Privacy Policy

Scope of This Policy

Mavlon helps manufacturers and quality teams analyze technical drawings, identify and interpret inspection characteristics, create ballooned drawings, and prepare first article inspection records for human review. This Policy applies to information processed through our website, trials, hosted platform, customer-controlled cloud deployments, and support interactions.

A customer agreement, order form, or Data Processing Agreement ("DPA") may provide additional terms for a particular deployment. If those terms conflict with this Policy, the signed agreement controls for that customer.

Information We Collect

• Account and business information: name, work email, company, role, authentication records, and account preferences.
• Customer content: technical drawings, specifications, title blocks, notes, inspection requirements, part metadata, related documents, and the ballooned drawings or inspection records produced through the Services.
• Service and device data: IP address, browser and device information, timestamps, audit events, feature usage, diagnostic logs, and security events.
• Commercial and support data: subscription and billing records, customer requests, communications, and feedback. Payment card details, when required, are processed by our payment provider and are not stored by Mavlon in full.

Customers should not upload personal information or controlled data that is not necessary for the requested analysis. The customer is responsible for confirming that it has authority to provide all customer content submitted to the Services.

How We Use Information

We process information only as needed to:

• provide, secure, operate, and support the Services;
• process drawings and generate requested analysis and outputs;
• authenticate users and maintain account and audit records;
• diagnose errors, monitor performance, and prevent misuse;
• manage subscriptions, customer relationships, and support;
• send service notices and, where permitted, product communications;
• comply with law and enforce our agreements; and
• analyze aggregated usage metrics that do not contain drawing content or identify an individual customer.

No Training on Customer Drawings

Mavlon does not use customer drawings, specifications, related documents, prompts, extracted characteristics, corrections, or outputs to train, fine-tune, or improve Mavlon models or any third-party general-purpose model. Customer content is processed only to provide the requested Services, maintain security, and meet contractual or legal obligations.

Where a commercial AI model provider is used for inference, Mavlon uses business or API services covered by contractual data-protection terms, including a DPA or equivalent protections, and configures the service so submitted customer content is not used for provider model training. Mavlon also supports approved open-source model configurations for customers that require them.

Deployment, Data Residency, and Security

Customer content is stored in the deployment location selected by the customer and documented in the applicable order form or agreement. Depending on the selected plan and technical requirements, options may include a customer-selected Mavlon-managed cloud region, a customer-controlled cloud environment, or an on-premises environment. Supported open-source models may be used in customer-controlled or on-premises configurations.

For Mavlon-managed deployments, customer content is encrypted in transit and at rest, access is restricted by role and business need, and access to production systems is logged. Customer-controlled and on-premises deployments may allocate certain security, backup, access, and deletion responsibilities to the customer as described in the applicable agreement.

Trials and Retention

Technical drawings and related customer content uploaded for a trial are deleted from Mavlon's active systems within seven days after the trial analysis is completed, unless the customer begins a paid service or asks us in writing to delete the content sooner. Trial content is not used for model training.

For paid Services, customer content is retained for the service term or the period specified in the customer agreement. Following termination or a verified deletion request, Mavlon deletes customer content from active Mavlon-managed systems within 30 days unless law or the customer agreement requires a different period. Residual encrypted backup copies are isolated from normal use and expire under the applicable backup schedule. Retention in customer-controlled or on-premises deployments is controlled by the customer unless otherwise agreed.

Service Providers and AI Sub-processors

We may use vetted service providers for hosting, authentication, monitoring, support, payments, communications, and AI inference. They may process information only to provide contracted services to Mavlon and are subject to confidentiality, security, and data-protection obligations. We maintain DPAs or equivalent contractual protections with commercial AI providers used to process customer content. A sub-processor list is available to customers on request.

We do not sell customer content or personal information. We do not share personal information for cross-context behavioral advertising.

International Transfers

The selected deployment and the locations of approved service providers determine where information is processed. If personal data is transferred internationally, we use an applicable transfer mechanism and contractual safeguards, such as Standard Contractual Clauses where required. Customer-specific residency and transfer terms are documented in the applicable agreement or DPA.

Cookies and Website Analytics

Our website uses essential technologies required for security and core functionality and analytics services, including Google Analytics and PostHog, to understand site performance and usage. These services may process device, browser, IP-address, and interaction data and may set cookies. You can restrict cookies through your browser settings and use any consent controls presented on the website.

Legal Bases and Privacy Rights

Depending on the context and applicable law, we process personal data to perform a contract, pursue legitimate interests such as operating and securing the Services, comply with legal obligations, or based on consent. Depending on where you live, you may have rights to:

• access or obtain a copy of your personal information;
• correct inaccurate personal information;
• request deletion or restriction of processing;
• object to certain processing or withdraw consent;
• receive portable data where applicable; and
• appeal a decision or complain to a data protection authority.

Mavlon generally acts as a processor of customer content on behalf of its business customers. If your request concerns information submitted by your employer or another Mavlon customer, please contact that organization first. We may need to verify your identity before acting on a request.

Children

The Services are intended for business users and are not directed to children. We do not knowingly collect personal information from anyone under 18 through the Services.

Security Incidents

We maintain incident-response procedures for investigating, containing, and remediating security incidents. If an incident affects personal information, we will notify affected customers, individuals, or regulators as required by applicable law and our agreements.

Changes to This Policy

We may update this Policy as our Services or legal obligations change. We will post the revised version here, update the date below, and provide additional notice when required by law or contract.

Contact Us

For privacy questions, data requests, or a copy of our DPA or sub-processor list, contact atishay@mavlon.co.