Privacy Policy

This is the current version, dated 13 October 2026.

This policy explains how MVV Technologies Limited ("MVV", "we", "us") uses personal information for its own business: about the businesses that subscribe to our software (the MVV App), the people there we deal with, the independent sales agents who introduce businesses to us, and anyone else who contacts us.

Four terms used in this policy:

• A Workspace is a customer's own copy of the MVV App, with its own database, sign-in and file storage.
• Our control console is the private tool we use to set up, watch and update Workspaces. Its database is our control database.
• A keyed fingerprint is a code worked out from a value, such as an email address, with a secret key. It lets us check whether a value matches one we have seen. The value itself is not stored.
• When sign-up opens means the day we send our first invitation to join to a customer. Joining is by invitation: our public sign-up form (signup.mvvtechnologies.com) is not open, and what this policy says about that form applies only if we open it. Until that day we take no customer's payment. Before that day we may run the invitation and payment steps in test mode to rehearse them. What this policy says about invitations, and about payments through Stripe, applies from that day.

1. Who we are

MVV Technologies Limited, company number 17300982, registered in England and Wales. Registered office: Suite 301, 18-24 Turnham Green Terrace, London, England, W4 1QP.

Contact for privacy questions: privacy@mvvtechnologies.com.

We are registered with the Information Commissioner's Office (ICO). Our ICO registration number is ZC264136.

We are the controller of the information described in this policy.

2. Two different roles: which one applies to you

The rest of this policy is about the first row only.

3. What we collect, and where it comes from

3.1 When a business becomes our customer

• the company's legal and trading names, company number, registered address, phone, email, website, VAT number, logo and brand colours, and the bank details it wants printed on its own invoices, which we type in once and confirm;
• the account owner's name and email address, and their role;
• the records address to which copies of the Workspace's outgoing emails are sent;
• the plan, modules, seats, prices, country, currency and region of the Workspace;
• the payment that arrived before the Workspace was built: our invoice number, the amount and currency, the period it pays for, the date it arrived, how it was paid, a short note, and who at MVV confirmed it. That record holds no card details and no bank details.

We keep the company details above outside our source code: in a private folder on our own computer, every version, and in the backups of the customer's Workspace. Our control database keeps the customer's registered name, the country it is billed in, the Workspace's name and its plan, seats and fees, with a fingerprint of each version of the company details. It does not keep the versions themselves, so the bank details are never in it. We keep no password for the account owner: they choose their own from the link in their welcome email, and we never see it.

When we invite a business. Joining is by invitation. MVV support types in the company's registered name, trading name, company number and registered office, the first and last name, role and work email of the person we invite, as that person or their company gave them to us, and the plan and packs of extra seats we offer. We keep these details in a private file on our own computer, never in our control database, except as described under "The record of the terms accepted" below. Our control database keeps the Workspace name, the plan, the packs of extra seats and whether the invitation is for real or test payments, a keyed fingerprint of the link we email (never the link itself), and the versions of the Terms of Service and the Data Processing Agreement ticked on the invitation page, with the time of that tick; for a business established in Italy, also its country and the second, separate tick by which it specifically approves the clauses listed in Schedule 4 of the Terms of Service (articles 1341 and 1342 of the Italian Civil Code): the version approved, a fingerprint (sha256) of that Schedule's text and the time of the tick. We email the person we invite: the invitation, and again if they need a new link or have not yet set up their Direct Debit. Each email says what we keep and links to this policy. If the invitation is withdrawn, ends because it was not paid within 30 days of being made, or ends refused or refunded, we delete the company's and the person's details from that file. Once the Workspace is built, we keep the company's details as described above for a customer, and that file keeps only the person's first name and email, for the Direct Debit reminder, until the Workspace is deleted after it leaves. Card and bank details go to Stripe alone, on its own pages. When we invite a business, we also keep a keyed fingerprint of its company number in our control database, so that our sales agents cannot later claim it as their own contact (3.7).

When a business asks to join on our "I'd like to join" page (signup.mvvtechnologies.com/join.html, from the day it opens): the company's name; the first and last name, work email and, if given, phone number of the person asking; their message; and, if they came through a sales agent's personal link, that agent's code. The page sends them through our gateway at Cloudflare to our sign-up service at Supabase, which seals them, with a public key whose private half only our own computer holds, before it stores them in our control database. Our computer collects them within minutes, keeps them in a private file with the date and the version of this policy the page showed, and removes the sealed copy from the database; a sealed copy our computer has not collected within 14 days is removed all the same. Our control database keeps only the request's reference, its date, the agent's code if it named a sales agent working with us at that moment, the reference of the key that sealed it, and what became of the request (for example, that we invited the company), never the details themselves. We use the details to reply and, if you ask, to invite the company to join. The agent does not see them. We delete them 90 days after the request, or sooner if you ask or if we will not be inviting the company, unless we invite the company; then they become the invitation's details described above. We send no email to the address typed, other than our reply. For the page's limits we keep keyed fingerprints of the network address and the email address asking, for two days.

