with a content blocker, and the app keeps working.
• Optional Advertising Cookies: We do not currently load advertising or cross-site targeting cookies. If we introduce them, they will remain off until you explicitly consent where required and will be covered by an updated provider disclosure.

7.3 Your Choices and How to Manage Cookies

We provide you with robust tools to control the use of cookies and trackers on our Services.

• Cookies Notice: Our websites show a notice about the cookies and storage we use. Because we only use storage that is needed for the site to work or to remember your choices, there are no optional categories to switch on. If we ever add optional cookies, they will stay off until you agree.
• Global Privacy Control (GPC): We recognize and honor Global Privacy Control (GPC) signals sent by your browser. If we detect a GPC signal, we will automatically treat it as a valid request to opt-out of the "Sale or Sharing" of your Personal Information for that browser, as required under the CCPA/CPRA.
• Browser Settings: Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set, visit <www.aboutcookies.org> or <www.allaboutcookies.org>.

7.4 Our Commitment to Fair Choices

We are committed to providing you with clear and fair choices regarding your privacy. We do not use "dark patterns" (manipulative or deceptive user interface designs) to trick you into giving consent. Our consent mechanisms are designed to be easy to understand, with choices given equal weight, ensuring that your decisions are freely given and unambiguous.

Section 8: How We Share and Disclose Personal Data

We do not sell your Personal Data for monetary consideration. However, we do share Personal Data with trusted third parties who act as our service providers and sub-processors to help us provide, analyze, and improve our Services. This section details the categories of recipients with whom we share data and our commitment to ensuring they handle your data responsibly.

8.1 Categories of Data Recipients

We may share your Personal Data with the following categories of third parties for the business purposes described in this Policy:

• Cloud and Infrastructure Providers: We use third-party cloud hosting services to store the data we process and to run our Services.
• Analytics and Error Monitoring Providers: We share data with partners who provide analytics on service usage and help us identify and resolve technical errors and crashes.
• Feature and Integration Providers: When a Customer enables a channel or integration, we share the minimum data needed with that provider to deliver the requested functionality.
• Business Data Enrichment Providers: When you create a workspace, we send the business website domain, and the business's public name and location, to our enrichment provider, which looks up public business information through its data providers (Section 4.3).
• Payment Processors: We share payment information with specialized third-party payment processors to securely handle financial transactions.
• Communications Providers: We use third parties to facilitate our email and other communications with you.
• Professional Advisors: In the course of business, we may share information with our lawyers, accountants, auditors, and insurers.
• Corporate Transactions: If we are involved in a merger, acquisition, financing, reorganization, or sale of all or a portion of our assets, your information may be shared or transferred as part of that transaction, subject to standard confidentiality agreements.
• Legal and Law Enforcement Bodies: We may disclose your information if we are required to do so by law or in response to a valid legal request, such as a subpoena, court order, or government demand. We will only do so after assessing the validity of the request and will disclose the minimum information necessary.

8.2 Our Key Sub-processors

Under the UK GDPR, when another processor handles Customer Data on our behalf, we need the Customer's prior specific or general written authorization and a binding contract with that provider offering equivalent data protection obligations. The provider contract may incorporate those obligations without a separately signed DPA. Our Data Processing Addendum sets out Customer authorization and change-notice terms. Our provider review examines the service, data flows, security measures and applicable transfer arrangements. Listing a provider below does not, by itself, establish the agreement or transfer mechanism for a particular account.

The following table lists our key sub-processors, the services they provide, and their location. This list is reviewed regularly and updated as needed. For a comprehensive list focused on Customer Data processing, see our Sub-Processor List.

Perplexity AI and Expo push notifications are not currently in use. We will give 30 days' notice before using them.

8.3 Sub-Processor Change Notification

We will provide at least thirty (30) days' prior written notice before engaging a new sub-processor or replacing an existing sub-processor that processes Personal Data on our behalf. Notification will be sent to the email address associated with the Customer's account. Questions or objections may be sent to privacy@masheev.com.

If a Customer objects to a new sub-processor on reasonable data protection grounds, we will work in good faith to address the objection. Our Terms of Service set forth the complete objection and resolution procedure.

Section 9: International Data Transfers

As a company with operations and service providers in both the United Kingdom and the United States, we may transfer Personal Data collected from individuals in the UK to the US. Such transfers are considered "restricted transfers" under Chapter V of the UK GDPR and require specific legal safeguards to ensure that your data remains protected to a standard equivalent to that in the UK.

