Privacy Policy

Last updated: 12 October 2026

This policy explains how Maliru ("we", "us") handles personal data in the Maliru platform — the web application at app.maliru.com, the Maliru mobile apps, and this website. It is written to meet the UK GDPR and the EU GDPR.

The Service is provided by Oracha (UK) Limited, trading as Maliru — a company registered in England and Wales, company number 15517641, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. "We" and "us" mean Oracha (UK) Limited throughout this policy, including where it describes us as a controller or a processor. Reach us at maliru.com/contact.

1. Two roles

For workspace data, we are a processor. A Maliru workspace belongs to the customer organisation that created it. Its administrators decide what is collected about workers and operations; we process that data on their behalf. Questions about data in your employer's workspace go first to your workspace administrator.
For account, billing and website data, we are a controller. That covers the data described below that we need to run the Service itself.

2. What we collect

Account data — your mobile number (used for sign-in by one-time SMS code), name, and where provided, email address.
Workspace data — the operational records your workspace holds: jobs, schedules, forms and their answers, photographs and files, signatures, timesheets, leave, expenses, credentials, and messages. Shared packs also hold recipient details, access records, returned forms and signed documents. Location stamps are collected at capture or clock events where enabled and available. Where a workspace has switched on journey monitoring, a worker who starts a lone worker session and chooses to share their route has it recorded from that moment until they end the session, including while their phone is locked, and the phone shows that it is recording for as long as it does. Otherwise the Service does not track workers in the background.
Billing data — plan, seats and invoicing details. Payment card details are collected and held by Stripe, not by us.
Device data — push-notification tokens for the devices you sign in on, removed on sign-out.
Website data — this website sets no advertising cookies and has no third-party chat widgets. It has its own chat, answered first by Marie, our AI assistant; see Chat on this website. Page views are counted anonymously, and your journey on the site is recorded only if you allow analytics; see Analytics on this website and Cookies on this website.

3. Why, and on what basis

To provide the Service — performance of a contract.
To secure it (authentication, audit trails, abuse prevention) — legitimate interests.
To bill for it — performance of a contract; legal obligation for tax records.
To answer a website chat and follow up an enquiry you start there — legitimate interests, and steps you ask for before a contract.
To count page views anonymously — legitimate interests. To record your journey on this website — your consent, which you can withdraw at any time.
To send service notifications — legitimate interests; you control channels per category in the product, and your in-app inbox always retains notices.
AI-assisted features (for example a first-pass review of form submissions and their photos) are on by default for scored inspections that carry photos on eligible paid plans, and otherwise only where a workspace or form enables them. A workspace can switch automatic review off. Confidential and expense form submissions are excluded from automatic review. Findings await human decision.
Marie, the assistant in the app, reads a workspace's records only once one of its owners has switched her on, and then only what the person asking may see. See Marie in the app.

4. Where your data lives

The primary workspace database and file storage are hosted in the European Union (AWS, Ireland). Files are held in private, per-workspace storage, and workspace access is enforced at the database level. Web delivery and the processors listed below may process data in other locations.

5. Who helps us run it (processors)

Supabase (AWS eu-west-1, Ireland) — database, authentication and file storage.
Stripe — subscription payments.
Google Firebase Cloud Messaging — push notification delivery.
Twilio — sends the one-time sign-in code by SMS, and the text messages and phone calls a workspace's lone worker escalation sends to its chosen contacts.
what3words — where a workspace switches it on, turns the last known position of a worker in a lone worker alarm into a three-word address, and does the same when a worker asks for their own during a session. Nothing else is sent to it.
PowerSync — delivers chat history to the phone app.
Resend — transactional and digest email.
Anthropic — processes the content supplied to enabled AI-assisted features, such as form drafting, evidence review, cost-document extraction, Marie in this website's chat, and Marie in the app, including the workspace records she looks up to answer (see Marie in the app).
TypeSafe AI (United States) — a planned provider for short yes-or-no and pick-one checks on text, such as flagging a possible safety issue or suggesting that a support question needs a person. These checks are disabled for customer workspaces and customer support routing while the processing agreement remains unsigned. Before customer use is enabled, we will update this notice and notify affected customers. Any enabled check receives only the text it needs, never photos or files.
GIPHY — GIF search and media delivery where the GIF picker is enabled. Opening a GIF loads media from the provider.
Cloudflare — hosting and delivery of the web applications and this site, and, if you allow it, this site's page-view analytics.

