We built Macaaw so that your files stay private and leave no trace. This page explains what happens to your files and data, and what you can do yourself. The full details are in our privacy policy and security page.
Before you start
- Most of this happens automatically. The settings you can change are on Profile and security, and, for Business workspaces, on Members and roles › Sign-in and policies.
Where your files go
| What | Where it runs | How long we keep it |
|---|---|---|
| Browser tools (for example Merge, Sign, Redact) | On your device | Never uploaded |
| Server tools (for example Compress, OCR, Word to PDF) | Our servers in London | Free 1 hour, Pro 2 hours, Business the workspace setting, or until you choose Delete now |
| Scans | On your device | Until you delete them; never uploaded unless you share or sync them |
| Cloud library (only if you turn it on) | London, encrypted file by file | Until you delete them; the Bin empties after 30 days |
| Documents sent for signature | London, encrypted | Until everyone has signed, plus 30 days, or until you void or delete them |
| Invoice check documents (Business) | The workspace's cloud library, encrypted | The workspace's Keep documents for rule |
Files are uploaded over an encrypted connection, processed automatically with no person opening them, and deleted automatically. If a deletion fails, it is retried, and a safety rule removes anything left over.
What staff can and cannot see
Our support staff use a separate, protected console with two-step sign-in, and every action they take is recorded. They can see your account details, plan, job history (tool, file name, size and status) and usage. They can never open, download or preview your files, and documents sent for signature store no file names at all.
How to protect your account
- Add a passkey on Profile and security (see How to add a passkey). A passkey cannot be phished: it only works on Macaaw, and it needs your device plus its fingerprint, face or PIN. We store only its public key, never your fingerprint or face.
- Or turn on two-step sign-in with an authenticator app (see Your account and sign-in).
- Check Where you're signed in from time to time, and choose Sign out everywhere if you see a device you do not know. When you sign in from a new browser or device, we email you, saying how you signed in (password, email link, Google, Microsoft or passkey).
- For a Business workspace, owners and admins can require two-step sign-in for everyone (a passkey meets it), limit the sign-in methods, and keep sensitive tools in the browser.
Adding or removing a passkey is recorded in your account's security log.
How to download your data
- Open Profile and security and find Your data.
- Choose Download my data. You get a JSON file with your profile, sign-in methods, passkey names and dates, teams, job history (without file contents), workflows, invoices and credits.
How to delete your files or your account
- To delete files on our servers now, use Delete all now on your account home, or Delete all my files now in History.
- To delete your account, open Profile and security, choose Delete account… under Your data, type your email address to confirm and choose Delete my account.
When you delete your account, any subscription is cancelled at once, files still on our servers are deleted at once, your cloud library is deleted, and your personal data is removed within 30 days. Invoices stay with our payment provider, Stripe, because UK law requires accounting records to be kept. If you own a Business workspace, transfer it or delete it first.
Cookies
We use only the cookies we need to run the site, unless you agree to more. If you open an offer link or a friend's invitation, two small cookies remember the code for 30 days (mc_promo and mc_ref); they are needed for the offer you chose, so they are set without asking. Choose Cookie settings at the foot of any page to change your choice. See the cookie policy.
If something goes wrong
- I think someone else used my account. Choose Sign out everywhere, change your password, remove any passkey you do not recognise, add a passkey or turn on two-step sign-in, then contact support.
- I sent a file by mistake. Choose Delete now on the result page or in History. It is deleted straight away.
- I want to report a security problem. Email us (see Contact support) with as much detail as you can. Please do not include other people's personal data.
Frequently asked questions
Do you use my files to train AI?
No. We never use your files or text to train AI. When you ask a question about a scan, only the recognised text and your question go to our AI provider, under an agreement with no training and no retention.
Can Macaaw staff open my files?
No. Staff can see file names and sizes to help you, but they can never open, download or preview a customer's file.
Where are my files processed?
On our servers in London, UK.