Privacy Policy
Mavlon Inc. is a company registered in Delaware, in the United States. We make the AI Quoting Engine, which reads a bid package and prepares a first draft of the quote for an estimator to check. This page explains what information we collect, why we collect it, who we share it with, and what you can ask us to do with it.
The short version
- We do not sell personal information, and this website has no advertising cookies.
- The documents a customer sends us are used only for that customer's work. We do not use them to train AI models.
- This website counts visits, records how pages are used, and has a chat window. The section on cookies and analytics explains how you can limit this.
- You can ask for a copy of your information, ask us to correct it, or ask us to delete it. Write to atishay@mavlon.co.
Who this policy is for
This policy covers three groups of people.
- People who visit mavlon.co.
- People who write to us, book a demo, join the newsletter, or receive an email from us about our product.
- People who use the AI Quoting Engine at one of our customers, and people whose names appear in the documents a customer sends us.
If your company is a Mavlon customer, your company decides which documents go into the engine. Its signed agreement with us controls how we handle them. Where that agreement says something different from this page, the agreement applies.
What we collect
When you visit this website
| What | What it contains |
|---|---|
| Visit data | The pages you open, the buttons you press, how far you scroll, and the website that sent you here. It also includes your browser, your device type and your IP address. The IP address tells us your country and city. |
| Session recordings | A replay of how a page was used: where the mouse moved, what was clicked and how the page scrolled. Anything typed into a form field is hidden in the replay. The replay also keeps the error messages the page produced. |
| Company name | We look up the public owner of an IP address to see which company a visit came from. The result is the name of a company or of an internet provider. It does not tell us who you are. |
When you contact us
| What | What it contains |
|---|---|
| Demo form | The work email you type, the page you were on and the button you pressed. The form also records what you typed if it does not accept the address, or if you close the form before you send it. You then pick a time on Calendly, which collects your name, your email and anything you write in its form. |
| Newsletter | Your email address and the page where you signed up. |
| Chat | The messages you send, your name and email if you give them, your IP address, your browser and the pages you had open. |
| Email and calls | The emails you send us and our notes from calls. If we want to record or transcribe a call, we ask you first. |
When we find your details ourselves
We sometimes write to people at manufacturers who may have a use for our product. To do that we collect business contact details: a name, a job title, a company and a work email. We take them from public places such as company websites, LinkedIn, trade directories, job postings and public bid records. You can stop these emails at any time by replying, and we will not write to you again.
Our public bid data pages repeat government records, and those records name the companies that bid on public work. If a record names you personally and you want it removed, write to us.
When your company uses the AI Quoting Engine
| What | What it contains |
|---|---|
| Account details | Your name, work email, company and role, and a record of when you signed in. |
| Customer documents | Bid packages (the drawings, the specifications, the addenda and the bid forms), and your company's own past quotes, price lists and cost sheets. |
| What the engine produces | The draft quote, the list of requirements with the page each one came from, the questions it raises, and the changes your estimators make. |
| Activity and security logs | Who opened or changed what, error reports, and the IP address that was used. |
| Billing records | Invoices, and the name and email of the billing contact. If a payment is made by card, the card details go to the payment provider, and we never see the full card number. |
These documents are mostly business information. They also contain some personal information, such as the names, signatures, professional stamps and contact details of the engineers, buyers and estimators who prepared them.
The same rules cover our drawing inspection product, where the documents are technical drawings and the inspection records made from them.
Please do not send us personal information that the work does not need. Please do not send export-controlled or classified information, such as ITAR technical data or Controlled Unclassified Information, to our hosted service unless we have agreed in writing how it will be handled.
Why we use it
European and UK law asks a company to name a legal reason for each use of personal information. The right-hand column gives ours in plain words.
| Purpose | What we use | Our legal reason |
|---|---|---|
| To do the work a customer asked for | Account details, customer documents, results and logs. We read the documents, prepare the draft quote, run user accounts and give support. | Our contract with the customer. For the documents themselves, we act on the customer's instructions. |
| To keep the service secure | Logs and account details. We use them to find faults and to stop misuse. | Our legitimate interest in running a safe service that works. |
| To answer you and arrange a demo | The demo form, chat messages, emails and call notes. | Your own request, and our legitimate interest in answering it. |
| To send the newsletter | Your email address. | Your consent. You can unsubscribe with one click in any issue. |
| To improve this website | Visit data, session recordings and the company name. | Our legitimate interest in knowing which pages are useful. You can object, and the section on cookies and analytics explains how. |
| To tell manufacturers about our product | Business contact details. | Our legitimate interest in finding customers. You can object at any time, and we stop. |
| To keep records the law requires | Billing records, and other records when an authority lawfully asks for them. | A legal duty. |
A legitimate interest is a fair business reason that does not override your own rights.
We do not make decisions about people by computer alone. The AI Quoting Engine reads business documents and prepares a draft. An estimator at the customer checks that draft and decides what to send.
Customer documents and AI
Your documents are used only for your work. We do not use a customer's documents, prices, corrections or results to train or fine-tune any AI model. That is true for our own models and for anyone else's.
Nothing moves from one customer to another. When we set up the engine for a customer, we use that customer's own past quotes and cost sheets, so that it prices the way that customer prices. We never show, copy or reuse one customer's documents, prices or rates in another customer's work.
AI providers cannot train on your documents. The engine sends parts of a document to an AI model so that the model can read it. We use the business services of commercial AI providers, under contracts that forbid them from training their models on what we send.