When a business signs up on our sign-up page (only if we open it: joining is by invitation), the page asks for:

• the plan and seat packs chosen;
• the company's registered name, company number and registered office, as the person signing up types them. The page does not look them up anywhere. Before we build the Workspace, we check them on the public register at Companies House (see below). A Workspace ordered on our sign-up page is built only for an active UK limited company;
• the trading name;
• the name, role and work email of the person signing up. The email must be at the company's own web domain: free mailboxes such as Gmail or Outlook are refused. We confirm it with a six-digit code;
• if given, the name and phone number of the person our account team should call back.

Our control database keeps only keyed fingerprints of the email address, of the person (name, role and trading name together), of the company number and of the network address the sign-up came from, never the values, except the name and role of the person who signed up, which, once we build the Workspace for a paid order, are kept as described under "The record of the terms accepted" below. With them it keeps the plan, the seat packs, the Workspace name asked for, the versions of the Terms of Service and the Data Processing Agreement ticked and the time of that tick, and, in one word, whether the same company already had a paid order with us. An application that did not become a paid order is deleted, fingerprints and all, 30 days after it was started. One that did is kept, as the record of the terms accepted and of one Workspace per company, for 7 years after the customer's last subscription ends. For our limits we also keep keyed fingerprints of the network address and the email address asking, for two days.

The details themselves go to Stripe, in the checkout, and, when we build the Workspace, into the private folder on our computer described above. The contact person is kept there too, never in our control database.

Some of this we look up ourselves when we set the Workspace up. Before we build a Workspace ordered on our sign-up page, MVV support checks the company by hand on the public register at Companies House: that it is an active UK limited company, that its registered name, number and office are the ones given, and that the person who signed up is one of its officers. We do not copy the list of officers into our records. We also look at the brand colours, logo and company details shown on the company's own public website.

The record of the terms accepted. When we build a Workspace for a paid order, our control database records which versions of the Terms of Service and the Data Processing Agreement the customer accepted, when, and how (on the invitation page or on the sign-up page), with the name and role of the person who accepted them on the customer's behalf, never their email address. For a business established in Italy, it also records, next to that acceptance, the second tick of specific approval described above (the version approved, the fingerprint of Schedule 4's text and the time of the tick), with the same name and role. Our software cannot change or delete this record. We keep it for 7 years after the customer's last subscription ends, then delete it in our yearly delete (section 7).

3.2 While the subscription runs

We keep service records about each Workspace, without the content of the customer's data:

• how many office staff, by role, and how many of the firm's own customers and architects have sign-ins; how many were active in the last 30 days; the time of the latest office-staff sign-in;
• for each table in the Workspace, how many rows, how many added recently, and when it last changed;
• whether the Workspace was reachable, and how quickly it answered;
• a record of each AI, email and voice request the Workspace made through our gateway: time, type of service, function, result and duration, never what was asked or sent;
• AI use per module per day: the number of AI calls, the tokens (units of text) sent and received, and their cost, never per person;
• for each Workspace with an AI allowance, month by month: the pounds its plan includes, its AI spend before the month as the Workspace reports it, the total we issued to it, and the signed settings file that carried it; and, while a call or an email passes our gateway, a short hold on its count;
• each Workspace's server errors counted hour by hour, by function, never what was said;
• support requests raised from the Workspace: category, urgency and time, never the text. Our control console emails each new support request, and each new cancellation request, once to our own mailbox: the kind, the urgency, the time and the Workspace's name, and nothing else;
• a cancellation request, who confirmed it and when, and the leaving dates; then each step of the leave that followed (the suspension, the finished leave with the date deletion may begin and the names of the files we hand back, a withdrawal if the customer stayed, and the deletion), with the account and computer at MVV that recorded it;
• our record of each backup, restore test and update of the Workspace: its short name, times, counts and, for a failure, the reason in words. It is built never to hold the Workspace's data or the names of its stored files;
• a record of each command our tools run with a key to the Workspace (for example a backup, a restore or an update), written before the key is used (since 30 September 2026): which tool, which Workspace, which kinds of key, what for, and the computer account that ran it, never the key and never the Workspace's data. A use of a key by hand is written in our access log book. Our control console's own automatic checks of each Workspace are not listed one by one. Clause 5.3 of our Data Processing Agreement says more;
• a record of each time someone at MVV was shown a view of a Workspace's data in our control console: who, which Workspace, which view and when, never the data itself. A second look at the same view within 5 minutes adds no new line;
• for a paying customer, when its company details were last changed in its Workspace and which of them; when its VAT number there stopped being one; the old and the new of the latest change to its registered name and company number, and of each change made in the last day to its registered office, invoice email and website (all in full) and VAT number (its last three digits), never who changed them; and when someone in its Workspace last asked us to change the bank details its invoices print, never who, never a number;
• for a paying customer, the payments we recorded, which we set against what its Workspace costs us to run. Where Stripe took the payment, this is the one Stripe recorded, without its VAT;
• when sign-up opens: Stripe's record of each order, subscription, payment, refund and card dispute, by Stripe's own reference numbers, amounts, dates and statuses (for a dispute, Stripe's words for its status and reason; for a payment for more AI made through our payment link, also the name of the Workspace it was made for and the link's own reference), never the buyer's name, contact details, address, VAT number or card; on our own computer, our record of each payment for more AI and of what we did with it (the AI we added for it, or why we added none, who at MVV did it and when); and, for a payment that failed, the case we keep on it: when it failed, when the Workspace was told, reminded and suspended, and, if it came to it, our termination for non-payment and the day it took effect.