9.1 Our Global Operations

Our regional application databases are in the European Union and the United States. Central identity, billing, global edge execution and external providers have separate processing locations, described below and in our Sub-Processor List. Personal Data may therefore be processed outside your country of residence, including in the United States.

9.2 Legal Safeguards for UK Data Transfers

Restricted transfers require a valid mechanism under applicable data protection law. The assessment must identify the actual recipient legal entity, service, data and destination rather than relying on a provider's general marketing statements.

When we transfer personal data from the UK, we use one of these safeguards:

• UK adequacy regulations: transfers to the European Economic Area, and to US companies certified under the UK Extension to the EU-U.S. Data Privacy Framework for the data concerned. We rely on a certification only where it covers the recipient and the data concerned.
• UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement, for recipients that are not certified. Where we rely on these, we assess the transfer risks as UK law requires.

Personal data from the European Economic Area can flow to us in the UK under the European Commission's adequacy decision for the UK. The safeguard used for each provider is shown on our Sub-Processor List. You can ask for a copy of the relevant safeguard at privacy@masheev.com; we may remove commercially confidential terms.

9.3 Data Residency

The organization region selects the regional application database and object storage for conversations, contacts, connected-email content and uploaded files. The region cannot be changed through the product after creation.

• European Union: the regional database is in Frankfurt (AWS eu-central-1) and R2 uses the EU jurisdiction setting.
• United States: the regional database is in Northern Virginia; the US R2 placement is configured separately and is not a guarantee that every processing operation occurs in that location.

Account, identity, organization and billing control records are handled centrally, including in the EU primary database. Cloudflare edge execution and email routing, AI and communications providers, billing hosting, and operational monitoring can process information outside the selected organization region. The region setting is therefore not an all-data or all-processing residency guarantee. The search index used for AI knowledge retrieval is a single global index operated by Cloudflare and is not limited to the selected region. See the Sub-Processor List for provider locations and Section 9 for international-transfer safeguards.

Section 10: Our Data Retention and Deletion Practices

In accordance with the UK GDPR principle of "storage limitation," we are committed to not retaining Personal Data in an identifiable form for longer than is necessary to fulfill the purposes for which it was collected. A well-defined data retention strategy is not only a legal requirement but also a critical component of our data security and minimization efforts, reducing the risk associated with holding data over the long term.

10.1 Our Data Retention Philosophy

Our approach to data retention is purpose-based. We do not apply a one-size-fits-all retention period to all data. Instead, we determine the appropriate retention period for each category of Personal Data based on a careful assessment of the following criteria :

• The Purpose of Processing: The primary factor is the reason we collected the data. Once that purpose is fulfilled, the data is scheduled for deletion or anonymization.
• The Nature and Sensitivity of the Data: More sensitive data may be retained for shorter periods or subject to stricter security controls during its retention.
• Legal and Regulatory Obligations: Certain laws require us to retain data for specific minimum periods. Necessary UK company accounting records are ordinarily kept for six years from the end of the relevant financial year, with longer retention where an applicable exception requires it.
• Contractual Requirements: Our agreements with Customers may specify retention periods for the data we process on their behalf.
• The Need to Defend Against Legal Claims: We may retain data for a period corresponding to the statute of limitations for potential legal disputes.

10.2 Illustrative Retention Periods

While specific retention periods are detailed in our internal data retention schedule, the following examples illustrate our general approach:

