Privacy policy

1. Who is responsible

Mello Group, 37, Jalal Eddine Sayouti, Racine, Casablanca, Morocco, is responsible for the personal data processed through Mello and this website. Contact for any privacy question: hello@iagency.ma.

We process personal data in accordance with Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data and, for people in the European Union, the General Data Protection Regulation (GDPR).

2. What we collect

Account data: name, email address, organisation, role and preferences. Content: the files, versions, comments and decisions you add, and the approval receipts that record them. External approvers: their email address and their decisions. Billing: plan, invoices and payment status — card details are handled by Stripe and never reach us. Messages you send through our contact form. Technical data: IP address, browser, device and security logs needed to run the service securely. Connected services: if you link Zoom or Google, the data described in the sections on Google and Zoom below.

3. Why we use it

To provide the service and keep a record of approvals (performance of our contract with you); to bill paid plans and keep accounting records (legal obligation); to secure the platform, prevent abuse and improve the service (our legitimate interest); to answer your messages (your request); and to connect Zoom, Google or Microsoft when you choose to (your consent, which you can withdraw by disconnecting them).

We do not sell your data, do not use it for advertising and do not use it to train AI models.

4. Who processes it with us

Vercel (hosting of the website and the app), Convex (application database), Stripe (payments), Resend (sending emails), OpenRouter (the AI assistant, only when you use it), and Zoom, Google and Microsoft only when you connect them. Each acts on our instructions under a data processing agreement and may only use your data to provide its service to us.

5. Google user data

Mello connects to Google in two separate, optional ways, and accesses only the data described here.

Sign in with Google. If you choose to sign in with Google, Google shares your name, email address, profile picture and Google account identifier with us (the openid, email and profile permissions). We use them only to create your Mello account and sign you in. The sign-in tokens Google returns are stored with your account and are not used to call any other Google service.

Google Meet. If you connect Google Meet, Mello requests a single permission, meetings.space.created. It lets Mello create Meet meeting spaces on your behalf and read back only the spaces Mello created. When you schedule a meeting in a Meeting Room, Mello creates a space and stores its link and identifier with that meeting so participants can join. Mello cannot see your calendar, your other meetings, your contacts, your emails, your files or your Google profile, and it writes nothing to your Google Calendar.

Storage and sharing. The access and refresh tokens Google issues are stored in our application database (Convex), encrypted at rest, and used only on our servers: they never reach your browser. Google user data is not sold, not used for advertising, not used to train AI models, and not shared with anyone other than the hosting providers needed to run the service (Vercel and Convex). No Google user data is sent to OpenRouter or to any other AI service. Our staff do not read it, except with your permission, to investigate a security incident, or when the law requires it.

Retention and deletion. Google Meet tokens are kept for as long as Google Meet stays connected. Disconnecting Google Meet in Mello deletes them from our database immediately; you can also revoke Mello’s access at any time at myaccount.google.com/permissions, after which the tokens stop working. Meeting links already created stay on their meetings, as part of the project history, until the meeting, project or organisation is deleted. Sign-in data is kept while your account exists and deleted within 90 days of its closure. To have your Google data deleted sooner, write to hello@iagency.ma.

Mello’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Zoom user data

Mello connects to Zoom only if you choose to link your Zoom account, from Integrations in the app.

What we access. Mello requests five permissions: meeting:write:meeting and meeting:read:meeting, to create meetings on your account and read them back — including which of your meetings is running when Zoom refuses to start a new one; user:read:user, to know which Zoom account is linked (its user ID and display name); user:read:zak, a short-lived key that lets you start your own meeting as host inside Mello, used at that moment and never stored; and cloud_recording:read:list_recording_files, to list the recordings of meetings created in Mello. When a cloud recording of such a meeting is ready, Zoom also sends us a notification describing it.

What we store. Your Zoom user ID and account name; the access and refresh tokens Zoom issues; for each meeting created in Mello, its number, passcode, join link and host ID; for each recording, its file ID, type, size, start and end time, topic, duration, playback and share links and playback passcode. We do not store the audio, video, chat or transcript of your meetings: they travel directly between your browser and Zoom, and recording files stay in your Zoom cloud.

How we use it. Only to create, start and join the meetings you schedule in Mello, and to show their recordings to the members of the project they belong to. Data received from Zoom is not sold, not used for advertising, not used to train AI models, not sent to OpenRouter or any other AI service, and not shared with anyone other than the providers that host the service (Vercel and Convex). Our staff do not access it, except with your permission, to investigate a security incident, or when the law requires it.

Storage and security. Zoom tokens are stored in our application database (Convex), encrypted at rest, used only on our servers and never sent to your browser.

Retention and deletion. Zoom tokens and account details are kept while Zoom stays linked. Disconnecting Zoom in Mello, or removing the Mello app from your Zoom account (Zoom App Marketplace → Manage → Added Apps → Remove), deletes them immediately. Meeting details and recording references stay with their meeting, as part of the project history, until the meeting, project or organisation is deleted; you can ask us to delete them sooner at hello@iagency.ma, and we do so within 30 days. Meetings and recordings in your Zoom account are governed by Zoom’s own privacy statement.

7. Transfers outside Morocco

Some of these providers store or process data in the United States and the European Union. These transfers are covered by the providers’ data processing agreements, including the European Commission’s Standard Contractual Clauses where they apply, and are carried out in accordance with Law No. 09-08.

8. How long we keep it

Account data and content: as long as the account is active, then 90 days after closure. Approval receipts: as long as the organisation that requested them keeps its account. Invoices and accounting records: 10 years, as required by Moroccan commercial law. Contact-form messages: 3 years after our last exchange. Security logs: 12 months.

9. Security

Data is encrypted in transit and at rest, access is limited to the people who need it, every account confirms its email address with a code, approval links expire, and data is backed up automatically.

10. Your data protection rights and how to exercise them

Wherever you live, you have the right to: access the personal data we hold about you and receive a copy; have inaccurate data corrected; have your data deleted; object to processing based on our legitimate interest; restrict processing while a request is examined; receive your data in a portable, machine-readable format; withdraw a consent at any time — for example by disconnecting Zoom or Google — without affecting earlier processing; and not be subject to a decision based solely on automated processing, which Mello does not make. These rights come from Moroccan Law No. 09-08 and, for people in the European Union, the GDPR. Residents of California have equivalent rights under the CCPA; we do not sell personal data or share it for advertising.

How to exercise them. Write to hello@iagency.ma with the subject “Data request”, from the email address of your Mello account if you have one, and tell us which right you want to exercise. You can also act yourself in the app: correct your profile in your settings, disconnect an integration in Integrations, or close your account in your settings, which deletes your data as described above. Approvers invited by link can write to us the same way.

We answer within 30 days, free of charge. We may ask you to confirm your identity before acting on a request, and we tell you if the law requires us to keep some data, such as invoices. Someone you authorise can make a request on your behalf, with proof of that authorisation.

If you are not satisfied with our answer, you can complain to your data protection authority: in Morocco, the CNDP (Commission nationale de contrôle de la protection des données à caractère personnel, www.cndp.ma); in the EU, the authority of your country.

11. Children

Mello is a professional service for people aged 18 and over. We do not knowingly collect data about children.

12. Changes

We update this policy when our processing changes, and tell you by email when the change is significant. The date at the top shows the latest version.