Max HQ Privacy Notice

Who this notice covers

This notice explains how Max HQ, the MaxERP employee app, handles information. The MaxERP website and service are operated by MERP TECHNOLOGIES L.L.C. Your organization manages its workspace and determines how employment records are used. We provide the service for that organization and handle account, security and support information to operate it.

This notice supplements our platform privacy policy with Max HQ-specific details. For questions, contact [email protected].

Information used by Max HQ

• Account and employment information: your name, email, account and employee identifiers, organization membership, role, profile and team information.
• Work records: attendance, leave requests and balances, approvals, published payslips and expense information, documents, announcements and HR support messages, according to your organization’s enabled features.
• Location: coordinates and accuracy when you perform an attendance action that needs location verification. Max HQ does not need continuous background location tracking for attendance.
• Files and photos: documents and images you choose to upload, and camera images you take for an upload. The camera can also scan attendance QR codes.
• AI conversations: prompts, relevant conversation history, replies and work information retrieved to answer your question.
• Device and service information: notification tokens and preferences, app/device details, request and error information, and AI usage records used for delivery, reliability, security and service administration.

Why information is processed and who can access it

Information is used to authenticate you, connect you to your organization, provide employee workflows, deliver enabled notifications, answer requests and protect and maintain the service. Your organization’s authorized administrators and approvers can access records according to their roles. Do not assume workplace records or HR requests are private from your organization.

Service providers process information needed for hosting, authentication, database and file storage, notifications, support and AI. Max HQ uses Supabase for authentication and data services, Vercel for application hosting, and Expo and Apple services for mobile delivery and enabled notifications. OpenAI processing is explained below. Information may also be disclosed where required by law or necessary to address abuse or protect rights.

Optional Max AI and OpenAI sharing

When you choose to use Max AI and allow sharing, Max HQ sends your message, relevant chat history and information retrieved for your question to OpenAI to generate a response. Depending on the question, this can include profile information, attendance, leave, payslip details, document information and HR requests. It is not limited to the text you type.

Do not enter information you do not want shared with the AI provider. You can decline sharing and use the other app features. Consent is remembered for your account and workspace on that device. Withdraw permission in AI Settings to stop new AI requests until you consent again. Withdrawal does not erase conversations or information already processed.

MaxERP stores conversation and usage records to provide history and operate the service. OpenAI may retain API data under its service terms and data controls; we do not promise zero retention. See OpenAI’s API data controls. To request deletion of stored conversations, follow the data request instructions.

Permissions and your choices

Location, camera, photo access, microphone, speech recognition and notifications are requested for the features that need them. You can manage permissions in iPhone Settings. Denying a permission can make the associated feature unavailable.

Voice dictation uses device speech recognition and may use Apple’s speech services. Audio is transcribed into an editable draft. Max AI receives the text when you send it, rather than a recording uploaded as part of the chat request. The app does not provide facial-recognition attendance.

Retention, deletion and international processing

Work records are retained according to your organization’s requirements and applicable obligations. Account, conversation, support and security records are retained as needed to provide the service, handle requests and meet applicable obligations. There is no single deletion period for all employment records. Deleting the app or signing out does not delete server-side records.

You can request access, correction, account closure or deletion through your organization or [email protected]. We may need to verify your identity and coordinate with your organization. Some employment, payroll or other records may need to be retained; we will explain applicable limitations. Backup copies can remain until their normal retention cycle expires.

Service providers may process information outside your country, including outside the UAE. Applicable contractual and legal requirements govern these transfers. Contact us for information relevant to your organization’s arrangement. We use access controls and HTTPS to protect service access; no service can guarantee absolute security.

Website visits and notice changes

This support website is separate from the native app and includes Google Analytics and a Tawk.to chat widget. Visiting the website or using its chat can involve those services. See the website and platform privacy policy. Their presence on this website does not mean those widgets are embedded in Max HQ.

We update this notice when practices change and show the revision date above. Material changes to AI sharing will require an updated disclosure in the app. Contact [email protected] with privacy questions or Max HQ support for technical help.