Most of these are counts and measurements about a Workspace. In a Workspace with only one or two office staff, some of them, such as the time of the latest office-staff sign-in, can relate to a person.

MVV ID, our phone app's way to find a person's company. Each hour the Workspace sends us the list of its people's sign-in email addresses, and we keep only a keyed fingerprint of each, with its first character and domain, never the address. We process that list for the customer, as its processor (see clause 5.2 of our Data Processing Agreement). When someone types an email address into our phone app, we use it only to find a match and send them a sign-in code, and we keep a record of the request with keyed fingerprints of the address and of the network address it came from, never the values themselves. We can also record a company's email domain as its own, so that our phone app never offers another company's Workspace to that domain.

Operational alerts. When our control console finds a problem, it emails MVV support, naming the Workspace (the customer's company name) and the problem. The problems are:

• the Workspace not answering; its outgoing calls failing; its server errors well above its own normal; its email pushing against its limits; its people sent a lot of phone-app sign-in codes; its AI stopped at its daily limit of AI calls, or at its daily limit of AI spend;
• no good backup for 26 hours or more; a failed restore test; its newest backup holding its data but not its stored files; a paying customer's company details missing from the Workspace's newest backup, or not the version we recorded;
• its backup key, or the key that locks the passwords of the services it is connected to, not yet in our safe keeping, or the file of that second key lost or damaged on our computer;
• an update or a set-up stopped part way; a serious security finding reported by its host;
• a paying customer's VAT number cleared in its Workspace; a request made in a paying customer's Workspace to change the bank details its invoices print (when it was made, never who made it, never a number);
• when sign-up opens: a termination for non-payment we may now give (with the amount still unpaid and its invoice number); a termination whose notice has run out; a step in the chase of a failed payment our console could not take; a paying customer's subscription that Stripe may still end after it paid; a change our console asked Stripe for that did not go through; and a card payment the customer disputed with its bank, while the dispute is open or after it was lost.

The console also emails MVV support, for its information, each change a paying customer makes in its Workspace to its registered name or company number (the alert stands while the change is not yet checked against the public register), to its VAT number, and to the registered office, email or website its invoices print, with the old and the new. These are shown in full, except the VAT number, of which only the last three digits are shown. A further change is emailed at most once an hour. It also tells MVV support, once, that the contact person or phone our account team calls was changed in a paying customer's Workspace, and when, never who changed it, never the name or the number. That alert stands until MVV support has confirmed the change with the customer on a call.

Every Monday the console emails MVV support a short summary of the week before: each Workspace's health, backups and updates, the alerts raised and cleared, its AI use against its allowance, and the Workspaces that joined or left.

Some alerts name no Workspace: our sign-up page under unusual load or probing; our master backup key missing, or not the one we expect; and our own record files differing from our control database.

The console keeps a record of what it sent on our own computer: the Workspace's name, the problem and, for the changes to company details, the old and new values shown, which can include an email address, but never the address the alerts go to. Where a customer trades under a person's name, or its invoice email names a person, that is personal data.

