Privacy policy

Who we are

Maven is an AI workspace for tax and advisory firms, built and run by CTRLX in Dar es Salaam, Tanzania. In this policy, “Maven”, “we” and “us” mean CTRLX. It explains what personal information we collect when you visit itsmaven.io or use the Maven app, how we use it and the choices you have.

CTRLX is registered with Tanzania’s Personal Data Protection Commission.

If you have a question about this policy or your information, email us at privacy@itsmaven.io.

Your firm’s data and our role

Firms use Maven to work on their clients’ matters. For the documents, messages and drafts a firm adds to Maven, the firm decides what is collected and why, and we process that information on the firm’s instructions to provide the service. If you are a client of a firm that uses Maven, please contact that firm about your information.

Information we collect

Account information. Your name, email address, firm, role and profile picture.
Content your firm adds. Documents, messages, playbooks, drafts and reviews created in your firm’s workspace.
Usage and device information. Sign-in times, pages used, browser type, device and IP address, which we use to run and secure the service.
Messages to us. What you send when you book a demo, ask for support or contact us.

How we use it

To provide Maven, including drafting, answering questions and organising your firm’s work.
To keep accounts and client work secure, and to prevent misuse.
To support you and respond to your requests.
To improve how Maven works, using usage information rather than your firm’s content.
To meet our legal obligations.

AI and your content

Maven uses AI to read the files your firm gives it and to prepare drafts for your team. Your firm’s content is used only to provide the service to your firm. It is never used to train AI models, and one client’s documents are never used to answer for another. A client’s owner can switch AI processing off for that client at any time.

Who we share it with

We do not sell personal information. We share it only:

With the service providers listed below, who host, store and process information for us under contracts that require them to protect it and use it only to provide their services.
With professional advisers, such as lawyers and auditors, when needed.
When the law requires it, or to protect the rights and safety of our users and others.
As part of a merger or sale of our business, with notice to you.

Our service providers

Depending on the features you use, these providers may include:

Convex (Convex, Inc.). We use Convex to run Maven’s database, store your firm’s files and run the app’s backend. You can read Convex’s privacy policy at www.convex.dev/legal/privacy.
OpenAI (OpenAI, L.L.C.). We use OpenAI for the AI that reads the files your firm gives Maven and prepares drafts. You can read OpenAI’s privacy policy at openai.com/policies/privacy-policy/.
Vercel (Vercel Inc.). We use Vercel to host and deliver the Maven website and app. You can read Vercel’s privacy policy at vercel.com/legal/privacy-notice.
Cloudflare (Cloudflare, Inc.). We use Cloudflare to run our domain, to send and receive Maven’s email, and to measure website and app traffic and page performance with Cloudflare Web Analytics. You can read Cloudflare’s privacy policy at www.cloudflare.com/privacypolicy/.
Google (Google LLC). We use Google Fonts to show the fonts on the Maven website. You can read Google’s privacy policy at policies.google.com/privacy.

Each provider handles information under its own privacy policy. We will update this list when our providers change.

International transfers

Our service providers may process information outside Tanzania. We are a company registered with the Personal Data Protection Commission, and we are working through the requirements of Tanzania’s Personal Data Protection Act, 2022 for these transfers. If your firm needs details before it shares client data, contact us at privacy@itsmaven.io.

How long we keep it

We keep account information while your account is active. Your firm’s content stays until your firm asks us to delete it, and when an account closes we delete the firm’s content within a reasonable period, unless the law requires us to keep it. We keep security and usage logs for a limited time.

Security

We protect information with access controls that limit each client’s work to the people your firm adds, private work areas, review before anything is shared and encryption in transit. No system is perfectly secure, so please tell us at security@itsmaven.io if you notice anything wrong.

Your rights

You can ask to see, correct or delete your personal information, object to how we use it or ask for a copy. Email privacy@itsmaven.io and we will respond within the time the law allows. You can also complain to Tanzania’s Personal Data Protection Commission.

Cookies

We use cookies that are needed to sign you in and keep your session secure. We do not use advertising cookies. Cloudflare Web Analytics measures visits and page performance without analytics cookies or tracking people across websites.

Children

Maven is a service for businesses and is not meant for anyone under 18.

Changes to this policy

We may update this policy as Maven changes. If the changes are significant, we will let you know before they take effect.