Privacy notice
What Mason collects about the people who use it and the agreements they put into it, why, where it goes, how long it stays, and what you can ask us to do about it.
1. Who we are
Mason is a service provided by Intergen Technology Inc., Bridgetown, Barbados. For the personal data described in this notice, Intergen acts as the controller under the Data Protection Act, 2019 of Barbados. CONFIRM confirm that Intergen Technology Inc. is the controller entity, its registered company details and registered office, and the address this notice should give.
Where a ministry or another organisation uploads its own agreements, that organisation may be the controller of the content of those agreements, and Intergen may act as its processor. COUNSEL decide the controller and processor roles for agreement content uploaded by a ministry, and whether a written data processing agreement is needed before the first such workspace is opened.
2. What we collect
- Account details: your email address, which is where sign-in codes and sign-in links are sent; your display name, if you give one; and your password, if you choose to set one. Passwords are handled by our authentication provider, Supabase Auth.
- Workspace and membership data: the name of each workspace you belong to, your role in it (owner, admin, reviewer or member), invitations you have sent or accepted, and your onboarding and account preferences.
- Agreements you upload: the original file, stored as uploaded, and the text Mason extracts from it, including clauses, defined terms, parties, dates and the structure of the document.
- Review output: the findings, obligations, key dates, positions, playbook rules and review runs that Mason produces from your agreements, and the decisions reviewers record on them.
- AI advisory output: the suggestions and rationales produced by the AI review described in section 4, and a record of each run.
- Audit record: a record of actions taken in a workspace, the person who took each action, and when. The record is kept as a hash chain, so that later changes to it can be detected.
- Share records: for an agreement shared by link, who created the share, its expiry and status, and a log of each attempt to open the link. Share links are stored only as hashes. The log stores a hashed network address and, where the reader was signed in, their account.
- Connections: if you connect an AI assistant or another client to your account, the connection, the consent you gave for it, the client's registration with our authentication provider, and a record of each request it makes.
- Invitation and sending records: every address Mason has sent an invitation or share email to on a workspace's behalf, who sent it, and when. These rows are kept rather than pruned. Mason's database holds no table of message bodies, and its logs are written so that full email addresses and message bodies are not recorded.
- Technical records: the server and hosting logs that web services keep, which can include network addresses, browser type and request times. CONFIRM confirm how long hosting and server logs are kept, and by which provider.
3. Why we use it
We use this information to sign you in and keep your workspace secure; to store, parse and review the agreements you upload; to send the invitations and sharing emails you ask for; to keep the audit record that shows who did what; to answer support requests; and to meet our legal obligations. COUNSEL state the legal basis for each of these purposes under the Data Protection Act, 2019, and the wording to use where the customer is a public body.
4. AI review of agreement text
When an advisory AI review runs, Mason sends Anthropic, which operates the Claude models, more than the clause under review. Each request can include: the text of the clauses under review; Mason's review instructions; the settled positions and playbook rules that apply to the agreement; similar clauses drawn from other agreements in the same workspace; and past reviewer decisions recorded in the workspace. Anthropic returns advisory output, and Mason stores it with the review. A review runs automatically after an agreement is uploaded, and when a member runs one by hand. Mason sends this material to Anthropic only when an advisory AI review runs, and for no other purpose. CONFIRM confirm whether AI review is switched on for pilot workspaces by default, and at which review levels the advisory skills run, and therefore which of these items are sent.
Under Anthropic's commercial terms, data sent through the API is not used to train its models by default. COUNSEL confirm this against the terms Intergen has actually signed, and whether sending settled positions, playbook rules, clauses from other agreements in the workspace and past reviewer decisions is within those terms. CONFIRM confirm whether a zero-data-retention arrangement with Anthropic has been requested and agreed, and how long Anthropic keeps request data if it has not.
5. Who processes your data
We use the service providers below (sub-processors). Each acts on our instructions, for the purpose shown.
| Provider | What it handles | Where it is processed | Purpose |
|---|---|---|---|
| Supabase | Database, file storage for uploaded agreements, authentication, and sign-in codes and links. Connected clients' OAuth registrations and grants are stored here too. CONFIRM confirm whether sign-in codes are sent by Supabase's built-in mailer or through Resend once custom SMTP is set, and that connector OAuth registrations are stored in the production project and for how long. | United States, us-east-1 region. CONFIRM confirm the production project region. | Stores Mason's data; signs you in |
| Vercel | Hosts the Mason web application and server code; sees request traffic in transit | United States. CONFIRM confirm the function and deployment region. | Runs Mason |
| Anthropic | Clause text and review instructions, only when an AI review runs (section 4) | United States | AI advisory review |
| Mandatum (an Intergen platform at mandatum-indol.vercel.app) | Full document files for parsing; citations and statute search terms for checking | CONFIRM confirm Mandatum's hosting region in writing. | Parsing and statute checking |
| Railway | Reported to host Mandatum's parsing service. Mason does not contract with Railway directly. | CONFIRM confirm with Mandatum that Railway hosts its parsing service, and the region. | Parsing, through Mandatum |
| Resend | Recipient email address, and the body of invitation and sharing emails. Sign-in codes too, once Supabase Auth's email is routed through Resend. | CONFIRM confirm Resend's sending region. | Sending email |
| Paddle.com Market Ltd (Paddle) | The name and email address of the person paying for a paid redline, and the price and transaction details of the sale. Paddle collects the payment details itself; Mason receives only whether the payment was taken and its transaction id, never card numbers. | CONFIRM confirm Paddle's processing region and the data transfer terms for paid redlines | Taking payment for paid redlines, as merchant of record |
When you connect an AI assistant or another client to your Mason account, that client acts for you and can read what you are allowed to read. Its operator's own terms govern what it does with that data. Mason returns data to a connected client only in answer to a request the client makes with your authorisation.