Where a provider processes data outside the UK/EU, transfers rely on adequacy decisions or standard contractual clauses.

6. Retention, deactivation and erasure

Workspace data is retained while the workspace is active and deleted after closure (subject to a short export window and legal retention duties).
Within a workspace, the product distinguishes deactivation (access removed; records kept) from anonymisation (personal details permanently removed while the operational record and audit history survive) — reflecting that work history often must be retained even when a person's data should not be.
Audit trails are tamper-evident and retained for the life of the workspace.
A deleted workspace cannot be restored individually. Daily database backups follow a seven-day retention schedule. Separate recovery checkpoints are scheduled to expire after 30 days, with old versions scheduled for deletion seven days after they become noncurrent. Backup deletion runs asynchronously.
After a workspace is deleted, its support conversations are kept to answer questions about the closure, with their messages scheduled for deletion after 365 days. Files stored in the workspace are removed when it is deleted. Conversations linked to a demo request are retained with that request. The minimal record of the deletion and its audit fingerprint remains.
A website chat that leaves no way to reach you (no email address, enquiry or demo) is deleted after 90 days without activity; otherwise it is kept with your enquiry.
Conversations with Marie in the app are deleted 90 days after their last message, or sooner by the person who had them. The changes she prepared are deleted after 30 days, reminders 180 days after they are done, and what she remembers when someone deletes it. A change someone confirmed stays in the workspace's records and audit trail like any other.
Website journeys recorded with your consent are kept for 13 months; anonymous page counts for 25 months.

7. Your rights

Under the UK/EU GDPR you may request access, rectification, erasure, restriction, portability, or object to processing, and complain to a supervisory authority (in the UK, the ICO). For data in an employer's workspace, direct requests to that organisation — we support them in fulfilling requests. For account data, contact us via maliru.com/contact.

8. Security

Traffic is encrypted in transit; data is encrypted at rest by our hosting providers; access to workspace data is isolated per workspace and permission-checked on the server; files are served through short-lived signed links; and every material change writes an audit entry.

Maliru support opens a workspace's records (jobs, form submissions, time, measures, pay runs and their evidence) only when the workspace's owner or an office admin gives access from a support conversation: read-only, limited to what they choose, for a set time (three days unless they choose otherwise), and ended whenever they like. Every record support opens is recorded in the workspace's own audit trail and listed for the workspace to see.

To run the Service, authorised Maliru staff can see limited account information without that access, such as the state of pay runs and accounting connections, whether document emails were delivered, and how much the workspace is used, and can make specific repairs with a stated reason, such as restoring an archived record. They do not see anyone's pay, connection secrets or full email addresses there. Each repair, and each of these views apart from the usage counts, is listed for the workspace to see.

9. Children

The Service is for working organisations and not directed at children under 16.

10. Marie in the app

Marie is our AI assistant inside the Maliru app, labelled AI wherever she speaks. On every plan she answers questions about how Maliru works. On plans that include it, and only once one of the workspace's owners has switched her on, she also answers from the workspace's own records, and can set reminders, remember what she is asked to and prepare changes for the person to confirm. Marie on this website is separate and never sees workspace data.

