Privacy Policy
Last updated: 2026-09-12
This policy explains what personal data Mavels Tech ("we", "us") collects through Edmired at https://www.edmired.com, why we collect it, who else processes it, how long we keep it, and what you can ask us to do with it.
We are the data controller for the personal data described in Section 2. Where you enter information about other people into your workspace, you are the controller of that information and we process it on your behalf — Section 4 explains what that means and what it requires of you.
1. Contacting us about privacy
Send any privacy question, access request or deletion request to hello@mavelstech.in. We reply within 2 business days.
- Mavels Tech
- Email: hello@mavelstech.in
- Phone: +91 93987 28565
- Address: Bangalore, Karnataka, India
2. What we collect about you
| Category | What it is | Where it comes from |
|---|---|---|
| Account identity | Your email address, your display name, and an identifier issued by our authentication provider | You, when you sign in |
| Workspace content | Everything you enter — ideas, problem statements, customer records, interviews, evidence, requirements, plans, documents | You, as you use the Service |
| Plan and usage | Which plan is assigned to your account, your credit balance, and an append-only record of each credit granted or spent | Generated as you use the Service |
| Audit records | A record of sign-in, account creation, and each accepted change to your workspace, with a request identifier | Generated as you use the Service |
| Technical data | IP address, browser and device information, request paths, timestamps and error details, in server logs | Automatically, on every request |
| Product analytics | Which pages and features are used, and in what order | Automatically, in your browser |
| Messages to us | Your email address and the message you send | You, when you contact us |
We do not collect or store payment-card details. Where a payment is taken, it is taken by a payment processor and the card details go to them, not to us.
We do not ask for, and you must not enter, special-category data (such as health, biometric, religious or political information), government identification numbers, card numbers, or anyone's passwords. Section 6.3 of the Terms makes this your obligation as well as our request.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, and providing the Service you asked for | Performance of a contract |
| Taking payment and keeping financial records | Performance of a contract; legal obligation |
| Keeping the Service secure, preventing abuse, and investigating incidents | Legitimate interests |
| Diagnosing faults and improving the Service | Legitimate interests |
| Answering your messages and providing support | Performance of a contract; legitimate interests |
| Complying with law, and responding to lawful requests | Legal obligation |
We do not sell personal data, and we do not share it for advertising or for anyone else's marketing. We do not use your workspace content to train machine-learning models, our own or anybody's.
4. Information about other people that you enter
The Service is built for research, so your workspace can end up describing people who are not you — an interview participant, a named contact, a person whose public post you recorded.
- You are responsible for having a lawful basis for holding that information, and for any notice or consent that basis requires. This is Section 6.3 of the Terms.
- Where the Service shows you a contact detail gathered from a public source, it shows the source alongside it so you can verify it yourself. Nothing is guessed or derived from a domain name.
- If someone asks us directly to remove information about them that a customer entered, we will pass the request to that customer and assist them in handling it.
5. Authentication and passwords
Sign-in is handled by Google Firebase Authentication. We never receive, see or store your password. What reaches us is a verified token and the account identifier it carries. If you sign in with Google, your password is managed by Google under their terms.
6. Cookies, and why there is no cookie banner
The Service does not use advertising cookies, tracking pixels or third-party marketing tags.
- Essential storage. Your browser holds a session so that you stay signed in, and holds interface preferences such as which tab you last opened.
- Product analytics. Our analytics tool stores its identifier in your browser's local storage rather than in a cookie, and records product usage — not your workspace content.
Because we set no advertising or cross-site tracking cookies, we do not present a consent banner. If that changes, this section changes with it and consent will be asked for before any such technology is used. You can clear browser storage at any time through your browser settings; doing so signs you out and resets your interface preferences.
7. Who else processes your data
We use the following processors. Each is bound to process data only on our instructions.
| Processor | What it does | What it receives |
|---|---|---|
| Vercel | Hosting, content delivery, serverless functions | Every request, including IP address, request path and server logs |
| Neon | Managed PostgreSQL database | Your workspace content, account record, plan and credit records, audit records |
| Google Firebase Authentication | Identity and sign-in | Your email address, display name, account identifier and authentication events |
| PostHog | Product analytics | Product-usage events and a browser-held identifier |
| Perplexity | Research lookups, where you use a research feature | Only the fields that feature needs, per Section 8 |
| Google Vertex AI | Draft generation, where you use a drafting feature | Only the fields that feature needs, per Section 8 |
| A payment processor | Taking payment for a paid plan | Your payment details, which go to them and not to us |
Some of these operate outside India, so your data may be transferred and stored in other countries. Your data leaves the UK and the European Economic Area — we say so plainly rather than omitting the sentence and letting the omission reassure you. Where such a transfer involves personal data protected by UK or EU law, it is made under the safeguards that law requires, including standard contractual clauses where applicable.
Nothing you enter is used to train anybody's model, and we do not sell or share your workspace content. Where a feature sends fields to a model provider, an interview transcript is never one of them — a finding can travel; the transcript and the person who said it do not. Section 8 lists what is excluded and how that exclusion is enforced.
