Privacy Policy

This Privacy Policy explains how Spec AI ("Spec AI", "we", "us", "our") collects, uses, stores, shares, and protects personal data when you visit usepec.com or use the Spec AI platform (the "Service"). Spec AI is operated by Mahin Khattak, an individual trading as Spec AI, and acts as the data controller of personal data processed through the Service. By using the Service you also agree to our Terms of Service and Refund Policy.

1. Information we collect

We collect only the information needed to operate the Service. Specifically:

• Account information — name, email address, company name, password hash (we never store plaintext passwords), and authentication identifiers if you sign in with Google.
• Tool inputs — product descriptions, supplier data, RFQ details, costing assumptions, translations, and any other content you enter into Spec AI tools.
• Generated outputs & run history — the AI-generated documents, comparisons, and estimates produced for your account, plus timestamps and which tool was used.
• Spec Agent conversations — in Standard mode, the messages you send to the Spec Agent, its replies, the tools it called and the timestamps are stored in your account so you can reopen a thread. In tenant-resident mode the conversation is ephemeral: it is held in your browser for the session only and is not written to our database. Files you attach to a chat are processed in memory and their bytes are never stored; text extracted from them may appear in a stored Standard-mode transcript.
• Subscription & billing metadata — plan, status, trial dates, and usage counters. We never see or store your card details. Payments are processed by Paddle, our Merchant of Record.
• Technical & usage data — IP address, browser type, device type, pages viewed, referring URL, and basic event logs needed for security and reliability.
• Support communications — the contents of any email or message you send us.

We do not knowingly collect data from anyone under 18. Spec AI is intended for business use only.

2. How we use your data

• Provide the Service — create your account, run AI tools, and store your run history so you can retrieve past outputs.
• Process payments & subscriptions — through Paddle as Merchant of Record.
• Improve the Service — aggregated, non-identifying analytics about which features are used.
• Security & fraud prevention — detect abuse, prevent unauthorised access, and enforce our Terms.
• Customer support — respond to your questions and resolve issues.
• Service & billing notifications — confirmations, receipts, password resets, and important changes. You can opt out of optional product updates at any time.
• Legal compliance — meet tax, accounting, and other legal obligations.

3. Legal bases for processing (GDPR / UK GDPR)

• Performance of a contract — to deliver the Service you signed up for.
• Legitimate interests — to keep the Service secure, prevent abuse, and improve our product, in a way that does not override your rights.
• Legal obligation — for tax, accounting, and lawful requests from authorities.
• Consent — for any optional marketing communications, which you can withdraw at any time.

4. Where your data goes — subprocessors & integrations

We do not sell your data. We share data only with the vetted third parties below, strictly to provide the Service. Each is contractually bound to handle data securely.

We may also share data with professional advisers (legal, accounting) or with authorities where required by law, court order, or to protect the rights, property, or safety of Spec AI, our users, or the public.

5. Data residency modes

Every workspace runs in one of two modes, which you choose in Settings → Data residency:

• Standard mode — tool inputs and outputs, run history, Library records and Spec Agent transcripts are stored in our managed database (Supabase, Singapore) and AI runs on our managed gateway.
• Tenant-resident mode — document content is read from your Microsoft 365 tenant only at the moment it is needed, processed in memory for a single request, and discarded. We store metadata receipts only: identifiers, timestamps, content hashes and the derived figures our calculations produce. Spec Agent conversations are ephemeral. AI requests go to the endpoint you configure, never to our shared gateway; if none is configured, AI features are refused rather than falling back.

Every AI call, Microsoft read, outbound lookup and residency setting change is written to an append-only audit log in your account, recording the data class involved and whether content was stored. You can read and export it at any time.

These modes are technical controls provided on a best-efforts basis and described so you can evaluate them. They are not a certification and do not, on their own, make your organisation compliant with any law (including the Saudi PDPL and NCA Cloud Cybersecurity Controls, the UAE PDPL, or the UK/EU GDPR). Authentication, the workspace database, payment processing and application hosting always sit with the subprocessors listed above and cannot be moved into your tenant. If you believe the Service has behaved differently from this description, contact us immediately at mahinkhattak@gmail.com so we can investigate and correct it. See also our Data Flow & Residency Map.

6. International data transfers

Spec AI is operated from Hong Kong, and our subprocessors are located in the United States, United Kingdom, Singapore, and the EU. Where personal data of UK/EEA residents is transferred outside the UK/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or equivalent mechanisms offered by our subprocessors.

7. Data retention

• Account, tool inputs, run history, generated outputs — retained for as long as your account is active.
• Billing & tax records — retained by Paddle (and by us where required) for up to 7 years to meet legal/tax obligations.
• Security & access logs — retained for up to 12 months for fraud prevention and incident response.
• Spec Agent transcripts — in Standard mode, retained until you delete the thread or your account; in tenant-resident mode, not retained at all.
• Audit log entries — append-only records of AI calls, Microsoft reads and residency changes are retained for the life of your account and cannot be edited.
• After account deletion — your profile, run history, saved outputs, and other personal data stored by Spec AI are erased immediately and irreversibly. Backups containing residual data are overwritten in the normal backup rotation (within 30 days). Billing records that we are legally required to keep are retained by Paddle as described above.
• Trial abuse prevention — to prevent the same person from repeatedly re-registering to obtain new free trials, we retain a one-way salted SHA-256 hash of the email address associated with any account that has consumed a free trial. This hash cannot be reversed to recover the original email address, is never shared with third parties, and is used only to detect returning trial users at signup.

8. What we never do

• We do not sell your personal data.
• We do not share your supplier data, product inputs, or AI outputs with other Spec AI users.
• We do not use your inputs or AI outputs to train AI models.
• We do not run advertising or third-party tracking pixels on the Service.

9. Your rights

Depending on where you live, you may have the following rights in relation to your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — delete your account and associated data at any time from Settings → Delete account. Deletion is immediate and irreversible.
• Restriction & objection — restrict or object to certain processing.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — for anything processed on the basis of consent.
• Complain to a supervisory authority — UK/EEA residents may complain to their local data protection authority (e.g. the UK ICO).

To exercise any of these rights, email mahinkhattak@gmail.com. We aim to respond within 30 days.

10. Security

We implement appropriate technical and organisational measures to protect your data, including: encryption in transit (HTTPS/TLS), encryption at rest by our database provider, hashed passwords, row-level security policies that scope data to your account, access controls, and routine dependency updates. No method of transmission or storage is 100% secure; we cannot guarantee absolute security, but we work to protect your data using industry-standard practices.

11. Cookies & similar technologies

Spec AI uses only strictly necessary cookies and local storage required to authenticate you, maintain your session, and remember basic preferences. We do not use advertising cookies, third-party tracking pixels, or cross-site tracking. Our payment provider Paddle may set its own cookies on its checkout pages, governed by its own policies.

12. Children

The Service is intended for users aged 18 and over for business use. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided data to us, please contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

14. Contact

For any privacy questions, data subject requests, or complaints:
Mahin Khattak (Spec AI, sole trader) — Hong Kong
Email: mahinkhattak@gmail.com