Privacy Policy

This Privacy Policy explains how Spec AI ("Spec AI", "we", "us", "our") collects, uses, stores, shares, and protects personal data when you visit usepec.com or use the Spec AI platform (the "Service"). Spec AI is operated by Mahin Khattak, an individual trading as Spec AI, and acts as the data controller of personal data processed through the Service. By using the Service you also agree to our Terms of Service and Refund Policy.

1. Information we collect

We collect only the information needed to operate the Service. Specifically:

• Account information — name, email address, company name, password hash (we never store plaintext passwords), and authentication identifiers if you sign in with Google or Microsoft, and your acknowledgement of the account terms at sign-up.
• Tool inputs — product descriptions, supplier data, RFQ details, costing assumptions, translations, and any other content you enter into Spec AI tools.
• Generated outputs & run history — saved documents, comparisons, estimates, imported source references and review records, plus timestamps and which tool was used. Connected-source scans may store item identifiers, titles, senders, dates, links and, in Standard mode, short previews; saved Library entries and comparison records may contain information extracted from those sources.
• Spec Agent conversations — in Standard mode, the messages you send to the Spec Agent, its replies, the tools it called and the timestamps are stored in your account so you can reopen a thread. In tenant-resident mode the conversation is ephemeral: it is held in your browser for the session only and is not written to our database. Files you attach to a chat are processed in memory and their bytes are never stored; text extracted from them may appear in a stored Standard-mode transcript.
• Connected sources — if you connect Microsoft 365 or Google Workspace, we process the account identifiers, connection credentials, and the messages, attachments or files you choose to scan or open. To make this possible, the permissions you grant allow read access to the mail and files of the connected account; Spec AI only reads the items you open or import, or that Auto Quote Watch checks on the schedule you choose, and you can revoke access at any time from Settings or your Google/Microsoft account. Gmail and Microsoft mail and file sources support import and Spec Agent reads; Google Drive can also receive exports you request. If a workspace owner switches on Auto Quote Watch, Spec AI reads the selected connected sources on the chosen schedule in the background to find supplier quotes for active sourcing projects, and saves matching quotes (as PDFs, with extracted figures) to that workspace. In tenant-resident mode no document copy or full text is kept: only a reference to the original item plus the key quote figures needed for review and duplicate detection (supplier name, prices, currency, MOQ, lead time and quote reference). It can be switched off at any time in Settings.
• Subscription & billing metadata — plan, status, trial dates, and usage counters, and Enterprise seat assignments (including member email addresses).We never see or store your card details. Payments are processed by Paddle, our Merchant of Record.
• Technical & usage data — IP address, browser type, device type, pages viewed, referring URL, and basic event logs needed for security and reliability.
• Support communications — the contents of any email or message you send us.

In an Enterprise workspace, the owner and accounts assigned seats share the company profile, product Library and supplier Library. Edits by one member are visible to the others. Only assign a seat to someone authorised to access those records; other account data is not automatically shared with every Spec AI user.

We do not knowingly collect data from anyone under 18. Spec AI is intended for business use only.

2. How we use your data

• Provide the Service — create your account, run AI tools, and store your run history so you can retrieve past outputs.
• Enable workspace collaboration — manage Enterprise seats and show shared Library changes to authorised members.
• Process payments & subscriptions — through Paddle as Merchant of Record.
• Improve the Service — first-party usage analytics (pages visited, browser type, approximate country and, when signed in, your account) to understand which features are used. See section 11.
• Security & fraud prevention — detect abuse, prevent unauthorised access, and enforce our Terms.
• Customer support — respond to your questions and resolve issues.
• Service & billing notifications — confirmations, receipts, password resets, and important changes. You can opt out of optional product updates at any time.
• Legal compliance — meet tax, accounting, and other legal obligations.

3. Legal bases for processing (GDPR / UK GDPR)

• Performance of a contract — to deliver the Service you signed up for.
• Legitimate interests — to keep the Service secure, prevent abuse, and improve our product, in a way that does not override your rights.
• Legal obligation — for tax, accounting, and lawful requests from authorities.
• Consent — for any optional marketing communications, which you can withdraw at any time.

4. Where your data goes — subprocessors & integrations

We do not sell your data. The providers below process information needed to provide the Service. AI providers may change when an administrator changes a Standard-mode model or when a tenant-resident workspace configures its own endpoint. Their own processing terms, retention and location may differ; we do not promise that every available model has the same training or data-retention terms. Contact us if you need the current model/provider list before submitting sensitive information.

AI requests are not limited to the text typed into a single form: when you ask Spec Agent to inspect your workspace or connected sources, relevant profile, Library, quote, history, audit and source content can be sent to the selected model to answer your request. Review the model and provider terms applicable to your workspace before submitting sensitive data.

We may also share data with professional advisers (legal, accounting) or with authorities where required by law, court order, or to protect the rights, property, or safety of Spec AI, our users, or the public.

