Privacy Policy
Last updated 5 November 2026 · Mekanys SRL
MKOS is a business system operated by Mekanys SRL (“Mekanys”, “we”). Our staff use it to run consulting engagements, and people from our clients and partners use its client portal to follow and discuss the work we share with them. This policy explains what it collects, why, and what we do not do with it.
Who this covers
People who sign in to MKOS at mkos.mekanys.com:
- Mekanys staff, with a @mekanys.com Google Workspace account.
- Client and partner people, whom Mekanys invites to a project. They sign in with a code emailed to the address they were invited with. There is no password.
There is no public sign-up. The Google data described below concerns staff only: MKOS does not ask client or partner people for access to any Google data.
Google user data we access
MKOS requests the following Google OAuth scopes. Each is requested only when you take the action that needs it, and each can be withdrawn.
| Scope | Why | What we store |
|---|---|---|
calendar.readonly, and calendar.events for an account connected on Setup | Turn meetings into timesheet suggestions, on your sign-in calendar and on any other Google account you connect for Calendar on the Setup screen and switch on for your timesheet. MKOS only reads those calendars for the timesheet. The calendar.events permission is used only when you ask Claude to act on that calendar. | Event title, start and end time, and two identifiers (the Google event id and iCalUID). Events marked private or confidential are skipped entirely and never leave Google. We do not store attendee lists, descriptions, attachments or locations. |
drive.readonly | List the engagement and project folder tree so documents can be linked. | File and folder names, ids and links for items inside the engagement folders. We do not copy or store file contents. |
drive.file | File a document into the correct project folder — only files MKOS itself creates, or that you explicitly pick. | References to those files. This scope cannot see the rest of your Drive. |
gmail.readonly | File a client email thread against a deal, when you choose to file it. MKOS never reads your mailbox on its own initiative. | For threads you file: subject, sender, timestamps, message and thread ids, a snippet and the message body. Nothing is read or stored for any other thread. |
Limited Use
MKOS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use Google user data for advertising, we do not sell it, we do not transfer it except as needed to provide MKOS or where required by law, and we do not allow humans to read it except with your explicit consent, for security or debugging, or where required by law.
Google user data is not used to train machine-learning or AI models. MKOS includes AI-assisted features; where content is sent to a model provider it is for processing a request you initiated, under agreements that prohibit training on it.
Other information we hold
- Account — your name, work email and profile photo from Google sign-in.
- Work records — the business data you enter: projects, tickets, hours, clients, contacts and invoices.
- Operational logs — errors and request diagnostics used to keep the system working.
Client and partner people
What we hold about you. Your name, work email and organisation, from the invitation. The comments and files you post. When you first signed in. Which comments from Mekanys you have opened: the project team sees this as “Seen by”. The notifications MKOS sends you.
What you can see. Only the tickets Mekanys shares with you, on the projects you are invited to: each ticket's name, description, acceptance criteria, status and estimate, and the client side of its conversation. You never see Mekanys's internal notes, time records or other projects.
Who sees what you post. The Mekanys project team, and the other client and partner people on the same project. The client and the partner share one side of the conversation.
Editing and deleting. You can edit or delete your own comments. Deleting removes the text permanently and leaves a note that a comment was removed. Mekanys's project managers can also edit or remove comments, for example to take out something posted by mistake. Every edit shows who made it. Earlier versions are not kept.
Files. Files you attach are stored in Mekanys's Google Drive, in the project's folder. They pass through our automation server on the way in and out. That server keeps a copy with each run record for 14 days, and its nightly backups hold it for up to about 45 days in all.
Email. Supabase sends your invitation and your sign-in codes through Resend, our email provider. MKOS also emails you when someone comments on a ticket shared with you.
How long. Your access ends when Mekanys removes you from a project, or removes you altogether. Your comments stay part of the project's record, marked as from a former member. Retention otherwise follows “Where it is held, and for how long” below.
Where it is held, and for how long
MKOS runs on Vercel with a Supabase (PostgreSQL) database. Access is restricted to authenticated members of the Mekanys workspace and enforced per row in the database. The database is encrypted at rest by the hosting provider and is reachable only with the application's server-side credentials; Google access and refresh tokens are held there and used only to make the calls described above. They are never sent to a browser. Email is sent through Resend. Files attached in the client portal are stored in Google Drive and pass through our self-hosted automation server (n8n). Its run records are kept for 14 days and its backups for about 31 days more.
Business records are kept for as long as we run the engagement and afterwards as our accounting and contractual obligations require. Calendar suggestions you never act on are transient. Disconnecting a Google account deletes its stored tokens and removes its un-actioned suggestions.
Your choices
- Disconnect Calendar, Drive or Gmail at any time from the Setup screen in MKOS.
- Revoke MKOS from Google Account permissions.
- Client and partner people can ask Mekanys to remove their access at any time, by writing to the address below or to their contact at Mekanys.
- Ask for a copy of, correction of, or deletion of your personal data by writing to the address below. As MKOS is a workplace system, some records must be retained for legal and accounting reasons even after an account is closed.
Contact
Mekanys SRL — hello@mekanys.com. We will respond to privacy requests within 30 days.