Privacy Policy

The data controller for the personal data described in this policy is Mehashi Ltd, a company registered in England and Wales under company number 17134832, with its registered office at 66 Paul Street, London, EC2A 4NA, United Kingdom. Mehashi Ltd is registered with the UK Information Commissioner's Office as a data controller under registration reference ZC216169.

We have not appointed a Data Protection Officer because the scale and nature of our processing do not require one. For any question or request about your personal data, email hello@mehashi.comwith "Privacy" in the subject line, or write to the registered office above.

Workspace content is different.When your organization uses Mehashi to manage its projects, the tasks, comments, messages, files, and notes your team creates are your organization's data. For that content your organization is the controller and Mehashi acts as its processor under the Terms & Conditions. We process it only to provide the Service. Requests about workspace content should go to the organization's owner or admin first; we will help them respond.

Account data. Your email address, a hash of your password (never the password itself), your Google account identifier if you use Google sign-in, email-verification state, account timestamps, and a staff flag where applicable.

Profile and workspace data. Display name, avatar (a URL or an uploaded image), bio, organization memberships and organization name, and the projects, tasks, comments, files, links, notes, message threads, feedback tickets, votes, and subscriptions you create or are part of, with their timestamps.

Session and security data. A hashed session token stored on our servers, session creation, expiry, and last-used times, and the IP address each session was used from. For operator security views we may derive an approximate location (country, region, city, coordinates) from that IP address.

Billing data.Stripe customer and subscription identifiers, subscription status, seat counts, and a record of Stripe webhook event IDs and types so we never process a payment event twice. Card details are entered on Stripe's pages and handled by Stripe; Mehashi never stores them.

Product usage events. First-party records of which project views and features authenticated users open, and sign-up funnel steps, keyed to user, organization, and project IDs. These stay in our own database and are not sent to any analytics vendor.

Support and feedback. Anything you send us by email or through the in-app feedback form, and our replies.

Browser storage. Interface preferences and drafts kept in your browser, described under Cookies and Browser Storage below.

We collect this data from you directly, from teammates who invite you to an organization (your email address), from Google when you choose Google sign-in or connect Google Calendar, and from Stripe when you subscribe.

UK GDPR requires a lawful basis for each purpose. These are ours.

Providing the Service (contract)

Creating and securing your account, signing you in, verifying your email, resetting passwords, running project boards, tasks, comments, messages, files, feedback, and organization collaboration, and sending the transactional emails those features depend on. Legal basis: performance of our contract with you (Article 6(1)(b)).

Billing (contract and legal obligation)

Taking payment through Stripe, managing seats and subscriptions, and keeping the records UK tax and company law require. Legal basis: contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)).

Security and abuse prevention (legitimate interests)

Rate limiting, detecting and blocking suspicious sessions, keeping IP addresses and approximate locations against sessions so operators can spot account takeover, and revoking sessions on password change. Legal basis: our legitimate interest in keeping the Service and its users safe (Article 6(1)(f)). We have balanced this against your interests and keep the data minimal and short-lived.

Understanding product usage (legitimate interests)

Recording which features and views are used so we can decide what to build and fix. The records never leave our systems and are not used for advertising or profiling. Legal basis: legitimate interests (Article 6(1)(f)).

Optional integrations (consent)

Reading your Google Calendar (read-only) when you connect it, using your browser location for the workspace weather widget, and sending Slack notifications when your organization connects Slack. Legal basis: your consent (Article 6(1)(a)), which you can withdraw by disconnecting the integration or revoking the browser permission.

Answering you (legitimate interests)

Responding to support, feedback, and privacy requests. Legal basis: legitimate interests (Article 6(1)(f)).

We do not make decisions about you using solely automated processing that has legal or similarly significant effects, and we do not use your data for marketing.

We share personal data only with providers we need to run the Service, each acting under a contract that limits what they may do with it. We do not sell personal data and we do not share it with advertisers.

Microsoft Azure

Hosts the application, the database, and uploaded avatars in the UK South region (London).

Stripe

Subscription checkout, billing portal, invoices, and payment webhooks. Stripe is an independent controller for the payment data you enter on its pages.

Google

Google Identity Services for Google sign-in, loaded only on the authentication pages, and Google Calendar (read-only) if you connect it.

Transactional email provider

Delivers verification, password-reset, and notification emails over SMTP. Only your email address and the message content are shared.

Slack

If your organization connects Slack, we look up your Slack user by email address and post notifications you have asked for into your workspace.

ipapi.co

Receives the IP address of a session to derive an approximate location for operator security views. No other data is sent.

Open-Meteo and OpenStreetMap Nominatim

Receive the coordinates or place name you give the workspace weather widget, to return forecasts and reverse-geocode a location.

jsDelivr

Serves the Twemoji flag images shown next to project locations. Like any image host it sees your browser's IP address when the image loads.

We will also disclose personal data if the law requires it, to enforce our Terms, or as part of a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your data.

Your data is stored and processed in the United Kingdom. Some of the providers above (Stripe, Google, Slack, ipapi.co, jsDelivr) may process data in the United States or other countries outside the UK and the European Economic Area.

When that happens we rely on one of the safeguards UK law recognizes: the provider's certification under the UK Extension to the EU-US Data Privacy Framework, a UK adequacy regulation for the destination country, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguard that applies to a particular provider.

