Privacy policy
This policy explains how Formwork Software Limited, trading as Mavatu (“we”, “us”), handles personal data when you visit mavatu.com or use the Mavatu apps at app.mavatu.com. We are a company registered in England and Wales (company number 15640273, registered office 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF), registered with the Information Commissioner’s Office under number ZB781751. We have not appointed a data protection officer.
Questions about this policy go to hello@mavatu.com.
Our two roles
- We are the controller of the personal data we collect to run Mavatu as a business: your account, how you use the Service, billing and our conversations with you. This policy covers that data.
- We are a processor for the data organisations put into their workspaces (“Customer Data”), such as their projects, deals and the contacts in their Directory. The organisation that owns the workspace is the controller and decides what goes in and why. We handle Customer Data only on its instructions, under the data processing terms in our terms of service. If you’re in someone’s workspace data and want to exercise your rights, please contact that organisation; we’ll help them respond.
What we collect
- Account details: your name, email address and password (stored only as a secure hash), and the workspaces you belong to and your role in each.
- Billing details: your organisation’s name, billing contact and address, and payment records. Card details are handled by Stripe; we never see or store full card numbers.
- Usage and device data: your IP address, browser and device type, the pages and features you use, and logs of requests and errors, which we use to keep the Service secure and working.
- Notification settings: if you turn on notifications on a device, the push subscription your browser gives us for that device.
- Your messages to us: support requests and feedback.
We don’t use advertising trackers, and we don’t sell personal data.
How we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Create and run your account and workspaces, and provide the Service | Contract |
| Bill your organisation and keep financial records | Contract and legal obligation |
| Send service emails: sign-in links, invitations, notifications you’ve chosen, and important changes to the Service, prices or terms | Contract |
| Keep the Service secure, prevent abuse and enforce our fair use policy | Legitimate interests |
| Understand how the Service is used, so we can fix problems and improve it | Legitimate interests |
| Answer your questions and support requests | Contract or legitimate interests |
| Send product news by email, if you’ve opted in | Consent, which you can withdraw at any time |
Cookies
The Mavatu apps use one strictly necessary cookie to keep you signed in, and your browser’s storage to remember preferences such as your theme. mavatu.com uses no cookies. If we measure visits to mavatu.com, we use a privacy-friendly analytics service that doesn’t use cookies or track you across sites.
Where your data is stored
Mavatu’s data, including all Customer Data, is stored in a data centre in London, UK.
Who helps us run Mavatu
We use a small number of trusted providers. Each processes personal data only on our instructions and under a written contract.
| Provider | What they do | Where |
|---|---|---|
| DigitalOcean | Hosts the Mavatu apps, their database and the files you upload | London, UK |
| Cloudflare | Delivers the mavatu.com website | Global network |
| Twilio SendGrid | Sends our emails | United States |
| Stripe | Takes payments and handles billing and tax | United States and the European Economic Area |
Some features send data to other services only when a workspace or user turns them on or uses them:
- Contact pictures: to show contact and company pictures, we send Gravatar (Automattic) a one-way hash of the contact’s email address, and Google the company’s website domain. Workspace admins can turn this off, and contacts marked do not contact are never looked up.
- Notifications on devices: notifications are delivered through the push service of the device’s browser, run by Apple, Google or Mozilla.
- AI apps: if you connect an AI app such as Claude or ChatGPT, it receives the data it asks for on your behalf, with your permissions. That provider’s own privacy policy then applies to that data.
Some of these providers are based in, or process data in, countries outside the UK, including the United States. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the UK’s International Data Transfer Agreement or Addendum to protect it.
How long we keep it
| Information | How long we keep it |
|---|---|
| Account details | While your account is open, then 90 days after it’s closed |
| Customer Data | Until the workspace deletes it, or 90 days after its subscription ends |
| Sign-in sessions | Until they expire; records of expired sessions for 30 days |
| Server logs | 90 days |
| Backups | 30 days |
| Billing records | 6 years after the end of the financial year they relate to |
| Support conversations | 2 years after the account is closed |
How we protect it
Data is encrypted in transit, access to systems and data is limited to the people who need it, passwords are stored only as secure hashes, and we keep regular backups. No system is perfectly secure, but we work hard to protect your data and will tell you, and the ICO where required, if a breach affects it.
Your rights
Under UK data protection law, you can ask us to:
- give you a copy of your personal data
- correct it if it’s wrong
- delete it
- restrict or object to how we use it
- give it to you, or another organisation, in a portable format
- stop using it where we rely on your consent
Email hello@mavatu.com and we’ll reply within one month. If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We’d appreciate the chance to put things right first.
Children
Mavatu is for organisations and isn’t intended for anyone under 18.
Changes to this policy
We may update this policy. We’ll post the new version here with its date, and tell you by email about changes that matter.