Privacy Notice
How M7 handles personal data on mseven.io, in the client portal at portal.mseven.io, and when you speak with Ayn. Written to be read, not skimmed: it is short because we keep little.
If you are about to speak with Ayn — the short version
Ayn is M7's intelligence, and Ayn is AI. What you tell her is kept with your M7 relationship, read by the M7 people working with you, and used to understand your request and prepare our work. Substantive recommendations and deliverables are reviewed by a person before they reach you.
Unless you opt out of improvement use, conversations may be securely evaluated to improve Ayn. Confidential client conversations are not directly promoted into general Ayn knowledge or cross-client training material; broader improvements come through controlled, de-identified/generalized learning.
You can opt out of speaking with Ayn at any time. A complete prohibition on AI processing is a separate founder-reviewed restriction; M7 may decline if it cannot deliver properly under that restriction.
Do not share information you are not authorised to share.
1Who we are
M7 Solutions FZ-LLC, trading as M7, Dubai, United Arab Emirates, is the controller of the personal data described here. Privacy contact: hello@mseven.io.
2Who this notice covers
Visitors to mseven.io; people who contact M7 or speak with Ayn on the website; representatives of clients and prospective clients who use the portal; people who respond to a survey M7 runs for a client; and signatories of agreements executed through the portal. M7's own people are covered separately.
3What we collect, and where it comes from
| Data | From | Why |
|---|---|---|
| Your name, work email, company and role | You, or a colleague who added you | To know who we are working with and to sign you in |
| What you tell Ayn — a project brief, answers to intake questions, files and voice notes you choose to give | You | To understand your request and prepare our work |
| Documents, agreements, invoices and payment status shared with you in the portal | M7 | To deliver the engagement. We do not hold card or bank credentials; payment and signature are executed in the portal and only their status is recorded |
| Survey responses | Survey respondents, through a link | Research M7 runs for a client; responses stay in the survey system and are read for that engagement only |
| Signature records: name, time, IP address and browser, every event | The signing page | Evidence that an agreement was signed; kept append-only |
| Sign-in and audit records | The systems | Security and accountability for Ayn's answers |
On mseven.io we set no analytics cookies.
4Ayn and the AI behind her
M7 is human-led and AI-enabled. Ayn is M7's custom-built intelligence, governed by the M7 Brain — M7's system of method, evidence and rules — and by human judgment. Ayn helps M7 understand, organise, retrieve and draft. She does not decide, price, sign, pay, or give legal or regulated advice, and substantive recommendation, strategy, design direction or deliverable is subject to appropriate human review and approval.
M7 does not disclose its proprietary prompts, routing or orchestration. Provider and subprocessor information is disclosed only to the extent legally or contractually required.
Speech. You can speak to Ayn and she can speak to you. When you use the microphone, the recording is sent through M7 to our voice provider, ElevenLabs, which turns it into text and returns the text; when Ayn reads a reply aloud, her words go to the same provider, which returns the audio. Nothing is kept as audio by M7; the text takes the same path a typed message takes.
On the website, Visitor Ayn records what a visitor chooses to tell her as an enquiry for M7's founders to read, together with internal notes. Those notes are not shown to the visitor and do not decide whether M7 opens a Case. Ayn does not remember an anonymous visitor between visits; where continuity is wanted, she offers sign-in.
5Where your data is kept, and who processes it
| Provider | What | Where / transfer note |
|---|---|---|
| Supabase | Database and file storage behind the portal and M7 Workspace | Frankfurt, Germany (EU) |
| Vercel | Hosting of mseven.io and the portal; code handling requests | United States |
| Anthropic | Provider used through the API for Ayn's model processing | No EU inference region currently available for the relevant API processing; client material sent to Anthropic may leave the EU during inference. Signing data is not sent to Ayn. |
| ElevenLabs | Ayn's voice: turning what you say into text, and her replies into speech, only when you use the microphone or ask her to read aloud | United States; the audio is processed for the request and not kept by M7 |
| Resend | Email M7 sends — sign-in codes, invitations, notifications | United States |
| Zoho Mail | Fallback email transport, used only when primary is unavailable | United States |
| GitHub | Version control of M7's own knowledge system | United States; client personal data is excluded by design |
M7 must document the applicable transfer safeguards and legal basis for each relevant cross-border route. The Anthropic route is a material transfer consideration because Brain/client material processed by Ayn may leave the EU. This does not alter the signing flow: no signing data is sent to Ayn.
Within M7, access is need-to-know: people working on the engagement and founders. External specialists receive only what their role requires. No client can see another client's data, and this is tested, not assumed.
6How long we keep it
| What | How long |
|---|---|
| Conversations with Ayn | While the Case/Engagement is active + 12 months after closure, subject to legal/contractual obligations and applicable deletion rights |
| A conversation M7 archives because it matters to the engagement | Within the same Case/Engagement lifecycle; material intelligence is separately captured into proper engagement/Brain records. It is not visible to the client unless M7 shares it |
| Your account, documents, agreements and invoices | For the life of the relationship and the period the law requires for contractual and tax records |
| Signature records | Indefinitely as evidence of the agreement, unless deletion is required by law |
| Survey responses | For the engagement they serve and the period the law requires, subject to the declared survey design and applicable deletion rights |
| Website enquiries through Ayn | Twelve months from your last contact where no relationship with M7 follows, then deleted |
We do not keep information because it might be useful one day.
7Your rights
You may ask what we hold about you, ask us to correct it, ask us to delete it, object to a use, or withdraw a consent you gave, subject to applicable law and contractual obligations. Write to hello@mseven.io.. You may also ask to deal only with people, not with Ayn, and we will arrange it. A complete prohibition on AI processing is subject to founder review.
8Security
Role-based access, least privilege, row-level isolation between clients, append-only audit and signature trails, encrypted transport and storage, and an incident procedure. No system is perfectly secure; if an incident affects you, we tell you.
9Changes
This notice is versioned. A material change is dated here and, where it affects you, told to you in the portal. Version 0.2 · 18 September 2026 · a copywriter's revision (V1) follows.