We keep personal data only for as long as the purpose it was collected for requires. Current retention periods are:

Account, profile, and workspace data

For as long as your account exists, then through the 30-day recovery window described below, after which it is permanently deleted from active systems.

Sessions

Each session expires 14 days after it is issued and is revoked immediately when you sign out, change or reset your password, or delete your account. Expired sessions are removed from the database.

Email-verification and password-reset tokens

Until used, or until they expire, whichever comes first.

Product usage events

For as long as the related account and project exist; they are deleted with them.

Billing records

For as long as UK tax and company law require after the transaction, typically six years. Stripe keeps its own records under its own policy.

Support and feedback correspondence

For as long as needed to resolve the matter and, for feedback tickets, while the related account exists.

Database backups

Automated backups roll off within 35 days. Deleted data may persist in a backup until then, and is only ever used to restore the Service after a failure.

Deleting your account. You can delete your account from the profile security area. We immediately mark the account and the projects you own as deleted, revoke every active session, remove pending reset and verification tokens, and clear the session cookie. Normal login is blocked from that moment. For 30 days the account stays recoverable: email hello@mehashi.com and an authorized operator will verify the request and restore the account, memberships, owned projects, tasks, comments, messages, attachments, and avatar. After 30 days the account, its owned projects, dependent records, uploaded attachments, and avatar files are permanently removed from active systems.

Mehashi sets one first-party cookie, mehashi_session. It is strictly necessary for signing in and is not used for tracking, so no consent banner is required. It is documented in full in the Cookie Policy.

The web app also uses localStorage and sessionStorage for first-party interface state: language, sidebar state, recent projects, draft messages, unsaved spreadsheet cells scoped to your user and project for the current browser tab, project tab preferences, short-lived page caches, Google sign-in redirect context, a sign-in hint that tells the public home page whether to check for an existing session, and your saved weather location. Nothing in browser storage is sent to a third party. You can clear it through your browser settings; doing so resets those preferences.

Under the UK GDPR you have the right to:

• Access the personal data we hold about you and receive a copy of it.
• Rectify data that is inaccurate or incomplete. Most profile fields can be edited directly in the app.
• Erase your data. Deleting your account in the app does this for everything tied to your account, subject to the retention periods above.
• Restrict or object to processing we carry out on the basis of legitimate interests.
• Port the data you gave us to another service in a machine-readable format.
• Withdraw consent at any time for the optional integrations, by disconnecting them. Withdrawal does not affect processing that happened before.
• Not be subject to solely automated decisions with legal or similarly significant effects. We do not make any.

To exercise any of these rights, email hello@mehashi.com. We may need to confirm your identity, usually by asking you to write from the email address on the account. We respond within one month, or tell you within that month if a complex request needs up to two months more. There is no fee unless a request is manifestly unfounded or excessive.

Complaints.We would rather hear from you first, but you have the right to complain to a supervisory authority at any time. In the UK that is the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113. If you live in the European Economic Area you can complain to the data protection authority in your country. If you live in Mexico you have ARCO rights (access, rectification, cancellation, and opposition) under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares, which you can exercise by emailing us as above, and you may complain to the INAI.

United Kingdom and European Economic Area

If you are in the United Kingdom the UK GDPR and the Data Protection Act 2018 apply; if you are in the European Economic Area the EU GDPR applies. The rights described above apply to you in full. EEA users may also lodge a complaint with their national supervisory authority, listed at edpb.europa.eu. We have not appointed a representative in the EU under Article 27 of the EU GDPR because our processing of EEA users' data is occasional and low-risk; we will appoint one if that changes.

México: aviso de privacidad simplificado

Responsable: Mehashi Ltd, con domicilio en 66 Paul Street, Londres, EC2A 4NA, Reino Unido. Sus datos personales se utilizan para las finalidades descritas en este aviso: prestar el Servicio, facturación, seguridad y prevención de abusos, comprensión del uso del producto, integraciones opcionales que usted activa y atención a sus solicitudes. No recabamos datos personales sensibles. Puede ejercer sus derechos de acceso, rectificación, cancelación y oposición (ARCO), así como revocar su consentimiento, enviando un correo a hello@mehashi.comcon el asunto "Privacidad"; le responderemos en un plazo máximo de un mes. El aviso de privacidad integral es esta página, disponible en mehashi.com/privacy. Si considera que su derecho a la protección de datos ha sido vulnerado, puede acudir al Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI): home.inai.org.mx.

Everywhere else

Wherever you are, we apply the same protections described in this policy. The law where you live may give you additional rights; email hello@mehashi.com to exercise them.

All traffic to mehashi.com and api.mehashi.com is encrypted with HTTPS and protected by HTTP Strict Transport Security. Session tokens are stored in an HttpOnly, Secure cookie in your browser and only as hashes in our database. Passwords are hashed with Argon2id. Access to production data is limited to authorized operators, sign-up and sign-in endpoints are rate limited, and the database is not reachable from the public internet.

If a personal data breach is likely to put your rights at risk we will notify you and the ICO without undue delay, and within 72 hours of becoming aware where the law requires it.

Mehashi is a workplace tool and is not directed at children. You must be at least 13 years old to create an account, and we do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has created an account, email hello@mehashi.com and we will delete it.

When we change what we collect or how we use it, we update this page and the date at the top. For material changes we will also tell you in the app or by email before they take effect. The current version always lives at mehashi.com/privacy.

Mehashi Ltd, 66 Paul Street, London, EC2A 4NA, United Kingdom. hello@mehashi.com.