Privacy Policy

Last updated: 18 August 2026

This policy explains how Maliru ("we", "us") handles personal data in the Maliru platform — the web application at app.maliru.com, the Maliru mobile apps, and this website. It is written to meet the UK GDPR and the EU GDPR.

1. Two roles

  • For workspace data, we are a processor. A Maliru workspace belongs to the customer organisation that created it. Its administrators decide what is collected about workers and operations; we process that data on their behalf. Questions about data in your employer's workspace go first to your workspace administrator.
  • For account, billing and website data, we are a controller. That covers the data described below that we need to run the Service itself.

2. What we collect

  • Account data — your mobile number (used for sign-in by one-time SMS code), name, and where provided, email address.
  • Workspace data — the operational records your workspace holds: jobs, schedules, forms and their answers, photographs and files, timesheets, leave, credentials, and messages. Some records may include location stamps where a form or clock-in captures them; location capture is best-effort and never blocks work.
  • Billing data — plan, seats and invoicing details. Payment card details are collected and held by Stripe, not by us.
  • Device data — push-notification tokens for the devices you sign in on, removed on sign-out.
  • Website data — this website uses cookieless analytics and sets no advertising cookies. The support chat (Tawk.to) sets its own functional cookies when you use it.

3. Why, and on what basis

  • To provide the Service — performance of a contract.
  • To secure it (authentication, audit trails, abuse prevention) — legitimate interests.
  • To bill for it — performance of a contract; legal obligation for tax records.
  • To send service notifications — legitimate interests; you control channels per category in the product, and your in-app inbox always retains notices.
  • AI-assisted features (for example photo review of inspection submissions) run only where a workspace enables them, and their findings await human decision.

4. Where your data lives

The Service is hosted in the European Union (AWS, Ireland), with files held in private, per-workspace storage. Access to workspace data is enforced at the database level per workspace.

5. Who helps us run it (processors)

  • Supabase (AWS eu-west-1, Ireland) — database, authentication and file storage.
  • Stripe — subscription payments.
  • Google Firebase Cloud Messaging — push notification delivery.
  • Resend — transactional and digest email.
  • Tawk.to — support chat and the Help Center. The product does not send your account or workspace data to the chat; what you type in a chat is processed by Tawk.to.
  • Cloudflare — hosting and delivery of the web applications and this site.

Where a provider processes data outside the UK/EU, transfers rely on adequacy decisions or standard contractual clauses.

6. Retention, deactivation and erasure

  • Workspace data is retained while the workspace is active and deleted after closure (subject to a short export window and legal retention duties).
  • Within a workspace, the product distinguishes deactivation (access removed; records kept) from anonymisation (personal details permanently removed while the operational record and audit history survive) — reflecting that work history often must be retained even when a person's data should not be.
  • Audit trails are tamper-evident and retained for the life of the workspace.

7. Your rights

Under the UK/EU GDPR you may request access, rectification, erasure, restriction, portability, or object to processing, and complain to a supervisory authority (in the UK, the ICO). For data in an employer's workspace, direct requests to that organisation — we support them in fulfilling requests. For account data, contact us via maliru.com/contact.

8. Security

Traffic is encrypted in transit; data is encrypted at rest by our hosting providers; access to workspace data is isolated per workspace and permission-checked on the server; files are served through short-lived signed links; and every material change writes an audit entry.

9. Children

The Service is for working organisations and not directed at children under 16.

10. Changes

We may update this policy; material changes will be notified in the product or by email. The "Last updated" date above reflects the current version.