What she reads — the person's question and the conversation so far, the section and record they have open when they ask, and the records she looks up to answer. She sees only what that person may see in the workspace, and can prepare only what they may do.
Who processes it — the conversation and the records she looks up are sent to our AI model provider (Anthropic), which processes them under its data processing terms to write her replies. Nothing is used to train AI models.
Changes — Marie changes nothing by herself. A change happens only when the person confirms it, and the workspace's audit trail records it as theirs, made through Marie.
Who can read a conversation — only the person who had it: nobody else in the workspace, owners included. If they choose to talk to a person, only the messages they pick are sent to Maliru support. We read the questions people ask about how Maliru works, to improve our guides; a conversation in which Marie looked up the workspace's records stays private, and we see only counts from it.
What she remembers — only what the person agrees to: preferences and shorthand, listed for them in the app, and shorthand for the whole workspace, listed in its settings. Anything can be deleted at any time. She keeps no copies of records and looks them up each time.
What people ask for — when she can't do something, she notes the kind of request, without names, figures or record details, so we can decide what she learns next.
Usage — we record how much each workspace uses her, to apply fair-use limits and the plan's AI allowance.
Switching her off — the workspace can switch Marie off at any time, and each person can switch her off for themselves.

11. Chat on this website

The chat on maliru.com is our own. It is answered first by Marie, our AI assistant, and you can ask for a person at any time with Talk to a person.

What we keep — the messages you send and receive, any name, email address or company you give, the page you were on, the site and campaign that brought you, your language and time zone, your country and the kind of device you use.
In your browser — a random secret, so you can carry on the conversation from page to page. It is set only once you open the chat, and it is essential to the chat you asked for.
Marie is an AI — your messages are processed by our AI provider (Anthropic) to write her replies, and the team can read the conversation. She never asks for passwords or card details.
How long — if you leave no way to reach you, the chat is deleted after 90 days without activity. If you give an email address or book a demo, it is kept with your enquiry.
Your visits — if you allowed analytics, the chat is linked to your journey on this site, so the team can see what you looked at before you asked.

12. Analytics on this website

Always, anonymously — each page view is counted with the page's address, the name of the site that sent you, any campaign tags in the address, the kind of device and the country. No identifier is created and nothing is stored in your browser, so a count cannot be linked to you.
Only with your consent — if you choose “Accept analytics”, your browser keeps a random visitor id and a session id, and we record your journey here: pages viewed, how far you scroll, time on each page, the buttons and links you click, tabs you switch, and whether you start the demo form, send it or open the chat. If you then book a demo or give your email in the chat, the journey is linked to your enquiry. It is kept for 13 months.
Changing your mind — withdraw at any time with Cookie settings. The ids are deleted from your browser and nothing more is recorded.

13. Cookies on this website

maliru.com asks before anything optional runs. Your choice is kept for six months, and you can change it at any time.

Name	What it does	Kind	Kept for
`maliru_consent`	Remembers whether you allowed analytics, so we do not ask on every page.	Essential	6 months
`maliru_si`	Set by the Maliru app while you are signed in, so this site shows “Open Maliru” instead of “Sign in”. It holds no personal data.	Essential	Up to 30 days; removed when you sign out
`maliru_chat`	Keeps a chat you opened going: a random visitor id and secret, and the conversation number. Stored in your browser (local storage), only once you open the chat.	Essential	Until you clear this site's data
`maliru_chat_open`	Remembers that the chat is open, so it stays open on the next page (session storage).	Essential	Until you close the tab
`maliru_chat_hello`	Remembers that Marie has said hello on this visit, so she says it only once (session storage). It holds nothing else.	Essential	Until you close the tab
Anonymous page count	Counts each page view without any identifier. Nothing is stored in your browser.	Not a cookie	Nothing stored
`maliru_vid`	A random visitor id that links your visits to this site (local storage). Only if you choose “Accept analytics”.	Analytics (optional)	Until you withdraw or clear this site's data
`maliru_sid`, `maliru_landing`	This visit's id, and the page and source it started from (session storage). Only if you choose “Accept analytics”.	Analytics (optional)	Until you close the tab
Cloudflare Web Analytics	Counts page views and how fast pages load. It sets no cookie and does not follow you to other sites. Runs only if you choose “Accept analytics”.	Analytics (optional)	No cookie

Cloudflare may also set a short-lived security cookie (__cf_bm) to tell people from automated traffic. It is essential and holds no personal data.

Change cookie settings

14. Changes

We may update this policy; material changes will be notified in the product or by email. The "Last updated" date above reflects the current version.