• Customer Account Information: This data is retained for the duration that a Customer's account is active. Upon account termination, the data is retained for a limited period to facilitate account reactivation, address final billing inquiries, and comply with our legal obligations before being securely deleted.
• Marketing Data: Personal Data collected for marketing purposes is retained until you withdraw your consent or opt-out of receiving communications. We also periodically cleanse our marketing lists to remove data from individuals who are no longer engaged.
• Usage and Analytics Data: Data collected via cookies is retained according to the lifespan of the cookie or until you withdraw consent. Aggregated or anonymized usage data may be retained for longer periods for statistical analysis and product improvement.
• Conversations and Messages (including connected-email content): The daily retention job removes stored message content, sender details, attachments and associated free-text or AI-derived content after 365 days without conversation activity, whether the conversation was resolved or became inactive without a reply. It retains limited operational records, such as the conversation's contact association, status and timestamps; the associated contact record is not deleted by this conversation-specific operation. Records that can still be linked to a person remain Personal Data, subject to our retention and rights procedures. Provider deletion work is tracked separately until completed; this is not a promise of immediate deletion from every provider or backup. Valid earlier deletion requests use our erasure procedure. For connected email inboxes, only the labels or folders the Customer explicitly selects are ingested, and that content follows the same schedule.
• Audit and Security Logs: Audit logs (records of who took which action within an organization) are automatically deleted after 24 months.
• Backup Data: Our database provider takes automatic backups every 12 hours and keeps them for 2 days. We also keep a small number of named backups and recovery copies made before maintenance work. These are kept for longer and are retired under our internal backup schedule. Deleted data is not restored into active use: we keep a deletion record and re-apply it if a backup is ever restored. Deleted data disappears from backups when those backups expire.
• Contacts: Contact records (such as a name and phone number) are kept while the Customer's account is active and are deleted or anonymized under our retention schedule, when the Customer deletes them, or when the Customer's data is deleted at the end of the Services.

10.3 Data Deletion and Anonymization

Once the retention period for Personal Data has expired, we take active steps to securely dispose of it. This is typically achieved through automated processes that ensure timely and consistent deletion.

In some cases, instead of deletion, we may choose to anonymize the data. Anonymization is the process of irreversibly removing or altering personal identifiers so that the remaining data can no longer be linked to an individual. Only data that can no longer identify an individual, including through other information available to us, is treated as anonymous. Removing content or replacing identifiers alone does not make remaining linked records anonymous. Records that remain identifiable are still subject to data protection law and our retention and rights procedures.

Section 11: Our Commitment to Data Security

Protecting your Personal Data is a top priority for the Company. We have implemented and maintain a comprehensive information security program with appropriate technical and organizational measures designed to protect the data we process against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Our security measures are aligned with industry best practices and are designed to meet the principles of "integrity and confidentiality" under UK GDPR and the "reasonable security" requirements of the CCPA.

11.1 Our Security Measures

While we cannot disclose specific details of our security architecture for operational reasons, our security program includes the following key controls:

• Encryption: Connections between your device and our Services use Transport Layer Security (TLS). Managed database and object-storage providers encrypt data at rest under their service-specific controls. This is not end-to-end encryption of customer communications, and the applicable algorithms and key management depend on the provider and service.
• Access Controls: Application permissions are role-scoped and sensitive operations require server-side authorization. System-administrator operations in the application require verified second-factor assurance; organization users can enable MFA for their own accounts. Privileged account enrollment and access to external provider systems are reviewed separately under our operational access process.
• Secure Development and Vulnerability Management: We review security-sensitive changes and run source, dependency, and release-image checks in the local release pipeline. These point-in-time checks do not detect every defect. Independent assessments, when commissioned, are described by their scope and date; this policy does not represent that the Services hold a penetration-test certification.
• Vendor Security Management: Our vendor approval process requires review of the actual service, data flows, account settings and applicable processing and transfer terms. The Sub-Processor List identifies the providers relevant to those assessments.
• Incident Response: We have a documented incident response plan to promptly detect, investigate, and respond to any potential data breaches. In the event of a security incident affecting your Personal Data, we will notify you and any relevant regulatory authorities as required by law.
• Personnel Training: Personnel with access to customer data are required to understand their confidentiality and security responsibilities. Training and access-review records form part of our operational assurance process.

11.2 The Shared Responsibility Model

Our Services are built upon leading cloud infrastructure providers, including Cloudflare and PlanetScale. Security in the cloud is a shared responsibility. This model delineates the security obligations of the cloud provider and us, the customer.

• Security of the Cloud: Our cloud infrastructure providers (Cloudflare and PlanetScale) are responsible for protecting the underlying infrastructure that runs all of the services offered in their platforms. This includes the hardware, software, networking, and physical facilities that run the cloud services.
• Security in the Cloud: The Company is responsible for the security of everything we deploy on the cloud. This includes managing security configurations, access controls, application security, and securing the applications and Customer Data we deploy.

This responsibility extends to our Customers and Users. While we provide a secure platform, you are responsible for managing your own account credentials (like passwords) securely, configuring user access rights within our Services appropriately, and securing the data on your own devices.

11.3 Security Disclaimer

We strive to use commercially acceptable means to protect your Personal Data. However, it is important to recognize that no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, while we implement robust security measures, we cannot guarantee its absolute security.

