What we collect, and what we do not.

Mahara Labs is the operating name of 16276334 Canada Inc., a federally incorporated Canadian company with a registered office in Barrie, Ontario. We are the organization accountable for the personal information described on this page.

Questions, corrections and deletion requests all go to hello@maharalabs.com, which reaches a person rather than a ticket queue.

Only what you type into a form, plus the minimum technical detail needed to receive it. We collect nothing about you passively.

• Contact and quote forms. Your name, email address, and optionally your phone number, company and job title, along with the message or project brief you write.
• Newsletter and lead forms. Your email address, and your name where the form asks for it.
• The chat assistant. The messages you send it and the replies it gives, kept as a conversation record. If you choose to leave a name and email in the chat so we can follow up, those are stored with it. Do not put anything sensitive into the chat — it is a sales assistant, not a support channel.
• Technical detail. The browser user-agent string attached to a form submission, and ordinary server logs kept by our hosting provider. We do not build profiles from these.

• To reply to you. This is the reason for almost everything we hold. If you ask us a question, we keep enough to answer it.
• To follow up, with consent. If you ticked the consent box, we may contact you about the enquiry you started. We do not sell, rent or share your details with anyone for their own marketing, ever.
• To keep the site working. Server logs and rate limiting exist to keep the forms available and to stop abuse.

We do not use your information to train any machine-learning model, ours or anyone else's.

A small number of service providers process data on our behalf, under contract, and only to deliver the service described. This is the complete list.

• Supabase — the database and authentication behind this site. Form submissions and chat conversations are stored here, on infrastructure in the United States.
• Vercel — hosting and content delivery. Handles the request and keeps short-lived server logs.
• Resend — delivers the notification email that tells us you got in touch, and any reply we send from the platform.
• Groq — runs the language model behind the chat assistant. Your chat messages are sent there to generate a reply.

Because these providers operate in the United States, your information is stored and processed outside Canada and may be accessible to foreign courts and law-enforcement under the laws of that country. If you would rather not have your details leave Canada, email or phone us instead of using the forms.

This site sets no advertising cookies, runs no analytics product, and carries no tracking pixels or tag manager. There is nothing here that follows you to another website, which is also why you are not being asked to dismiss a cookie banner.

The only cookies we set belong to the operator sign-in on the admin side of the platform. They exist to keep a signed-in session and are never set for ordinary visitors.

• Enquiries that go nowhere. Deleted within 24 months of our last exchange.
• Client records. Kept for the life of the engagement and for seven years afterwards, which is the period Canadian tax and corporate record-keeping rules require.
• Chat conversations. Deleted within 12 months.
• Server logs. Retained by our hosting provider on their own short rolling window, typically days rather than months.

A deletion request overrides all of the above, except where we are legally required to keep a record.

Under Canadian privacy law you can ask us what we hold about you, ask us to correct it, and ask us to delete it. You can withdraw consent to being contacted at any time, and every message we send carries a way to do that.

Email hello@maharalabs.com and we will act within 30 days. We will not ask you why, and we will not make it difficult.

If you are not satisfied with how we handled your request, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Data is encrypted in transit and at rest. Access to the admin platform requires a verified email sign-in, and every workspace's records are isolated from every other workspace at the database client, not by hand-written filters in each query. Operator actions that change data are written to an audit trail.

No system is perfect. If we ever discover a breach that creates a real risk of significant harm to you, we will tell you and the Privacy Commissioner, as the law requires.

If we change how we handle personal information, we change this page in the same release and move the date above. We will not quietly broaden what we do with information you already gave us.