Last updated · 2026-01-01
Privacy notice
How this installation of Mauqe handles personal data.
Mauqe ships these notices as a starting point for whoever operates this installation. Before you rely on them, have them reviewed against the law that applies to you and fill in every part marked as needing completion.
Operator of this installation: [to be completed by the operator]
Who this applies to
This notice covers the people who use this installation: the staff of an organisation that has a workspace here, and anyone who fills in a form that a workspace has published. It does not cover what those organisations do with the data they collect from their own customers — that is their notice to write, not ours.
Controller and processor
For account data — the names, addresses and sign-in details of the people who use this service — the operator named above is the data controller. For the business records an organisation builds inside its own workspace, that organisation is the controller and the operator is a processor acting on its instructions. The distinction matters: a request about a record inside a workspace has to be answered by the organisation that owns it.
What is stored
Account data: name, email address, telephone number if given, password (stored only as a hash that cannot be reversed), language and display preferences, roles, and the time of the last sign-in. Business records: everything entered into the forms an organisation builds, including uploaded files. Operational data: an audit trail of significant actions with the actor, the time and the network address; server logs; and, for a published form, the address of whoever submitted it.
What it is used for
To run the service: authenticating people, showing them their work, routing approvals to the right person, sending the notifications the system is configured to send, enforcing quotas, and investigating faults and abuse. Personal data is not sold, and it is not used to train any model.
On what basis
Account and business data are processed to perform the contract with the organisation that holds the workspace. Audit trails, logs and rate limiting are processed under the legitimate interest of keeping a multi-tenant service secure and accountable. Where your law requires consent for something — marketing mail, non-essential cookies — it is asked for separately and can be withdrawn.
How long it is kept
Business records are kept until the organisation that owns them deletes them or closes its workspace. Audit entries are kept for as long as the workspace exists, because a trail with holes in it is not a trail. Server logs are kept for a short operating period and then discarded. Backups are overwritten on their own cycle, so deleted data can persist in a backup for a short time after it disappears from the live system.
Your rights
You may ask for a copy of your personal data, ask for it to be corrected, ask for it to be deleted, object to certain processing, or ask for it in a portable form. Records can be exported as CSV from inside the product at any time. If your data sits inside an organisation's workspace, ask that organisation first — the operator will forward the request rather than act on someone else's records without instruction.
Sub-processors
A self-hosted installation may have none at all: Mauqe needs no external service to run. A hosted one will use, at least, somewhere to run the server, somewhere to store backups, and a mail relay to deliver notifications. Payment processing, where a subscription is paid online, is handled by the payment provider and card details never reach this service.
How it is protected
Passwords are hashed. Session and anti-forgery cookies are restricted to the site and hidden from page scripts. Every query in the product is scoped to one organisation, so one tenant's data cannot be read from another's session. Uploaded files can be scanned for malware where the operator has configured a scanner. None of this is a guarantee: no service is immune, and a breach affecting you will be reported as your law requires.
Where it is held
The data lives wherever this installation runs. A self-hosted deployment keeps it on the operator's own infrastructure. For a hosted deployment, the region is stated by the operator below, and any transfer out of that region is made under a lawful transfer mechanism.
Cookies
The cookies this service sets are the ones it cannot work without: one to keep you signed in, one to protect forms against cross-site submission, one to remember your language, theme and layout, and — on a published form — one anonymous identifier that lets you see what you yourself submitted. There is no advertising cookie and no third-party analytics.
Changes to this notice
The date at the top changes when the text does. A change that materially affects how personal data is handled will be announced inside the product before it takes effect.
Contact
Questions about this notice, or a request about your data, go to the operator of this installation at the address below.
[to be completed by the operator]