Your agreement says where the documents are kept. The hosting region is written in the agreement. A customer that needs more control can run the engine in its own cloud account or on its own servers, if we agree this together.
A person checks the result. Everything the engine produces is a draft until your estimator has checked it.
We work on your behalf. For these documents the customer stays in charge, and Mavlon handles them only on the customer's instructions. Privacy law calls the customer the "controller" and Mavlon the "processor". We sign a data processing agreement with any customer that needs one.
Who we share it with
We do not sell personal information, and we do not share it with anyone for advertising. We have not done either in the past twelve months.
We use the companies below to run this website and to talk to you. Each one receives only what it needs for its job.
| Company | What it does for us | What it receives |
|---|---|---|
| PostHog | It counts visits and makes the session recordings. Its servers for our account are in the United States. | Visit data and session recordings. It also receives your email address once you type it into the demo form. |
| Google Analytics | It counts visits. We have switched off its advertising features. | Visit data. |
| Tawk.to | It runs the chat window. | Chat messages, your IP address, your browser and the pages you had open. |
| Calendly | It books the demo. | Your name, your email and the time you choose. |
| YouTube | It plays the videos on our pages. We use the player that Google calls privacy-enhanced mode. | Your IP address and browser, when a page shows a video and when you press play. |
| Netlify and Cloudflare | They host this website and deliver it to your browser. | Your IP address and the pages you request, in their server logs. |
| Zoho and Google Workspace | They carry our email. | The emails you send us and the emails we send you. |
The demo form and the newsletter form send your email address to our own server, and we store it in our own database.
For the AI Quoting Engine we use providers for hosting, for the database, for error reports and for AI models. A customer can ask us at any time for the current list of providers that handle its documents.
We may also share information in three other cases. We share it with our lawyers and accountants when they need it for their work. We share it with a court or an authority when the law requires it. We would share it with a buyer if Mavlon were sold or merged, and we would tell customers before their information moved.
How long we keep it
| What | How long |
|---|---|
| Session recordings | For 30 days. They are then deleted automatically. |
| Visit data | For as long as it is useful for comparing one year with the next. We delete yours sooner if you ask. |
| Demo requests, chat messages and emails | For as long as we are in contact with you. We delete them when you ask. |
| Newsletter list | Until you unsubscribe. |
| Contact details we found ourselves | Until you tell us to stop, or until the details are out of date. After that we keep only your address on a list of people we must not write to. |
| Customer documents and results | For the length of the customer's agreement. When the agreement ends, or when we receive a verified request to delete, we delete them from our active systems within 30 days. Encrypted backup copies expire on their normal schedule. |
| Documents sent for a trial | We delete them from our active systems within 7 days after the trial work is finished, unless the trial becomes a paid service or you ask us to delete them sooner. |
| Billing and tax records | For as long as tax and accounting law requires. |
If the engine runs in a customer's own cloud account or on its own servers, the customer controls how long the documents are kept.
Where your information is processed
Mavlon is a company in the United States. Most of our providers keep their servers in the United States or in the European Union, and members of our team may work from other countries. So your information may be handled outside the country where you live, in a place whose privacy law differs from yours.
When personal information leaves the European Economic Area, the United Kingdom or Switzerland, we rely on a legal safeguard for that transfer. The safeguard is usually the standard contractual clauses approved by the European Commission, or the provider's certification under the EU-U.S. Data Privacy Framework.
The hosting region for a customer's documents is written in that customer's agreement.
Your rights
You have these rights wherever you live. We do not ask where you are from before we honour them.
- You can ask what personal information we hold about you, and you can get a copy of it.
- You can ask us to correct information that is wrong.
- You can ask us to delete your information.
- You can ask us to stop using it for one purpose, such as analytics or sales emails, or to limit how we use it.
- You can take back a consent you gave, for example by unsubscribing from the newsletter.
- You can ask for your information in a format that another service can read.
To use any of these rights, write to atishay@mavlon.co. We may ask a question or two to make sure that the request really comes from you. We answer within 30 days, and we never treat you worse for using a right.
If we refuse a request, we tell you why, and you can ask us to look at it again. You can also complain to the privacy regulator where you live. In the European Union, the United Kingdom and Switzerland that is your national data protection authority. In the United States it is usually the attorney general of your state.
If you live in California or another US state with a privacy law
These laws give you the rights listed above. They also let you opt out of the sale of your information and of targeted advertising. We do neither, so there is nothing to opt out of. The section "What we collect" lists the kinds of information we have collected in the past twelve months, and the section "Who we share it with" lists who received it.
If your details are inside a customer's document
If your information is in a document that your employer or another company sent to us as a customer, please ask that company first. It is in charge of the document, and we will help it answer you.
Security
We encrypt customer documents while they travel and while they are stored. Access is limited to the people who need it for their job, and access to our production systems is logged. The security page has the details.
No system is perfectly safe. If a security incident affects your personal information, we tell the affected customers, the affected people and the regulators within the time that the law and our agreements set.
Children
This website and the AI Quoting Engine are made for people at work. They are not meant for children, and we do not knowingly collect information from anyone under 18.
Changes to this policy
We update this page when our product or the law changes, and the date at the top always shows the latest version. If a change is important, we also tell our customers by email.
Contact
Mavlon Inc. is responsible for the personal information described on this page. For a privacy question or request, or for a copy of our data processing agreement or our list of providers, write to atishay@mavlon.co.
Last updated: October 13, 2026.