5. Data residency modes

Every workspace runs in one of two modes, which you choose in Settings → Data residency:

• Standard mode — tool inputs and outputs, run history, Library records and Spec Agent transcripts are stored in our managed database (Supabase, Singapore). AI runs through our OpenRouter connection using a model selected per feature by an administrator; the default model is not a fixed promise of which provider will process your next request.
• Tenant-resident mode — document content is read from your Microsoft 365 tenant when needed, processed in memory for a request, and discarded rather than saved as original document content. We can retain source metadata, content hashes, structured business records and derived figures. Spec Agent conversations are not saved as transcripts by Spec AI in this mode. AI requests go to the endpoint you configure, never to our shared gateway; if none is configured, AI features are refused rather than falling back. Tenant-resident does not mean in-region processing if you choose a globally routed endpoint such as OpenRouter; check your endpoint's routing and provider terms.

Every AI call, Microsoft read, outbound lookup and residency setting change is written to an append-only audit log in your account, recording the data class involved and whether content was stored. You can read and export it at any time.

These modes are technical controls provided on a best-efforts basis and described so you can evaluate them. They are not a certification and do not, on their own, make your organisation compliant with any law (including the Saudi PDPL and NCA Cloud Cybersecurity Controls, the UAE PDPL, or the UK/EU GDPR). Authentication, the workspace database, payment processing and application hosting always sit with the subprocessors listed above and cannot be moved into your tenant. If you believe the Service has behaved differently from this description, contact us immediately at mahin@usepec.com so we can investigate and correct it. See also our Data Flow & Residency Map.

6. International data transfers

Spec AI is operated from Hong Kong, and our subprocessors are located in the United States, United Kingdom, Singapore, and the EU. Where personal data of UK/EEA residents is transferred outside the UK/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or equivalent mechanisms offered by our subprocessors.

7. Data retention

• Account, tool inputs, run history, generated outputs — retained for as long as your account is active.
• Billing & tax records — retained by Paddle (and by us where required) for up to 7 years to meet legal/tax obligations.
• Security & access logs — retained for up to 12 months for fraud prevention and incident response.
• Spec Agent transcripts — in Standard mode, retained until you delete the thread or your account; in tenant-resident mode, not retained at all.
• Auto Quote Watch documents — saved quote PDFs and extracted figures are kept in your workspace until you delete them or your account; dismissed items stay in the Dismissed list so the same quote is not offered again. In tenant-resident mode no document copy is kept.
• Audit log entries — append-only records of AI calls, Microsoft reads and residency changes are retained for the life of your account and cannot be edited.
• After account deletion — account-associated data is deleted from the active service subject to shared-workspace ownership, the trial-abuse record, legal obligations and backup retention. Backups may retain residual data until overwritten in the normal rotation (within 30 days). Paddle retains billing records under its own obligations.
• Trial abuse prevention — we retain a deterministic salted SHA-256 hash of a normalised sign-up email in a restricted trial ledger to detect repeat sign-ups, including after account deletion. A hash is pseudonymous, not anonymous: someone with access to the hashing method and a candidate email could test a match. We do not expose the ledger to other users.

8. What we never do

• We do not sell your personal data.
• We do not share your supplier data, product inputs, or AI outputs with unrelated Spec AI workspaces; authorised Enterprise seat holders can access the shared Library and company profile.
• We do not train our own AI models on your inputs or outputs. External model providers' use of data depends on the provider and endpoint selected; do not assume identical training settings across all models.
• We do not run advertising or third-party tracking pixels on the Service.

9. Your rights

Depending on where you live, you may have the following rights in relation to your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion or delete your account from Settings → Delete account, subject to the retention exceptions described above.
• Restriction & objection — restrict or object to certain processing.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — for anything processed on the basis of consent.
• Complain to a supervisory authority — UK/EEA residents may complain to their local data protection authority (e.g. the UK ICO).

To exercise any of these rights, email mahin@usepec.com. We aim to respond within 30 days.

10. Security

We implement appropriate technical and organisational measures to protect your data, including: encryption in transit (HTTPS/TLS), encryption at rest by our database provider, hashed passwords, access rules that scope data to your account or authorised workspace, access controls, and routine dependency updates. No method of transmission or storage is 100% secure; we cannot guarantee absolute security, but we work to protect your data using industry-standard practices.

11. Cookies & similar technologies

Spec AI uses cookies and local storage to authenticate you, maintain your session, and remember basic preferences. We also use first-party analytics: for each page visit we record the page, referring page, browser type, approximate country, a random session identifier and, when you are signed in, your account. These records are kept for up to 12 months and are never shared with advertisers. We do not use advertising cookies, third-party tracking pixels, or cross-site tracking. Our payment provider Paddle may set its own cookies on its checkout pages, governed by its own policies.

12. Children

The Service is intended for users aged 18 and over for business use. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided data to us, please contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

14. Contact

For any privacy questions, data subject requests, or complaints:
Mahin Khattak (Spec AI, sole trader) — Hong Kong
Email: mahin@usepec.com