Section 12: Your Privacy Rights and How to Exercise Them

We are committed to upholding your fundamental rights over your Personal Data. The rights available to you depend on your location and the applicable data protection laws. This section outlines the primary rights granted under the UK GDPR and the California CCPA/CPRA and explains how you can exercise them.

12.1 Your Rights Under UK Law (UK GDPR)

If you are a resident of the United Kingdom, you have the following eight fundamental rights regarding your Personal Data :

1. The Right to be Informed: You have the right to be provided with clear, transparent, and easily understandable information about how we use your information and your rights. This is why we are providing you with this Privacy Policy.
2. The Right of Access: You have the right to obtain access to your Personal Data (if we are processing it) and certain other information (similar to that provided in this Policy).
3. The Right to Rectification: You are entitled to have your Personal Data corrected if it is inaccurate or incomplete.
4. The Right to Erasure: This is also known as "the right to be forgotten" and, in simple terms, enables you to request the deletion or removal of your Personal Data where there is no compelling reason for us to keep using it. This is not a general right to erasure; there are exceptions.
5. The Right to Restrict Processing: You have rights to "block" or suppress further use of your Personal Data. When processing is restricted, we can still store your data, but may not use it further.
6. The Right to Data Portability: You have the right to obtain and reuse your Personal Data for your own purposes across different services. This allows you to move, copy or transfer your data easily from our IT systems to another, in a safe and secure way.
7. The Right to Object: You have the right to object to certain types of processing, including processing for direct marketing (which we must stop) and processing based on our legitimate interests.
8. Rights Related to Automated Decisions: If a decision with a legal or similarly significant effect on you is made solely by automated means, you have the right to be told about it, to make representations, to have a person review it and to contest it. We do not make decisions like this about you. When a new workspace is created, automated checks can approve it; if a check raises a concern, a member of our team reviews the workspace before any decision to refuse it. Our Customers decide how they use AI agents; ask the business you dealt with about its own decisions.

Time limits. We respond within one month. If we need to confirm your identity or need more information to find your data, the time limit is paused until we receive it. For complex requests we may extend by up to two further months and will tell you why.

If you are in the European Economic Area, you have the same rights under the EU GDPR and can complain to the data protection authority where you live or work.

12.2 Your Rights Under California Law (CCPA/CPRA)

If you are a resident of California, we honor the following rights in line with the California Consumer Privacy Act, as amended by the California Privacy Rights Act. We currently fall below the thresholds that make the Act apply to us as a business, but we follow it voluntarily. We will honor equivalent requests from residents of other US states.

1. The Right to Know and Access: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collecting it, and the categories of third parties with whom we share it.
2. The Right to Delete: You have the right to request the deletion of your personal information that we have collected, subject to certain exceptions (for example, if we need the information to complete a transaction or comply with a legal obligation).
3. The Right to Correct: You have the right to request that we correct any inaccurate personal information we maintain about you.
4. The Right to Opt-Out of Sale or Sharing: You have the right to direct us not to "sell" or "share" your personal information. As detailed in Section 13, we provide a "Do Not Sell or Share My Personal Information" link to exercise this right.
5. The Right to Limit the Use of Sensitive Personal Information: You have the right to direct us to limit our use and disclosure of your sensitive personal information to that which is necessary to perform the services or provide the goods reasonably expected. As explained in Section 13.3, we already use it only for those purposes.
6. The Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you goods or services, charge you different prices, or provide you a different level or quality of services for exercising your rights.

12.3 How to Exercise Your Rights

To exercise any of the rights described above, please submit a verifiable request to us by:

• Emailing us at: privacy@masheev.com
• Following our privacy rights request instructions: Privacy rights request instructions

Verification Process: To protect your privacy and security, we will take steps to verify your identity before processing your request. This may require you to provide additional information to match with the information we have on file.

Complaints. If you are unhappy with how we handle your personal data, tell us at privacy@masheev.com with the subject "Privacy complaint". We will acknowledge your complaint within 30 days, look into it, and tell you the outcome.

Response Time: We will respond to your request without undue delay, and in any event, within the timeframes stipulated by applicable law (typically within one month for UK GDPR requests and 45 days for CCPA/CPRA requests, with the possibility of extension in certain cases).

Requests Regarding Customer Data (Processor Role): If your request pertains to Personal Data for which we are a Data Processor on behalf of one of our Customers (as described in Section 3.2), we will forward your request to the relevant Customer (the Data Controller) and assist them in responding, as they are the party responsible for that data.

