Who we are
Mahara Labs (16276334 Canada Inc.) is a federally incorporated Canadian company at 3136 Mavis Road, Unit 210, Mississauga, ON L5C 1T9, Canada. We are the organization accountable for the personal information described on this page. We serve customers in Canada and the United Arab Emirates.
Questions, corrections and deletion requests all go to hello@maharalabs.com, which reaches a person rather than a ticket queue.
What we collect
Only what you type into a form, plus the minimum technical detail needed to receive it. We collect nothing about you passively.
- Contact and quote forms. Your name, email address, and optionally your phone number, company and job title, along with the message or project brief you write.
- Newsletter and lead forms. Your email address, and your name where the form asks for it.
- The chat assistant. The messages you send it and the replies it gives, kept as a conversation record. If you choose to leave a name and email in the chat so we can follow up, those are stored with it. Do not put anything sensitive into the chat — it is a sales assistant, not a support channel.
- Technical detail. The browser user-agent string attached to a form submission, and ordinary server logs kept by our hosting provider. We do not build profiles from these.
Why we use it
- To reply to you. This is the reason for almost everything we hold. If you ask us a question, we keep enough to answer it.
- To follow up, with consent. If you ticked the consent box, we may contact you about the enquiry you started. We send marketing email only if you also ticked the separate, optional marketing box or subscribed to our updates, and every such email has an unsubscribe link that takes effect at once. We do not sell, rent or share your details with anyone for their own marketing, ever.
- To keep the site working. Server logs and rate limiting exist to keep the forms available and to stop abuse.
We do not use your information to train any machine-learning model, ours or anyone else's.
Our products and platform
Businesses use our products (such as Tezline, Fleetsguard and our AI employee app) and the Mahara Labsplatform to work with their own customers. For their customers' information, the business decides why it is collected and how it is used, and we process it on its behalf, under these rules:
- Calls. When a business records calls, callers hear a notice first. Calls may be transcribed and summarized by an automated system. Recordings are deleted after 90 days unless the business sets a shorter period.
- Tracking numbers.A business's website may show different phone numbers to different visitors, so it can tell which ad or page led to a call. We keep an anonymous identifier for this, not who you are.
- AI call-backs. An automated AI assistant calls only people who ticked a box asking to be called, says it is an AI at the start, and stops calling as soon as you ask.
- Company details. For business contacts, a business may look up public details about the company (such as size and industry) from its website or a business-data provider. This is never done for personal email addresses or in health-care workspaces.
- Shared requests. When a form says your request may be shared with named businesses, it is shared only with those businesses, and only the ones chosen receive your contact details.
To ask about information a business holds about you, contact that business; we will help it answer, and you can also write to us.
Google, YouTube, Meta, LinkedIn and TikTok
Businesses using our platform can connect their accounts on these platforms. They sign in on the platform itself and choose what to allow; we never see their password there. We use the access only to do what the business asks through our platform, for the accounts it chose:
- Google. Google Ads: the ad accounts, campaigns and their results, and answers to Google lead forms; creating paused campaigns and sending conversions when asked. Google Business Profile: locations, reviews, and replies and posts the business approves. Google Analytics, Search Console, Sheets and Calendar, when connected: reports, rows and free/busy times for the features that use them.
- YouTube.The channel's name and basic details, and uploading the videos the business approves.
- Meta (Facebook, Instagram and WhatsApp). The list of assets a business shares with us as its agency partner in its Meta business portfolio; the Pages and Instagram business accounts chosen, with their names and follower counts; publishing approved posts; comments and direct messages (Messenger, Instagram and WhatsApp) so the business can answer them; WhatsApp message templates and their approval status; lead ad forms and the answers people send through them; ad accounts, their campaigns and results; and sending conversion events, which are hashed before they leave our systems.
- LinkedIn. The company Pages chosen, publishing approved posts, Page statistics, answers to Lead Gen Forms, and ad accounts with their campaigns and results.
- TikTok.The profile's name, sending approved videos to the account and checking whether they were posted; with TikTok for Business, ad accounts, their results, and answers to instant forms.
Why.Only to publish what the business approves, show it its results, answer its messages and comments, and bring its new leads into its own records. Publishing, campaign launches and budget changes always need a person's approval.
What we never do. We do not sell this data, use it for advertising, share it with other businesses, or use it to train AI models, and people at Mahara Labs look at it only when the business asks us to help, for security, or when the law requires.
How long we keep it.Sign-in tokens are stored encrypted and deleted as soon as the account is disconnected. Results, posts and messages are kept while the business's workspace is active; raw lead-form answers are cleared 30 days after they become a lead in the business's records. When a business disconnects an account or closes its workspace, it can ask us to delete the data, and we do so within 30 days.
