Privacy Notice

Mauyer provides an AI platform for financial institutions and individuals. For website visitors, account holders and private clients, Mauyer is the controller of personal data. Where a bank or other Institution uploads data about its customers, the Institution is the controller and Mauyer acts as its processor, under a data processing agreement.

• Account data — name, work email, organisation, role and authentication details (including Google sign-in identifiers).
• Customer content — documents, case notes, prompts and outputs you place in the Vault or workspace.
• Audit data — who did what and when, including maker and checker actions, which we retain to support your regulatory record-keeping.
• Technical data — IP address, device and browser information, and security logs.
• Enquiry data — what you tell us when you request a demo or contact us.

• To provide the Services and run Digital Committee reviews (performance of contract).
• To secure the platform, prevent fraud and maintain audit trails (legitimate interests and legal obligation).
• To respond to enquiries and send service communications (legitimate interests).
• To send marketing only where you have agreed, with an unsubscribe link in every message (consent).

We do not make solely automated decisions with legal or similarly significant effects about you. Mauyer is built so that a human checker reviews regulated outcomes.

Content is sent to AI model providers only to generate the output you requested, under contracts that prohibit them from retaining it for training. Requests are made with storage disabled where the provider supports it. Every output is logged with its model and cited sources so that it can be explained and audited.

We share personal data only with vetted sub-processors that help us operate — cloud hosting, database and storage, AI model providers, and email delivery — each bound by confidentiality and data-protection terms. We may disclose data where required by law or to protect rights and safety. We never sell personal data.

We operate globally. Where data moves across borders, we rely on recognised safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and equivalent mechanisms. Enterprise customers can discuss data-residency options for their deployment.

We keep account data while your account is active. Customer content is retained per your organisation's settings and deleted within 30 days of a verified deletion request or contract end, unless law requires longer. Audit records may be retained for the period your regulators require.

Data is encrypted in transit and at rest. Access is controlled by row-level security, role separation and least privilege, and the four-eyes rule is enforced on the server rather than in the browser. Details are on our Security page.

Depending on where you live, you may have the right to access, correct, delete or port your data, to restrict or object to processing, to withdraw consent, and to not be discriminated against for exercising these rights. Californian residents may also opt out of any sale or sharing; we do neither.

If your data was provided by your bank, we will route your request to them as controller. You can also complain to your local data protection authority.

We use only the cookies and local storage needed to keep you signed in and the site secure. We do not use advertising trackers.

The Services are not directed to anyone under 18, and we do not knowingly collect their data.

We will post updates here and notify account holders of material changes. Signed-in users can view, edit, export or delete their profile and content directly in the workspace; deleting your account removes your data as described above. Step-by-step instructions are in the Help & FAQ. If your data came from your bank, contact your bank as controller.