Privacy policy

Masaq Mind Inc. ("we", "us") builds Masaq Hub, a platform that organizations license to manage their people, spaces, documents, requests and payments. This policy explains what personal information Masaq Hub handles, why, and who it is shared with.

Who controls your information

Almost always, you are using Masaq Hub because an organization gave you access. That organization decides what information to collect about you, what it is used for, and how long to keep it. We hold and process that information on the organization's behalf and under its instructions.

This matters for your requests: if you want to see, correct or delete information an organization holds about you, that organization is the right place to start. We will help it respond, and you can always contact us at privacy@masaqmind.com if you are not sure who to ask.

What we collect

Information you or your organization provide.

• Account identity: your email address, and your name and phone number where you or an administrator supply them.
• Membership: which organization you belong to, which role you hold, and which spaces that role is anchored to.
• Content you submit: documents and files you upload, requests you open, messages and comments you write, and your answers to surveys, forms and invitations.
• Payment details, where an organization collects money through the platform. Card numbers go directly to our payment processor and never reach our servers; we retain only the outcome of a payment and the amount.

Information we generate.

• Authentication records: sign-in times, the method used, and the passkeys you register. A passkey's private key never leaves your device.
• A session cookie in your browser, set when you sign in and read on every request to keep you signed in. It is how we know who you are; clearing it signs you out. We also store your light or dark theme choice locally in your browser, which never reaches us.
• If you turn on browser notifications, the push subscription your browser issues, which is the address your device can be reached at.
• An audit trail of actions taken in the platform, which is how an organization can tell who changed a record and when.
• Notification delivery records, so a message that failed can be retried or diagnosed.
• Technical logs from our hosting provider, including IP address and browser user agent, retained for security and troubleshooting.

Information from sign-in providers. If you sign in with Google, we receive your name, email address and profile picture, and nothing else. We request only basic profile scopes. We use that information solely to identify your account. We do not use it for advertising, we do not sell it, and we do not transfer it to anyone except the service providers listed below who operate the platform on our behalf.

What we do not do

We do not sell personal information. We do not share it with advertisers, and we do not use it to build advertising profiles. We do not use the content you submit to train machine-learning models of our own.

How information is used

To create and authenticate your account; to show you the spaces, documents and requests your role gives you access to; to send the notifications your organization has configured; to process payments an organization initiates; to keep an audit trail; to secure the platform and diagnose faults; and to meet our legal obligations.

Service providers

Masaq Hub runs on third-party infrastructure. Each provider receives only what its function requires, and each is bound to use it only to provide its service to us.

• Hosting and application delivery — Vercel.
• Database, authentication and file storage — Supabase.
• Email delivery — Resend.
• Text-message delivery — Twilio, where an organization enables it.
• Payment processing — Stripe, where an organization enables it.
• Meeting integration — Zoom, where an organization enables it.
• The in-app assistant — xAI. When you ask the assistant something, your question and the records it retrieves to answer are sent there. This is not configurable per organization.
• Document and audio processing — depending on what an organization enables and configures, this may include Anthropic, AssemblyAI, Google, Mistral, OpenAI and xAI.

Content sent to either of those is sent for processing only, is not used by those providers to train their models, and is subject to their zero-retention or short-retention terms.

Some of these providers operate outside your country, which means information may be stored or processed elsewhere and may be subject to the laws of those jurisdictions.

Separation between organizations

Each organization's records are isolated. Access is enforced in the database itself, on the single role you are acting as, so a role in one organization cannot read another organization's records even if the same person holds roles in both.

Notifications

You control notification channels in your profile settings, and you can turn email, text-message and browser-push notifications off. Text-message recipients can also reply STOP at any time. Messages required to operate your account, such as a sign-in link, are not optional while your account is active.

Retention

We keep account and content records for as long as your organization keeps its account with us, and afterwards only as long as we need to for backups, legal obligations and dispute resolution. An organization can delete content it controls at any time. Technical and delivery logs are kept for a short operational period and then discarded. When an organization leaves the platform, we delete or return its records on request.

Security

Traffic is encrypted in transit and data is encrypted at rest. Access controls are enforced per role at the database layer rather than only in the interface. Administrative access to production systems is limited to the people who need it. No system is perfectly secure, and we do not claim otherwise; if a breach affects you, we will notify you and the relevant authorities as the law requires.

Your rights

Depending on where you live, you may have the right to access the personal information held about you, to correct it, to have it deleted, to withdraw consent, and to complain to a privacy regulator. Ask your organization first, since it decides what it holds and why, or write to us at privacy@masaqmind.com and we will route your request.

Children

Masaq Hub is not intended for children, and we do not knowingly collect information from anyone under 13.

Changes

We will update this page when our practices change and revise the date at the top. If a change materially affects you, we will tell you through the platform or by email before it takes effect.

Contact

Masaq Mind Inc. — privacy@masaqmind.com