3.3 When you contact us, or we write to you

Your name, email address, and what you tell us. Email sent to our addresses, such as sales@mvvtechnologies.com, support@mvvtechnologies.com and privacy@mvvtechnologies.com, arrives in the mailbox described in section 5.

We send welcome emails from sales@mvvtechnologies.com, with a link to set a password. The link works once, and for 15 minutes. A paying customer's welcome is not sent without that link. For a welcome sent after an online order, we keep a note of when it was sent and a hint of the address (its first letter and its domain).

When sign-up opens, the sign-up page's email code goes from notifications@mvvtechnologies.com, as MVV Technologies, to the one address typed, and is copied to nobody.

3.4 When you reply to one of our automatic addresses

These are no-reply@mvvtechnologies.com and notifications@mvvtechnologies.com. We do not keep or forward your message. We send one automatic answer a day, and keep your email address and the date for 25 hours so that we do not answer twice. The automatic reply service runs at Cloudflare, whose logs of it can also hold the sender's address for a few days.

3.5 Our web pages

Our sign-up page (signup.mvvtechnologies.com, when sign-up opens). It collects only what the form asks for (3.1). It loads Cloudflare Turnstile, which checks that the visitor is a person from the browser's signals and IP address. It keeps what you typed in your browser tab's session storage until you go to pay, the sign-up is stopped or started again, or the tab is closed, so that a reload carries on, and sends it nowhere but our sign-up service (see our Cookie Notice). It sets no cookies of its own. Netlify serves the page. What you send on it goes to our sign-up service through our gateway address (gw.mvvtechnologies.com) at Cloudflare. Each of them sees your IP address when your browser contacts it. Cloudflare also counts the requests each network address sends to our sign-up service, and blocks an address for a short time when it sends too many. Paying happens on Stripe's own page.

Your invitation page (signup.mvvtechnologies.com/invite.html, opened from the link in our invitation email). It keeps that link in your browser tab's session storage until you have finished, the link stops working or the tab is closed, so that Stripe can send you back to the right step, and sends it nowhere but our sign-up service (see our Cookie Notice). It does not load Cloudflare Turnstile and sets no cookies of its own. Netlify serves the page, and what it sends goes to our sign-up service through our gateway address (gw.mvvtechnologies.com) at Cloudflare; each of them sees your IP address when your browser contacts it. Paying, and setting up the Direct Debit, happen on Stripe's own pages.

Our "I'd like to join" page (signup.mvvtechnologies.com/join.html, from the day it opens). It collects only what its form asks for (3.1). If you arrive through a sales agent's link, the agent's code is in the page's address and is sent with your request. It loads Cloudflare Turnstile, which checks that the visitor is a person from the browser's signals and IP address. It keeps nothing in your browser and sets no cookies of its own (see our Cookie Notice). Netlify serves the page. What you send on it goes to our sign-up service at Supabase through our gateway address (gw.mvvtechnologies.com) at Cloudflare, and is sealed there so that only our own computer can read it. Each of them sees your IP address when your browser contacts it. Cloudflare also counts the requests each network address sends to our sign-up service, and blocks an address for a short time when it sends too many.

Our status page (status.mvvtechnologies.com) shows whether the main parts of the service (sign-in, the app, AI features, email and backups) are working. It names no customer. It sets no cookies of its own and stores nothing on your device. Cloudflare serves it, and sees your IP address when your browser asks for it.

Our help pages (help.mvvtechnologies.com) publish how to reach support and these documents. They run no script, set no cookies of their own and store nothing on your device. Netlify serves them, and sees your IP address when your browser asks for a page.

Our main website (mvvtechnologies.com, which forwards to mvvtech.solutions). It runs on the systems of an affiliated business: Netlify serves it from that business's account, and what you send on its contact form is received and stored in that business's database at Supabase. When a page opens, your browser also asks that database whether to show the cookie banner, so it sees your IP address. It loads Google Analytics only if you press "Accept" on its cookie banner; until then no analytics cookie is set. If you accept, Google receives your IP address and details of how you use the site, and we see visit statistics (see our Cookie Notice, section 11). Its contact form collects the details it asks for, the page you sent it from and, whether or not you accepted cookies, the first page you opened on the site, the site you came from (if another site sent you there) and any campaign codes in the address you arrived by; only if you accepted are these also kept in your browser (see our Cookie Notice, section 11). We use them to reply to you and to follow up your enquiry; we also use the details of how you reached us (the pages, the site you came from and any campaign codes) to count which sites, campaigns and pages bring us enquiries.

No analytics or tracking is installed in the MVV App, on the sign-up page, on the "I'd like to join" page, on the status page or on the help pages. Our main website uses Google Analytics only with your consent, as above.