Section 13: Specific Disclosures for California Residents

This section supplements the information contained in the rest of our Privacy Policy and applies solely to visitors, users, and others who reside in the State of California. We adopt this notice to comply with the California Consumer Privacy Act of 2018 (CCPA) as amended by the California Privacy Rights Act of 2020 (CPRA).

13.1 Notice at Collection

As required by the CCPA/CPRA, we provide this notice regarding the categories of personal information we have collected from California residents in the preceding 12 months, the purposes for which we use it, and whether we "sell" or "share" it. This information is detailed in the table in Section 5 of this Policy. We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice. This notice is updated at least annually.

13.2 Sale and Sharing of Personal Information

Under the CCPA/CPRA, the terms "sell" and "share" are defined broadly. We do not sell your personal information for monetary payment, and we do not currently load optional third-party advertising or cross-site tracking cookies. If we introduce technology that could constitute a sale or sharing under these definitions, we will update this notice and provide the required choice before enabling it.

You can record or update your opt-out preference through the following methods:

• Click the link: Do Not Sell or Share My Personal Information This link will take you to our cookie choices, where you can keep advertising and other non-essential cookies disabled.
• Use Global Privacy Control (GPC): We recognize and process GPC signals from browsers as a valid request to opt-out of the sale or sharing of your personal information for that browser.

13.3 Use of Sensitive Personal Information

We do not collect or process Sensitive Personal Information for the purpose of inferring characteristics about you. Our collection of any data that may be deemed "sensitive" under the CPRA (such as account log-in credentials) is strictly for the necessary purpose of providing and securing your account and our Services.

Because we use sensitive personal information only for these permitted purposes, we do not offer a separate "Limit the Use of My Sensitive Personal Information" option. You can contact us with any questions at privacy@masheev.com.

13.4 Financial Incentives

We do not currently offer any financial incentives to consumers in exchange for the collection, retention, sale, or sharing of their personal information.

13.5 Authorized Agents

You may designate an authorized agent to make a request under the CCPA/CPRA on your behalf. We will require written proof of the agent's permission to do so and will need to verify your identity directly.

Section 14: Children's Privacy

Customer accounts and authorized operators must be at least 18 years old. The Services are designed for business use and must not be configured to target children or intentionally collect their personal data without our prior written agreement and the safeguards required by applicable law.

An end user contacting a customer is distinct from an adult platform operator. If a customer receives incidental information relating to a child, the customer remains responsible for its lawful handling and instructions to us. We assist with restriction or deletion requests under the DPA. Parents, guardians and customers can contact privacy@masheev.com about such information.

Some of our Customers' websites may be visited by young people. Our chat widget does not ask for age and is not designed for children. Customers whose websites are likely to be used by children must configure the widget accordingly and tell us before going live, so we can agree appropriate safeguards. We do not use AI providers whose terms prohibit services likely to be used by under-18s for those Customers.

Section 15: Updates to This Privacy Policy

The legal and regulatory landscape for data privacy is constantly evolving, as are our Services. We may update this Privacy Policy from time to time to reflect changes in the law, our data processing activities, or our business practices.

When we make changes to this Policy, we will update the "Last Updated" date at the top of this page. If we make a material change, one that significantly alters our privacy practices, we will provide you with more prominent notice. This may include sending a notification via email, posting a notice on our website homepage, or displaying a notification within our Services prior to the change becoming effective.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. This Policy is a transparency notice. Where a change requires consent or another legal basis, continued use alone does not supply that consent.

Section 16: Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy, our data handling practices, or if you wish to exercise any of your privacy rights, please do not hesitate to contact us. We have a dedicated point of contact to handle all privacy-related inquiries.

Primary Contact for Privacy Matters:

• Email: privacy@masheev.com
• Mailing Address: DA592 LTD, trading as Masheev Attn: Privacy Office DA592 LTD trading as Masheev Flat 32, 154 Loudoun Road London, England, NW8 0DJ

Privacy contact:

Our privacy team receives rights requests and privacy questions using the contact details above. This contact does not represent that we have formally appointed a statutory Data Protection Officer.

Right to Lodge a Complaint:

You can complain to us first (see Section 12.3). You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority. If you live in the European Economic Area you can complain to your local data protection authority.

• Website: https://www.ico.org.uk/concerns
• Helpline: 0303 123 1113

We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.