How to remove access.Disconnect the account on the platform's Connections page, or remove our app in the platform's own settings (Google: myaccount.google.com/connections). Our data deletion page has the steps for every platform.
Google user data. Mahara Labs's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
YouTube. Our YouTube features use YouTube API Services. By using them you agree to the YouTube Terms of Service, and the Google Privacy Policy applies. You can revoke our access at any time from your Google security settings.
Who else touches it
A small number of service providers process data on our behalf, under contract, and only to deliver the service described. This is the complete list.
- Supabase — the database and authentication behind this site. Form submissions and chat conversations are stored here, on infrastructure in the United States.
- Vercel — hosting and content delivery. Handles the request and keeps short-lived server logs.
- Resend — delivers the notification email that tells us you got in touch, and any reply we send from the platform.
- Z.ai (GLM) — runs the language model behind the chat assistant. Your chat messages are sent there to generate a reply.
- Groq— a backup language model for the chat assistant, used only when Z.ai doesn't answer. The same chat messages are sent there in that case.
- Twilio — phone calls and text messages, for businesses that use calling or texting on our platform.
- Cloudflare Turnstile — when switched on, checks that a form is being sent by a person rather than a bot. It sees technical details about your browser, not what you type.
- Google Analytics — counts visits and which pages are read, and records when someone sends an enquiry or taps our phone number or email address. It sees your browser, device, approximate location and the pages you view, not what you type into a form.
- Meta (the Meta Pixel) and Google Ads— only while we are running an advertising campaign. They tell those platforms that someone who saw one of our ads visited this site and, if they sent an enquiry, that an enquiry was sent, so we can measure the campaign. They see your browser, the pages you view and their own cookies, not what you type into a form. See “Cookies and tracking” for how to opt out.
Because these providers operate outside Canada — mostly in the United States, and for the chat assistant on Z.ai's infrastructure — your information is stored and processed outside Canada and may be accessible to foreign courts and law-enforcement under the laws of that country. If you would rather not have your details leave Canada, email or phone us instead of using the forms.
Cookies and tracking
We use Google Analytics to understand how many people visit, which pages they read, and when someone gets in touch. It sets its own first-party cookies (named _ga) to tell one visit from the next. We do not use it for advertising or remarketing.
While we are running an advertising campaign, the site also loads the Meta Pixel and the Google Ads tag, which set their own cookies (such as _fbp, _fbc and _gcl_au) so that a visit, or an enquiry, can be matched to the ad that led to it. They are off the rest of the time, and we never load a tag manager.
To opt out: turn on Global Privacy Control or “Do Not Track” in your browser and neither advertising tag loads at all; or block these cookies in your browser settings, or install Google's opt-out browser add-on. The site works exactly the same either way.
We set two cookies of our own, ml_ft and ml_lt, only when you arrive from a campaign link, an ad or another website. They remember where you came from (for example a campaign name or the referring site) for 90 days, and if you send an enquiry that is saved with it, so we can tell which of our marketing works. They stay on this site and are not shared. The admin side of the platform also sets sign-in cookies, for operators only.
How long we keep it
- Enquiries that go nowhere. Deleted within 24 months of our last exchange.
- Client records. Kept for the life of the engagement and for seven years afterwards, which is the period Canadian tax and corporate record-keeping rules require.
- Chat conversations. Deleted within 12 months.
- Server logs. Retained by our hosting provider on their own short rolling window, typically days rather than months.
A deletion request overrides all of the above, except where we are legally required to keep a record.
Your rights
Under Canadian privacy law you can ask us what we hold about you, ask us to correct it, and ask us to delete it. You can withdraw consent to being contacted at any time, and every message we send carries a way to do that.
Email hello@maharalabs.com and we will act within 30 days. We will not ask you why, and we will not make it difficult.
If you are in the United Arab Emirates, the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) also gives you the right to access, correct and delete your data, to restrict or object to how it is used, and to receive a copy of it. Ask us the same way.
If you are not satisfied with how we handled your request, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
How it is protected
Data is encrypted in transit and at rest. Access to the admin platform requires a verified email sign-in, and every workspace's records are isolated from every other workspace at the database client, not by hand-written filters in each query. Operator actions that change data are written to an audit trail.
No system is perfect. If we ever discover a breach that creates a real risk of significant harm to you, we will tell you and the Privacy Commissioner, as the law requires.
Changes to this page
If we change how we handle personal information, we change this page in the same release and move the date above. We will not quietly broaden what we do with information you already gave us.