3.6 Our sales agents

We work with independent sales agents who introduce businesses to us, and pay them a commission. For each agent we keep their name, email address, phone number and, if they trade through a company, its name, in a private file on our own computer, never in our control database. Our control database keeps a code for each agent, their market and currency, whether they are active, the commission rule agreed and from when, which team they belong to, the customers they introduced (by the Workspace's name and our order reference, with a keyed fingerprint of the company number, never the number itself) and each month's commission lines and statement totals. We send each agent a monthly commission statement, by email from sales@mvvtechnologies.com, and keep a copy of each statement, and a record of when we sent it, on our own computer. If a sales agent introduced your company, that agent's statement shows your company's trading name, your plan, and the subscription payments we received from your company, with their dates, invoice numbers and amounts excluding VAT, and any refund within 90 days of a payment. If the agent works in a team, the team's manager sees on their own statement the names and codes of the agents in their team and, for each, the trading names of the customers they introduced and the subscription payments the manager's team bonus is based on, with their dates, invoice numbers and amounts excluding VAT, and any refund within 90 days of a payment. We keep an agent's details, their statements and the record of when we sent them for as long as we work together, and erase them 6 years after their last statement. What stays longer is only our control database's record of the commission (codes, sums, invoice numbers and fingerprints, never a name, email address or phone number): it is kept for 7 years, then deleted in our yearly delete.

Agents sign in to their own page on our agents' site, agents.mvvtechnologies.com, with their email address, a password and a code from an authenticator app. We send each agent a one-time link to set up their sign-in, by email from sales@mvvtechnologies.com, valid for 72 hours; our control database keeps only a fingerprint of the link. On the site we keep the agent's email address only as a keyed fingerprint, their password only as a salted hash, and their authenticator secret encrypted, all erased when the agent stops working with us; their name and contact details stay on our own computer. The site greets an agent by their code, never by name. For each sign-in session our control database keeps a keyed fingerprint of the network address it came from, until 30 days after the session ends; to limit sign-in attempts and the number of changes an agent can make in a day, it keeps keyed fingerprints of network addresses and of the agent's account for two days. Our audit log records each agent's sign-ins and the contacts they record, by the agent's code. Each agent's figures (their clients by month, their commission so far and their statements) are worked out on our own computer and kept in our control database for the site to show, with the names of their clients encrypted; they are replaced as they change.

3.7 Contacts our sales agents record

Our sales agents use our agents' site (agents.mvvtechnologies.com) to record the businesses they contact for us. Some of our own staff who also introduce businesses to us record theirs in our control console, in the same way.

Contacts our sales agents record. For each business an agent contacts about MVV, the agent records the company's name and register number, the first and last name, role, work email and phone number of the person they spoke to, and short notes (up to 500 characters) of their calls, emails, meetings and demonstrations, with their dates. We keep the company's name and number, the person's details and the notes in our control database only in encrypted form, with a key that our agents' service and our own computer hold and the database does not. Our control database also keeps, in clear, a keyed fingerprint of the company number, the agent's code, the dates and kinds of each contact, any demonstration time, and how the contact ended. The agent who recorded a contact can read it; so can the MVV staff who manage our sales agents (each time they open a person's details, we record that they did), and the owner of MVV when inviting that business to join. If we move a contact to another agent, that agent can read it from then on, and the first agent for up to 30 days after the move. We use these details so that agents can follow up, so that two agents never approach the same business, and so that the right agent is paid if the business joins. A contact ends when the agent lets it go, 60 days after its last recorded activity, when we let it go or move it, when the business joins, or when we learn that we were already in touch with the business first. We erase the person's details and the notes about 30 days after the contact ends (our control console does this every hour while our computer is on, and our control database also does it the next time anyone records that business). If the business joins, the person's details we need become the invitation's details (3.1) and the contact's own copy is erased about 30 days after, as above. We erase the company's name and number with the person's details for a business that did not join; for a business that joined we keep them while the agent earns on it, and erase them 6 years after the later of the contact's end and the agent's last commission on it. The fingerprint of the company number, the agent's code, the dates and the outcomes are not personal details on their own, and we keep them for 7 years after the contact ends, then delete them in our yearly delete, so that a business is never claimed twice.

When the person asks. Anyone whose details an agent recorded can ask us at privacy@mvvtechnologies.com for a copy, for a correction, or to be erased, and can object to being contacted by our agents. We find the contact by the company's name or number. When you ask to be erased, or object, we end the contact at once and erase your details and the notes straight away (not after 30 days), and the company's name and number too if the business did not join; we then keep only the fingerprint of the company number with a note that we must not contact it through our agents again, so that no agent can record it again. If an agent contacts you again after that, tell us.

