Pact

Privacy Policy

Last updated: 19 June 2026

This Privacy Policy explains how MASA Build ("MASA Build", "we", "us" or "our") collects, uses, and protects your personal data when you join our waitlist, contact us through our form, or use the Pact app. We are committed to handling your data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are (Data Controller)

The data controller responsible for your personal data is MASA Build, the operator of the Pact app. MASA Build is not yet a registered company; we will update this section with our company registration details once incorporated.

If you have any questions about this policy or how we handle your data, please contact us through our contact form.

2. What data we collect

When you join our waitlist, we collect:

• Your email address — provided by you through the sign-up form.

When you submit our contact form, we collect:

• Your name — so we know who we are replying to;
• Your email address — so we can respond to your enquiry;
• Your message — the content you choose to send us.

In both cases we may also record limited technical data — such as the date and time of your submission, which may be recorded automatically by our systems for security and record-keeping.

We do not collect any special category (sensitive) personal data. Please do not include sensitive information in your message; we only process what you choose to send us.

3. How and why we use your data (Purpose & Lawful Basis)

We use the data you provide to:

• Add you to our early-access waitlist and notify you when Pact becomes available;
• Send you related product updates if you have joined the waitlist;
• Respond to your enquiry, support request, or feedback;
• Keep a record of our correspondence with you;
• Improve our app and support service.

Our lawful basis for waitlist and marketing communications is your consent (UK GDPR Article 6(1)(a)), which you give by submitting the waitlist form. You can withdraw your consent at any time (see Section 7), and every marketing email we send will include an unsubscribe link.

Our lawful basis for handling contact-form enquiries is our legitimate interests (UK GDPR Article 6(1)(f)) — namely, responding to and managing enquiries from our users. We will not use your contact details to send you marketing without your separate consent.

4. How long we keep your data

We keep your waitlist email only for as long as is necessary to operate the waitlist and keep you informed, or until you ask us to remove it or withdraw your consent — whichever comes first. If Pact does not launch, or you unsubscribe, we will delete your data within 30 days.

We keep contact-form messages and details only for as long as is necessary to deal with your enquiry and for a reasonable period afterwards in case of follow-up, typically no longer than 24 months, after which it is deleted.

5. Who we share your data with

We do not sell your personal data. We share it only with trusted service providers ("processors") who help us operate, and only to the extent necessary. These currently include:

• Supabase — our database and backend provider, which securely stores your data on our behalf;
• Vercel — our hosting provider, which serves this website.

All processors are bound by contracts requiring them to protect your data.

6. International transfers

Some of our processors may store or process data outside the UK. Where this happens, we ensure your data is protected by an appropriate safeguard recognised under UK GDPR, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

7. Your rights under UK GDPR

You have the right to:

• Be informed about how your data is used (this policy);
• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten");
• Restrict or object to our processing;
• Data portability — receive your data in a portable format;
• Withdraw consent at any time, without affecting prior processing.

To exercise any of these rights, please contact us through our contact form. We will respond within one month.

8. Cookies

This website does not use tracking or advertising cookies. We only use what is strictly necessary for the pages to function.

9. How we protect your data

We use appropriate technical and organisational measures to keep your data secure, including encrypted transmission (HTTPS) and access controls on our database. No method of transmission over the internet is completely secure, but we take reasonable steps to protect your information.

10. Complaints

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the chance to address your concerns first.

11. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with a revised "Last updated" date.