ProjectMali Privacy Policy

Effective date: [date] Last updated: [date]

Short version: ProjectMali helps adult family home owners and bookkeepers see supply spending across homes. We collect what you give us (your account, your homes, your spend lines, and the receipts you upload) to run the tool for you. We do not sell your data. Please do not upload resident names or medical information.

1. Who we are

ProjectMali ("we", "us") is a [entity type] located at [mailing address]. You can reach us at admin@projectmali.com. This policy covers the website at projectmali.com and the ProjectMali app.

ProjectMali is for businesses and is available by invitation only. You must be at least 18 and be using it for your adult family home business or on behalf of one.

2. What we collect

Information you give us

• Access requests: if you ask for access on our website, the email address and phone number you enter, and your name if you give it. We use these only to contact you about access.
• Account details: your email address, your name if you give it, your role (owner or bookkeeper), and your business name.
• Business setup: the names of your homes and the items you track.
• Spend data: the lines you upload by CSV or that are read from a receipt, such as vendor, item description, product number (SKU), quantity, price, date, and which home it belongs to.
• Files you upload: receipt photos, PDFs and similar documents, and the lines you confirm from them.
• Messages to us: anything you send to admin@projectmali.com, and data deletion requests.
• Invitations: the email address an owner or bookkeeper is invited with, and the business that invited them.

Information we collect automatically

• Sign-in and security information, such as when you signed in and basic technical details about your browser or device.
• Error and activity records that help us find and fix problems, for example that an upload failed and why.
• Email delivery information, such as whether a message was delivered or bounced.

What we ask you not to upload

Please do not include resident names, medical or care information, Social Security numbers, or full payment card or bank account numbers in anything you upload. ProjectMali does not need them. If a receipt shows a card's last four digits or a store address, that is fine, but if you notice sensitive details on a file, black them out first or contact us so we can remove it.

3. How we use it

• To run ProjectMali: show your spend by home, vendor and category, match lines to your item list, and keep a queue of lines that still need matching.
• To read receipts and documents you upload and turn them into lines for you to review (see section 4).
• To send you service emails: invitations, sign-in and account messages, upload results, reminders to map lines that are still unmatched after about 24 hours, and a summary of your spend. See section 7.
• To respond to access requests: we may call or email the contact details you gave to talk about an invitation. If you ask us to stop, we will.
• To give support, fix bugs, keep the service secure, and prevent misuse.
• To understand in general how ProjectMali is being used so we can improve it. We use your data in this way only in ways that do not identify you or your business to anyone else.

We do not sell your personal information or your business data, and we do not use it to show you ads.

4. Receipt and document reading

When you upload a receipt photo or PDF, the file is sent to an AI service that reads the text and returns suggested lines. You always see those lines first and must choose "Save lines" before anything is added to your spend. The reading can be wrong, so please check the vendor, quantities and prices.

The AI is used only to read the document. It does not decide how a line is matched to your item list. Matching is rule-based: it uses the vendor with a product number, or a match you have confirmed yourself.

The service that reads the file is provided through our app platform ([AI provider name(s) to be confirmed]). We send it only the uploaded file and the instructions to read it. [Statement on how the provider handles submitted files to be confirmed.]

We keep the uploaded file in private storage that only your business's signed-in users and our authorized staff can reach, so you can look back at the source of a line.

5. Who else handles your data

We use a small number of service providers to run ProjectMali. They may process your data only to provide their service to us:

• Lovable (app platform, hosting, file storage, login, app email, and AI document reading), which uses Supabase for the database.
• Microsoft 365 (our admin@projectmali.com mailbox, where your messages to us arrive).
• GoDaddy (our domain name registration and DNS).

We may also share information if the law requires it, to protect people's safety or our rights, or as part of a sale or merger of our business (we would tell you first and the new owner would have to honor this policy).

6. Keeping businesses separate and who can see your data

Each business is a separate space. People in one business cannot see another business's homes, spend, or files. Within a business, owners and bookkeepers you invite can see that business's data according to their role.

Our own staff may open your data when needed to give support, fix a problem, or investigate misuse. We limit that to what is necessary.

7. Emails

We send two kinds of emails. Service emails are the ones you need to use the app, such as invitations and account messages. Product emails are the summary of your spend and the reminders to map lines that are still unmatched. They come from noreply@projectmali.com and replies go to admin@projectmali.com.

Every email carries an unsubscribe link. Right now, using that link stops all app emails to that address, including invitations and reminders, not just the summary. If you only want to stop the reminders, email us and we will turn them off for your business instead.

8. How long we keep it, and deleting it

We keep your data while your account is active. If you ask us to delete your business's data, we will delete your account data, spend lines, and the receipt and document files stored for your business within [30] days, except for what we must keep to follow the law or settle a dispute. Backups roll off within [number] days after that.

If you asked for access but did not become a customer, we keep your request (email, phone, name) for up to [number] days and then delete it, or sooner if you ask.

To ask, email admin@projectmali.com from the address on your account with the subject "Delete my data", or use the data deletion request page at projectmali.com/data-deletion. We may ask you to confirm it is you.

9. Your choices and rights

You can ask us to show you the information we hold about you, correct it, export it, or delete it. Send the request to admin@projectmali.com.

You can remove spend lines and files yourself in the app, and you can ask us to remove an account at any time.

10. Security

We use reasonable measures to protect your data, including private file storage, access controls that separate businesses, and encrypted connections. No system is perfectly secure. If we learn of a security incident that affects your data, we will tell you without unreasonable delay and as the law requires.

11. Cookies and similar tools

We use only what is needed to keep you signed in and keep the app working. We do not use advertising or cross-site tracking cookies.

12. Changes to this policy

If we make a meaningful change, we will update the date above and email the owner on each account before it takes effect.

13. Contact

ProjectMali, [mailing address]. Email: admin@projectmali.com.