Businesses we already knew. When we invite a business, or a business asks to join on our "I'd like to join" page, or we were in touch with it ourselves first, we keep a keyed fingerprint of its company number with the date of that first contact, so that an agent cannot later claim it. A contact an agent records after that date does not make the business theirs. When MVV staff let a contact go, move it, or mark a business as one that came to us directly, they give a short reason, which the agent sees and which we keep with the contact's record; our staff are told not to name a person in it.

3.8 Signing the agent agreement

Signing the agent agreement. Before a sales agent can use our agents' site, they sign our agent agreement there. They read the whole agreement, type their full name, draw their signature on the screen, tick to say they have read and agree to that version and, unless we have recorded that they are not established in Italy, tick a second, separate box to approve specifically the clauses listed in Schedule 3 (articles 1341 and 1342 of the Italian Civil Code); and they take or upload a selfie holding their photo ID (a passport, a driving licence or a national identity card), so that we can show later who signed. When they sign, our agents' service records the evidence of the signing: the agreement's version and a fingerprint (sha256) of its text, the date and time, the agent's code, a keyed fingerprint of the email address they signed in with, a fingerprint of their sign-in session, the network (IP) address the request came from, their browser's description of itself (its user agent and preferred languages), what their browser reports of its screen size, platform and time zone, and fingerprints of the selfie, the signature and the typed name; and, for the second tick, that it was given, the schedule it approved, a fingerprint (sha256) of that schedule's text, and whether our records showed the agent as established in Italy.

Where it is kept. Our agents' service does not keep the selfie, the signature, the typed name or the evidence: it seals them at once with a public key whose private half is only on our own computer, so that only our own computer can open them. Our control database holds that sealed copy only until our own computer collects it (usually within minutes, and never more than 14 days; a copy not collected in time is erased and the agent is asked to sign again), and otherwise keeps only the agent's code, the agreement's version, the date and time of signing and the fingerprints above, none of which shows the selfie, the signature or the name. On our own computer, whose disk is encrypted, we keep the signed agreement as a PDF (the full text, the typed name, the drawn signature and the selfie, with a page of the evidence), and the selfie, the signature and the evidence on their own. Only our staff with full access to our sales agents can download a signed agreement or look at a selfie, and each time they do, we record that they did. A copy they download stays on their own computer, outside our 6-year erasure, so they delete it as soon as it has served its purpose.

What we use it for. We use the signed agreement, the selfie and the evidence only to show, if it is ever questioned, that the agent signed that version of the agent agreement and when, and to enforce the agreement. We do not use the selfie for face matching, face recognition or any other biometric processing: a person at MVV looks at it only if a signature is questioned. We ask for no more than we need: the photo ID needs to show the agent's photo and name, and the agent may cover its number and other details.

How long we keep it. We keep the signed agent agreement, the selfie, the signature and the evidence for 6 years after the agent agreement ends (when the agent stops working with us), so that we can answer any claim about it; then our own computer erases them, and our control database erases its record of the signing in its yearly delete. Copies in our encrypted backups go when each backup is replaced.

Your rights. An agent can ask us at privacy@mvvtechnologies.com for a copy of their signed agreement and of what we recorded when they signed. While their account is open and not paused, they can see on our agents' site which version of the agent agreement they signed, and when.

3.9 WhatsApp through our shared number

When WhatsApp is switched on for a customer's Workspace, the messages between that company's people and our one shared WhatsApp number are handled for the customer, under our Data Processing Agreement. For our own records we keep a keyed fingerprint of each linked phone number, its last three digits and the company it is linked to; the register of each person's yes, no and STOP to each company (as a keyed fingerprint of the number); and a record of each message sent and of each routing decision and "which company?" question, without its content. If someone writes to our WhatsApp number from a number that is linked to no company, we log that it happened, without its content, and pass the message to no company. We may answer automatically: if a company has asked to link that number, with a message they can tap to link; if the person earlier said no or STOP, with a way to undo it; otherwise, at most once a day, that the number is not linked to a company.

3.10 Demonstration workspaces

When we set up a demonstration workspace for someone, we create its owner's sign-in. A password we create for the owner of a demonstration workspace is kept on our own computer only until their first sign-in, and never more than 7 days after we hand it over; then it is deleted. A paying customer's owner chooses their own password through a one-time link, and we never hold it.

4. Why we use it, and our lawful basis

We do not sell personal information.