8. What is never sent to a model provider
Where a feature drafts text or performs a research lookup, it sends an explicitly listed set of fields for that feature — an allowlist, so a field that nobody listed is never sent, rather than a filter that has to recognise everything it should remove.
On top of that, the following are never included in any request to a model provider, whatever feature is running:
- any email address, including a business or published contact address;
- any phone number;
- any social handle or profile link;
- any person's full name;
- your account, workspace or authentication identifiers.
Outbound requests are restricted to a fixed list of provider endpoints, matched exactly. A request to any other destination is refused rather than allowed by a pattern that a lookalike host could satisfy.
Output produced this way is labelled as drafted, is not verified by us, and should be checked before you rely on it. See Section 7 of the Terms.
9. Keeping your data secure
- All traffic is encrypted in transit using TLS. Our hosting and database providers both enforce it.
- Data is encrypted at rest by our hosting and database providers.
- Every database table enforces row-level security, and it is enforced against the application's own database role as well — that role cannot bypass it. The workspace a request may read is set from the verified authentication token for the duration of that request and cannot be supplied by the request itself. The effect is that there is no query anyone can write that returns another customer's records.
- We log sign-in and account events, and each accepted change to a workspace. We do not log passwords, tokens, or the values of your workspace fields.
- Access to production systems is limited to those who need it to operate the Service.
What we do not claim. We hold no security certification, and no third party has assessed or reviewed this system's security. The controls above are the ones it actually enforces, and we would rather list those than imply an assurance nobody has given us.
No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to you, we will notify you and the relevant authority within the time the applicable law requires — under GDPR, within 72 hours of becoming aware of it.
10. How long we keep it
| Data | Retention |
|---|---|
| Account identity and workspace content | While your account is open. Deleted on request, as in Section 11 |
| Plan, credit and payment records | Retained after account closure for as long as tax and accounting law requires |
| Messages you send us through the site | 12 months, then deleted automatically |
| Server logs | Retained for a short operational period by our hosting provider, then rotated |
| Product analytics | Retained by our analytics processor under its own retention settings |
Closing your account does not destroy it immediately. When you confirm a deletion request your account is marked deleted and stops working at once, but nothing is erased for 30 days. Inside that window you can ask us to restore it and your workspace comes back as it was. After 30 days it is erased permanently.
Database backups. Our database provider keeps a short point-in-time recovery window. An erased record is gone from the live database immediately and ages out of that point-in-time recovery window within six hours. After that it cannot be restored, by us or by anyone. That is a shorter window than most services offer, and it is deliberate: it is the honest answer to somebody asking to be forgotten.
11. Your rights, and how to use them
Depending on where you are, you may have the right to: obtain a copy of the personal data we hold about you; have inaccurate data corrected; have your data deleted; restrict or object to certain processing; receive your data in a portable form; and withdraw a consent you previously gave. You also have the right to complain to your data-protection authority.
To exercise any of these, email hello@mavelstech.in. We will ask you to confirm the request from the email address on the account, and we will respond within 30 days.
How deletion works. Emailing us always works. Where your workspace is stored on our servers, you can also start the request from Settings inside the Service. Either route runs the same process, and it is deliberate:
- You ask — from Settings, or by email.
- We send a confirmation to the email address stored on your account, never to an address supplied in the request. Nothing is deleted until that comes back — a deletion that could be triggered by a message we cannot attribute would be a way to destroy someone else's work. If we cannot send you an email, we say so and contact you another way rather than promising one.
- The confirmation link stops working after 48 hours. While a request is open you can cancel it.
- On your confirmation your account is marked deleted and stops working immediately. Nothing is erased for 30 days, and inside that window you can ask us to restore it.
- After that, your account record, your workspace and every record belonging to it are erased, across every table that holds them.
- A record that the deletion happened survives it, stripped of anything that identifies you. We keep the fact, not the person.
- Where law requires us to keep something — a financial record, for example — we keep only that, and only for as long as required.
Where the Service keeps your work in your own browser rather than on our servers, there is no server-side account to delete and the Reset workspace control in Settings erases it. We say which of the two you are using on the screen itself rather than leaving you to guess.
You can export your workspace content from within the Service at any time, without asking us.
12. Children
The Service is for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email hello@mavelstech.in and we will delete it.
13. Automated decision-making
We do not make any decision about you by automated means that has a legal or similarly significant effect on you. Scores and summaries the Service produces are about your project, from records you entered, for you to read — they are not decisions we take about you.
14. Which laws we work to
We treat the UK and EU General Data Protection Regulation and India's Digital Personal Data Protection Act as applying to our processing, and we have written this policy to meet them. If a law that applies to you gives you a stronger right than this policy describes, that law prevails.
15. Changes to this policy
We may update this policy. The current version is always at https://www.edmired.com/privacy and the "Last updated" date at the top changes with it. Where a change materially affects how we handle your personal data we will take reasonable steps to tell you before it takes effect.