Draft template. This document has not yet been reviewed by a Canadian lawyer, and highlighted text is a placeholder or a fact still to be confirmed.
Last updated: effective date
This policy explains how Mauby Software Inc. (incorporation pending) ("Mauby", "we", "us") handles personal information on this website and in the Mauby platform. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
Who we are
Mauby is operated by Mauby Software Inc. (incorporation pending), registered office address, Ontario, Canada. Our privacy officer is name of privacy officer, reachable at hello@getmauby.com.
Our role
For information you give us directly, such as a message through the contact form, we decide how it is used and are responsible for it.
For information a customer puts into its Mauby workspace (documents, requirements, estimates, rates and the names of its staff), we process it on the customer's behalf and under our agreement with that customer. The customer is responsible for having the right to share it with us. Questions about that information are best sent to the customer first; we will help them answer.
What we collect
- Contact requests: your name, work email, company, and optionally your job title and a message.
- Account details: your name, email address, role and the workspace you belong to. Sign-in uses a one-time code sent to your email.
- Workspace content: the text of documents you upload or paste (we keep the extracted text, not the original file), and the requirements, capabilities, estimates, rates, approvals and notes you create.
- Activity records: who changed what and when inside a workspace, kept so customers have an audit trail.
- Technical data: IP address, browser type and request logs kept by our hosting providers to run and secure the service.
We do not sell personal information. We do not use advertising or analytics cookies. The only cookies we set keep you signed in.
How we use it
- To reply to contact requests and decide whether to offer an account.
- To create and run accounts and workspaces, and to send sign-in codes and service emails.
- To provide the features customers ask for, including drafting requirements from documents.
- To keep the service secure, fix problems and meet legal obligations.
We do not use workspace content to train AI models, and we do not look at it except to support the customer, keep the service secure, or when the law requires it.
AI-assisted drafting
When a workspace uses automatic requirement drafting, the text of the document is sent to Anthropic, PBC through its commercial API so a model can suggest requirements. Every suggestion must quote the document word for word and stays a draft until a person approves it. If this feature is turned off, drafting uses built-in rules and no text leaves our own systems for this purpose.
Confirm before publishing: Anthropic's current commercial terms on training on API inputs and how long inputs are retained.
Service providers
We use the following providers to run Mauby. Each may only use personal information to provide its service to us.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in and data storage | Region to confirm; believed Canada (Central) |
| Vercel | Website and application hosting | Region to confirm; may be United States |
| Resend | Sign-in and service email | United States; confirm sending region |
| Anthropic | AI-assisted drafting, when turned on | United States |
Some of this information may therefore be stored or processed outside Canada, where it can be accessed by courts and authorities under local law.
Consent
We collect only what we need for the purposes above. By sending a contact request or using an account, you consent to these uses. You may withdraw consent at any time, subject to legal or contractual limits; we may then be unable to provide the service.
How long we keep it
Contact requests we do not act on are deleted within 12 months. Workspace content is kept for as long as the customer's agreement is in force and deleted or returned within 30 days after it ends, unless the law requires longer. Backups follow our providers' retention cycles.
Security
Data is encrypted in transit. Each workspace is isolated from others in the database, and only its members can see its records. Access is limited to people who need it. No system is perfectly secure; if a breach creates a real risk of significant harm, we will notify affected people and the Office of the Privacy Commissioner of Canada as PIPEDA requires.
Your rights
You may ask to see the personal information we hold about you, ask us to correct it, or withdraw consent. Write to hello@getmauby.com. We will reply within 30 days. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
Changes
We will post any change here and update the date above. If a change is significant, we will tell account holders by email before it takes effect.