We make no decision that has a legal or similarly significant effect on a person by automated means alone. Our sign-up page does check by itself that a visitor is a person and that the email address is not at a free mailbox. Our "I'd like to join" page checks by itself only that a visitor is a person. If it turns you away and you think it is wrong, contact us at support@mvvtechnologies.com and a person will look at it. Whether the company is an active UK limited company is checked by MVV support, by hand, before we build the Workspace.

5. Who we share it with

Providers and services we use for our own business:

• Supabase: our control database, in London, and our server functions. These carry sign-ups and the requests sent from our "I'd like to join" page (sealed before they are stored), our phone app's sign-in codes and Stripe's messages about our billing, and they run our agents' service, our AI gateway, which carries our staff's Ask Control questions to OpenAI, and the router of our shared WhatsApp number, which writes the records described in 3.9 to our control database. The agents' service signs our sales agents in on our agents' site, seals and opens the contacts they record, and seals each signed agent agreement for our own computer (it cannot open it), holding the sealed copy in our control database until our computer collects it; it handles all of this only in memory, and keeps nothing itself. Until we switch Stripe to real payments for the opening of sign-up, the Stripe function takes only Stripe's test messages, which concern no customer. These functions pass information through and keep only what this policy says our control database records. They are not pinned to one region, so Supabase may run them outside London. A fallback copy of most of our control database is kept on our own computer.
• Cloudflare: email routing for our addresses; the automatic reply service for our no-reply addresses; our status page; our gateway address, which carries what the sign-up page and the "I'd like to join" page send, and everything our agents' site sends and receives, including the details of the contacts agents record and, when an agent signs the agent agreement, the selfie, the signature and the name, while they travel, our staff's Ask Control questions on their way to OpenAI, and the WhatsApp messages Meta delivers to our shared number, and which limits how many requests one network address can make; and Cloudflare Turnstile, the check that the visitor is a person, on the "I'd like to join" page from the day it opens, and on the sign-up page when sign-up opens.
• Google (Google Workspace): mail sent to our own human addresses (for example sales@, support@, privacy@ and info@) is forwarded to a mailbox on an affiliated business's domain, run on Google Workspace. So that mailbox, and Google as its host, receive every email you send us. The operational alerts and weekly summaries in 3.2, and the emails about support and cancellation requests, go to the same mailbox. That business has accepted Google's Cloud Data Processing Addendum for its Google Workspace account, naming the UK Information Commissioner as the supervisory authority.
• Google (Google Analytics): counts visits to our main website, only if you accept its cookies.
• An affiliated business, on whose systems our website's enquiries are received: it runs our main website (mvvtech.solutions, served by Netlify from its account) and receives what you send on the contact form in its own Supabase project.
• Resend: the emails we send, including invitation emails and Direct Debit reminders, welcome emails, the sign-up page's email codes and the phone app's sign-in codes; the operational alerts, weekly summaries and emails about support and cancellation requests in 3.2, which go from notifications@mvvtechnologies.com; and, from sales@mvvtechnologies.com, the monthly commission statements we send our sales agents and the one-time links that set up their sign-in.
• OpenAI: answers the questions our own staff type to Ask Control, the assistant in our control console. Each request holds the question, excerpts from our own staff manual and short readings built from Workspace short names, ids, kinds, counts and dates, never a person's name or free text from a Workspace.
• Anthropic: the AI coding assistant with which we operate our systems on our own computer (section 8). What it is asked to work on, which can include the records this policy describes, is sent to Anthropic.
• Meta (WhatsApp Business Platform): carries WhatsApp messages to and from our one shared WhatsApp number (3.9).
• Netlify: serves our help pages and our sign-up site, which carries the invitation pages and the "I'd like to join" page, and our agents' site (agents.mvvtechnologies.com).
• GitHub: our private source code. It holds the set-up details of our own demonstration Workspaces only. A customer's company details and account owner are not kept there.
• Companies House: receives the company number we look up on its public register, by hand: before we build a Workspace ordered on our sign-up page, and when a paying customer changes its registered name or company number.

Our Resend account and our Cloudflare account are shared with an affiliated business.

Payment provider. Stripe takes card payments, and sets up and collects Bacs Direct Debits, on its own pages, runs the subscription, and emails the invoices and receipts. It also takes the payments for more AI made from the "Buy more AI" button in a Workspace, which tells Stripe the Workspace's name, so that we know which Workspace the AI is for. Stripe holds the buyer's email, billing address, VAT number if given, and card and, once a Direct Debit is set up, the bank account and the Direct Debit mandate. With an invitation it holds only our order reference and the Workspace's name. With an order made on our public sign-up form, if we open it, it also holds the company's registered name, number and office, its trading name, the account owner's name and role, the Workspace's name and, if given, the contact person's name and phone. Our control database keeps only Stripe's reference numbers, amounts, dates and statuses and, for a payment for more AI, the Workspace's name and our payment link's reference. Stripe also uses what it holds under its own privacy notice.