6. Transfers outside Barbados
Most of the providers above process data in the United States, so your data leaves Barbados when you use Mason. The Data Protection Act, 2019 sets conditions for such transfers. COUNSEL state the transfer mechanism relied on (for example consent, performance of a contract, or the safeguards the Act provides), its legal basis, and whether ministry customers must be told before their data moves.
7. How long we keep it
Mason keeps your data for as long as your workspace or account stays open. The points below describe what happens when you close something, as the service deletes data today.
- Leaving a workspace removes your membership. The workspace and its agreements stay with the workspace and its other members.
- Closing a workspace, which any owner can do even while other members remain, deletes the workspace and every row that belongs to it. Everyone in it loses access when it closes. Mason sends no email to the other members about it. CONFIRM confirm whether closing should instead require the other members to be removed first. That includes its agreements and their versions, extracted text, clauses, structure, findings, obligations, key dates, definitions, review runs and AI run records, playbooks and their rules, settled positions, invitations and invitation records, memberships, share links, share access log and audit record. Stored files are removed from file storage first; the closure does not complete while any stored file remains.
- Redline billing records are not deleted with the workspace. They are kept for accounting, and hold the workspace's id and name, the agreement and version identifiers, who issued each redline, the workspace's owners at the time, the price, whether it was free, when it was issued, and the Paddle transaction that paid for it. They hold no agreement text. They keep a one-way fingerprint of the email addresses involved, used only so the first redline is free once per person, not the addresses themselves. CONFIRM confirm the retention period for billing records. CONFIRM confirm with counsel that the fingerprint is disclosed accurately here.
- Closing your account deletes your sign-in record, your memberships and your personal preferences. Your name and email address are cleared from your identity record, which is kept with no name or email attached, so that your name on past work still resolves and the audit record stays intact. You cannot close your account while you are the only owner of a workspace that still has other members.
- Backups held by our providers may keep deleted data until they expire. CONFIRM confirm how long Supabase keeps backups in the production project.
- Email delivery records and hosting logs are kept for CONFIRM confirm the retention periods for Resend and Vercel logs, and for any share and sign-in records not covered above.
8. Your rights and how to use them
Under the Data Protection Act, 2019 you may ask for access to the personal data we hold about you, ask us to correct it, object to some processing, and complain to the regulator. COUNSEL confirm the rights wording, the period within which requests are answered, and the name of the regulator and how to complain to it.
You can do several things yourself. Owners and admins can change a workspace's name from the workspace settings; any member can leave a workspace from there; owners can close a workspace from its settings; and anyone can close their own account from the account pages. For anything else, write to the contact on the Support page. We will check who is asking before we act on a request.
9. How we keep it secure
No service is perfectly secure. These are the measures in place today, described plainly:
- Each workspace's data is kept apart from every other workspace's. Database rules limit each row to members of its own workspace, and each uploaded file is stored under its workspace's path in a private storage bucket.
- Requests you make are carried out with your own session, not with an administrative key, so the database's own access rules apply to them.
- Data moves between your browser, Mason and its providers over HTTPS. Stored data is encrypted at rest by our providers under their default settings. CONFIRM confirm the encryption-at-rest settings of Supabase and Vercel for the production projects.
- Share links are stored only as hashes. The plain link exists only in the email that carries it and in the reader's browser, for a short time.
- Sign-in uses a one-time code or a sign-in link sent to your email, or a password you choose.
- Changes made in a workspace are written to a hash-chained audit record, so changes to the record can be detected. Attempts to open a share link are logged in a separate share access log, which is not part of that chain.
- Access to production systems is limited to CONFIRM confirm who holds production access, and whether multi-factor authentication is required for it.
CONFIRM confirm whether an independent security assessment or penetration test has been completed, and its date if so. COUNSEL confirm the incident notification wording, including the timeline for telling affected customers and the regulator under the Act.
11. Children
Mason is a service for organisations and the people who work in them. It is not directed at children, and we do not knowingly collect personal data from children. If you believe a child's data has been given to Mason, write to the contact on the Support page.
12. Changes to this notice
We will change this notice when Mason's data practices change, and show the date of the current version at the top of the page. CONFIRM confirm how workspace owners will be told about a material change, and how much notice is given before it takes effect.
13. Contact
Questions and requests about this notice go to the contact on the Support page. CONFIRM confirm the privacy contact address. Only founder addresses exist today. COUNSEL decide whether a role address (for example one monitored by more than one person) should replace the founders' personal inboxes as the privacy contact.