Privacy Policy

This Privacy Policy explains how Spec AI ("Spec AI", "we", "us", "our") collects, uses, stores, shares, and protects personal data when you visit usepec.com or use the Spec AI platform (the "Service"). Spec AI is operated by Mahin Khattak, an individual trading as Spec AI, and acts as the data controller of personal data processed through the Service. By using the Service you also agree to our Terms of Service and Refund Policy.

1. Information we collect

We collect only the information needed to operate the Service. Specifically:

• Account information — name, email address, company name, password hash (we never store plaintext passwords), and authentication identifiers if you sign in with Google.
• Tool inputs — product descriptions, supplier data, RFQ details, costing assumptions, translations, and any other content you enter into Spec AI tools.
• Generated outputs & run history — the AI-generated documents, comparisons, and estimates produced for your account, plus timestamps and which tool was used.
• Subscription & billing metadata — plan, status, trial dates, and usage counters. We never see or store your card details. Payments are processed by Paddle, our Merchant of Record.
• Technical & usage data — IP address, browser type, device type, pages viewed, referring URL, and basic event logs needed for security and reliability.
• Support communications — the contents of any email or message you send us.

We do not knowingly collect data from anyone under 18. Spec AI is intended for business use only.

2. How we use your data

• Provide the Service — create your account, run AI tools, and store your run history so you can retrieve past outputs.
• Process payments & subscriptions — through Paddle as Merchant of Record.
• Improve the Service — aggregated, non-identifying analytics about which features are used.
• Security & fraud prevention — detect abuse, prevent unauthorised access, and enforce our Terms.
• Customer support — respond to your questions and resolve issues.
• Service & billing notifications — confirmations, receipts, password resets, and important changes. You can opt out of optional product updates at any time.
• Legal compliance — meet tax, accounting, and other legal obligations.

3. Legal bases for processing (GDPR / UK GDPR)

• Performance of a contract — to deliver the Service you signed up for.
• Legitimate interests — to keep the Service secure, prevent abuse, and improve our product, in a way that does not override your rights.
• Legal obligation — for tax, accounting, and lawful requests from authorities.
• Consent — for any optional marketing communications, which you can withdraw at any time.

4. Where your data goes — subprocessors & integrations

We do not sell your data. We share data only with the vetted third parties below, strictly to provide the Service. Each is contractually bound to handle data securely.

We may also share data with professional advisers (legal, accounting) or with authorities where required by law, court order, or to protect the rights, property, or safety of Spec AI, our users, or the public.

5. International data transfers

Spec AI is operated from Hong Kong, and our subprocessors are located in the United States, United Kingdom, Singapore, and the EU. Where personal data of UK/EEA residents is transferred outside the UK/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or equivalent mechanisms offered by our subprocessors.

6. Data retention

• Account, tool inputs, run history, generated outputs — retained for as long as your account is active.
• Billing & tax records — retained by Paddle (and by us where required) for up to 7 years to meet legal/tax obligations.
• Security & access logs — retained for up to 12 months for fraud prevention and incident response.
• After account deletion — your profile, run history, saved outputs, and other personal data stored by Spec AI are erased immediately and irreversibly. Backups containing residual data are overwritten in the normal backup rotation (within 30 days). Billing records that we are legally required to keep are retained by Paddle as described above.
• Trial abuse prevention — to prevent the same person from repeatedly re-registering to obtain new free trials, we retain a one-way salted SHA-256 hash of the email address associated with any account that has consumed a free trial. This hash cannot be reversed to recover the original email address, is never shared with third parties, and is used only to detect returning trial users at signup.

7. What we never do

• We do not sell your personal data.
• We do not share your supplier data, product inputs, or AI outputs with other Spec AI users.
• We do not use your inputs or AI outputs to train AI models.
• We do not run advertising or third-party tracking pixels on the Service.

8. Your rights

Depending on where you live, you may have the following rights in relation to your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — delete your account and associated data at any time from Settings → Delete account. Deletion is immediate and irreversible.
• Restriction & objection — restrict or object to certain processing.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — for anything processed on the basis of consent.
• Complain to a supervisory authority — UK/EEA residents may complain to their local data protection authority (e.g. the UK ICO).

To exercise any of these rights, email mahinkhattak@gmail.com. We aim to respond within 30 days.

9. Security

We implement appropriate technical and organisational measures to protect your data, including: encryption in transit (HTTPS/TLS), encryption at rest by our database provider, hashed passwords, row-level security policies that scope data to your account, access controls, and routine dependency updates. No method of transmission or storage is 100% secure; we cannot guarantee absolute security, but we work to protect your data using industry-standard practices.

10. Cookies & similar technologies

Spec AI uses only strictly necessary cookies and local storage required to authenticate you, maintain your session, and remember basic preferences. We do not use advertising cookies, third-party tracking pixels, or cross-site tracking. Our payment provider Paddle may set its own cookies on its checkout pages, governed by its own policies.

11. Children

The Service is intended for users aged 18 and over for business use. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided data to us, please contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact

For any privacy questions, data subject requests, or complaints:
Mahin Khattak (Spec AI, sole trader) — Hong Kong
Email: mahinkhattak@gmail.com