Others:

• Professional advisers (accountants, lawyers, insurers), under a duty of confidentiality.
• Authorities, where the law requires.
• A buyer of our business, if it is sold, under the same protections.
• Our sales agents: each agent sees only the contacts they recorded themselves (3.7) and, on their monthly statement, the trading name and plan of each customer they introduced and the payments and refunds their commission is based on (3.6); that agent's team manager sees on their own statement the trading name of each such customer and the payments their own team bonus is based on. An agent never sees a request to join.
• Our staff: only our staff with full access to our sales agents can open a signed agent agreement or look at a selfie, and each look is recorded.

6. Transfers outside the UK

Our control database is in London. Our control console, the private folder of customers' company details, and the private files of requests to join, of our sales agents' details and of their statements, are on our own computer in England.

Some of the providers in section 5 are international businesses, most of them based in the United States, and may store or process information outside the UK:

• Supabase may run our server functions outside the UK, because they are not pinned to one region. This includes our agents' service, which handles the contacts our sales agents record while it seals and opens them; they are stored only in our control database in London. When an agent signs the agent agreement, our agents' service seals what they send before it is stored; it is stored, sealed, only in our control database in London until our own computer in the UK collects it. Our control database itself is in London.
• Cloudflare, Netlify, Stripe and Google run international networks and may process information in other countries where they operate.
• Resend and GitHub: our own research in September 2026 recorded that they store information in the United States.
• OpenAI and Anthropic decide where they process what we send them, which may be in the United States or elsewhere; Anthropic says it stores data in the United States.
• Meta decides where WhatsApp messages are stored; we set no region.
• What you send on our main website's contact form is stored in an affiliated business's Supabase project; we have not yet confirmed its region.

We use each of these providers under its own terms, which include its data protection terms. We have not yet finished confirming, provider by provider, which legal safeguard covers each transfer (for example the contract clauses approved for transfers from the UK, or UK adequacy regulations). If you want to know what applies to a provider, ask us at privacy@mvvtechnologies.com and we will tell you what we hold.

7. How long we keep it

"Kept for 7 years" below means that no account our software uses can delete the record, and most of these records cannot be edited either, so that each stays a reliable account of what we did. Those marked "updated as it changes" have their status updated in place. Once a year we delete, with our database's owner account, the records whose 7 years have passed (our "yearly delete"), unless one is needed for a legal claim or the law requires us to keep it. Only that owner account could remove these protections.

8. How we protect it

Our control console runs only on our own computer, at our premises in England, and is not reachable from the internet. Our staff roles are enforced by the server, staff can use two-step sign-in, and every change is recorded in an audit log that no account our software uses can edit or delete. Keys and passwords are kept in files on our own computer, on an encrypted disk. Our control database holds none of the business data inside a customer's Workspace.

We operate our systems with the help of an AI coding assistant, which acts only on our instructions. Its supplier, Anthropic, is named in our Sub-processor list (A4).

The contacts our sales agents record are encrypted before they reach our control database, with a key held as a secret by our agents' service, in a cloud project of its own, and on our own computer, never by the database. Agents sign in with a password and a code from an authenticator app; a session ends after 12 hours, or 30 minutes without use; and an account is held after repeated wrong codes until we release it.

A signed agent agreement is sealed for our own computer before it is stored anywhere: our cloud services and our control database cannot open it, and the key that can is kept only on our own computer. Our logs and audit records name a signature only by its reference and the agent's code, never by a name, an address or an image.

9. Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, and to data portability. Where we rely on legitimate interests you can object at any time, and you can always object to marketing.

To use a right, contact us at privacy@mvvtechnologies.com. We will reply within one month.

Some of our records cannot be deleted by our software once they are written, and most of those cannot be edited either; section 7 says which, and when our yearly delete removes them. They hold very little about people: mostly Workspace names, dates, amounts, the names of our own staff and the name and role of the person who accepted our terms for a customer. If you ask us to correct or delete something held in one of them, we will tell you what we can and cannot do.

10. Complaints

If you are unhappy with how we have used your information, please tell us first at privacy@mvvtechnologies.com. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.

You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.

11. Cookies

See our Cookie Notice.

12. Changes

We will update this policy when what we do changes, and date each version.

Version: 13 October 2026.