Privacy Policy
Last updated: 28 August 2026 · Applies to all Mavex platforms
Contents
1. Our principle, briefly
We collect the minimum needed to run the service, and use it for that purpose alone.
We do not sell your data. We do not share it for marketing. We do not use your customers' data to train general-purpose AI models.
This policy distinguishes two kinds of data:
- Your data as an account holder — we are the controller.
- Your customers' data that you enter into the system — you are the controller and we are a processor acting on your behalf.
2. What we collect
| Category | Examples |
|---|---|
| Account data | Name, email, phone, business name, role and permissions |
| Operational data | What you enter: bookings, customers, vehicles, invoices, documents, correspondence |
| Technical data | IP address, browser and device type, sign-in times, error logs |
| Usage data | Pages you visit and actions you take inside the system |
| Billing data | Subscription plan and invoice history. We do not store card numbers — a certified payment provider handles them |
3. Why we process your data
- Contract performance: operating the service, providing your account, issuing invoices.
- Legitimate interest: securing the platform, preventing fraud, improving performance, technical support.
- Legal obligation: retaining financial and tax records under UAE regulations.
- Your consent: for marketing messages if you opted in — withdrawable at any time.
4. Where data is stored
Our infrastructure is distributed, and some components sit outside the UAE:
| Component | Provider | Location |
|---|---|---|
| Database and files | Supabase (AWS) | Tokyo, Japan |
| Application servers | Railway | United States |
| Frontend hosting and CDN | Vercel · Cloudflare | Globally distributed |
Cross-border transfer. This means your data is transferred and processed outside the UAE. We disclose this explicitly in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
We contract with these providers under data protection terms that bind them to equivalent security standards and prohibit them from using your data for their own purposes.
5. Who processes it for us
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication, file storage |
| Railway | Running application servers |
| Vercel | Frontend hosting |
| Cloudflare | Bot protection and content delivery |
| Resend · Zoho | Sending system and business email |
We do not share your data with anyone else except under a court order or legal obligation, and we will notify you where the law permits.
6. Retention periods
- Active account data: for as long as the account exists.
- After termination: thirty days to export, then deletion from operational systems.
- Backups: retained a limited further period until the backup cycle expires.
- Financial records: retained for the period required by UAE tax regulations.
- Security logs: a limited period for incident investigation.
7. How we protect it
- Encryption in transit (TLS) and at rest.
- Tenant isolation enforced at the database level.
- Role-based permissions, and two-factor authentication for sensitive operator accounts.
- An audit trail recording sensitive actions.
- Regular backups.
If a breach materially affects your personal data, we will notify you and the competent authority as required by law.
8. Your rights
At any time you may request to:
- Access the data we hold about you.
- Correct it if inaccurate.
- Delete it, within the limits of our legal obligations.
- Port it by exporting in a machine-readable format.
- Object to specific processing, or withdraw consent where processing relies on it.
Write to info@mavex.ae and we will respond within thirty days at most.
9. Cookies
We use cookies that are necessary to operate the service: keeping your session open, remembering your language, and protecting forms from automated submission.
We do not use advertising trackers and do not permit third parties to track you across our platform.
10. Children's data
Our services are intended for businesses and are not directed at anyone under eighteen. If we learn that we have collected a minor's data without a lawful basis, we will delete it.
11. Contact and complaints
- Legal name: Mavex Technologies
- Email: info@mavex.ae
- Address: Dubai, United Arab Emirates
If you are not satisfied with our response, you may lodge a complaint with the competent data protection authority in the UAE.