Privacy Policy

Who this covers

MESA Business Management ("MESA", "the app") is published by Zoomlion Gulf FZE ("we", "us") and is provided to authorised employees, contractors and partners of Zoomlion for internal business use.

It is not a consumer product. There is no public sign-up: accounts are created from the company org chart, and access ends when your authorisation ends.

This policy explains what the app records, why, who else can see it, and how to ask us about it.

Information we hold about you

• Identity and role — your employee number, name, corporate email address, job title, and where you sit in the org chart. This comes from company HR records, not from anything you type into the app.
• Sign-in records — the time and outcome of sign-in attempts, and the one-time codes sent to your corporate email address. Passwords are stored only as a cryptographic hash and cannot be read back.
• Work you do in the app — customers, purchase orders, quotations, price records, visits, targets, KPIs, tasks, documents you upload, and messages you send to colleagues.
• Device and technical data — device model, operating system version, app version, IP address, and error diagnostics. Used to keep the service working and to investigate faults.
• Notification tokens — an identifier issued by Apple or Google so we can deliver push notifications to your device.

Camera, microphone and voice

The app asks for camera and microphone access only when you use a feature that needs it, and you can refuse.

• Calls — video and audio are carried live between participants for the duration of the call. Ask before you record anything.
• Voice questions to MESA AI — holding the message box records a short audio clip, which is sent to our transcription provider, converted to text, and then discarded. We keep the resulting text as part of the conversation, because that is the question you asked.
• Photos and files you attach are stored with the record you attached them to.

Biometric unlock

If you turn on fingerprint or face unlock, the check happens entirely on your device using the operating system's own security hardware. Your fingerprint or face is never sent to us and we never receive it. All the app stores is a yes-or-no preference saying you turned the feature on.

Why we use this information

• To let you sign in, and to show you the records your role permits you to see.
• To operate the features you use — approvals, messaging, calls, notifications and reporting.
• To keep the platform secure: detecting misuse, investigating incidents, and maintaining an audit trail of who changed what.
• To fix faults and improve the product.
• To meet legal, tax and regulatory obligations that apply to the business records held in the app.

We do not sell your information, we do not use it for advertising, and we do not use it to build a profile of you outside your work role.

Who else sees it

Colleagues see what your shared work requires and what their role permits — a manager sees their team's records; a colleague on the same account sees that account. What each role can see is set by the company, not chosen by us.

We use a small number of service providers who process data on our instructions and are not permitted to use it for their own purposes:

• Amazon Web Services — hosting and storage, in the Asia Pacific (Singapore) region.
• Cloudflare — access control and protection for the web platform.
• Alibaba Cloud Model Studio (Singapore) — the AI assistant and voice transcription. Text you send to MESA AI and audio you record for it are processed there.
• Daily — the connection used for voice and video calls.
• Apple and Google — delivery of push notifications to your device.

We may also disclose information where the law requires it, or to protect our rights, our people or our customers.

Where it is stored

The platform runs in the Asia Pacific (Singapore) region, and our AI provider processes requests in Singapore. If you use MESA from another country, your information is transferred to and processed in Singapore.

How long we keep it

• Business records — kept for as long as the business and applicable law require, which is usually well beyond your own use of the app.
• Messages and attachments — kept while the conversation exists.
• