Legal

Privacy Notice

Effective 11 October 2026

SpecSense is operated by Mohab Salah in Egypt. For privacy questions and requests, email mohab@specsensehq.com.

This notice covers the public site, pilot applications, and the SpecSense application. An organisation using SpecSense also decides what project and user information its members provide; ask your organisation administrator about its own policies.

Information we receive

For an account, we process names, email addresses, organisation membership, roles, password hashes, protected authentication data, sessions, security events, and support correspondence. In the application we process the schedules, files, project details, scenarios, reviews, exports, prompts, and other content users submit, along with service usage and audit records. We also receive technical information needed to deliver and secure the site and application, such as network addresses, browser or device information, request times, and error logs.

When you join the pilot waiting list, we save your email address, application time, review status and email delivery records. We also use protected identifiers derived from the requesting network address and email address to limit abuse. We send a waiting-list confirmation to the address you provide. If we approve your application, we create a separate pilot workspace and send an invitation with a single-use password-setup link. Joining the waiting list does not itself grant an account or access. These messages concern your application; the form does not subscribe you to advertising emails.

Why we use it

We use information to review pilot requests; create and administer approved accounts; deliver, secure, troubleshoot, and improve the service; respond to support requests; provide requested AI features; maintain operational and audit records; and meet legal obligations. If paid service is introduced, transaction and usage records may also support billing, tax, fraud prevention, and refunds. The public site does not currently take payment.

Cookies and local device storage

The web application uses a Secure, HttpOnly, SameSite session cookie to keep signed-in users authenticated and a related protection against cross-site requests. It stores language and theme choices in browser local storage and may keep the selected project for the browser session. These are functional preferences, not advertising trackers. The current public marketing page has no third-party tracking script.

Service providers and locations

Our hosted application and object storage use Oracle Cloud Infrastructure in its Jeddah region. Oracle Email Delivery supports operational email such as account and security messages. When an authorised user uses an AI feature, selected request content and relevant context are sent to Anthropic for processing. Anthropic processing may occur outside the Jeddah region. We cannot promise that all data always stays in one country or that AI inputs have a special zero-retention arrangement. We may also share information with professional advisers or authorities where required by law, or with a successor if the service is transferred with appropriate protections.

If future paid checkout uses Paddle, Paddle will act as merchant of record and process payment and buyer details under its own privacy notice. Checkout is not active on the current public site. We do not collect full payment card numbers there.

Security and recovery

We use encrypted connections, account access controls, tenant separation, and encrypted recovery copies. The nightly recovery process retains two verified off-host recovery archives and removes older archives after replacements are verified. These measures reduce risk but cannot guarantee that information is never lost or accessed improperly. We do not promise a fixed recovery time or claim a security certification here.

Retention and deletion

We keep information while needed to provide an approved account and for the purposes above. An authorised organisation administrator can request export or deletion. Deleting an organisation removes its active project and user records and stored files through a verified deletion process. Limited audit, usage, AI accounting, security, or legally required records may remain after account deletion. Recovery copies are replaced and older copies removed through the recovery process, but there is no fixed age limit promised for every copy or record.

A separate permanent, append-only deletion record retains an opaque organisation identifier to prevent a deleted organisation from being recreated by an old backup. It does not contain the organisation's project files. We do not promise that every record can be erased on a fixed schedule.

Your choices and requests

You may ask us for access to, correction of, export of, or deletion of personal information, or raise another privacy concern, by emailing mohab@specsensehq.com. We may need to verify your identity and coordinate requests involving an organisation account with its administrator. Rights and exceptions depend on applicable law. You can clear browser preferences in your browser; signing out ends the current application session.

Changes

We will update this notice and its effective date if our practices change materially. Contact us for the current version or questions.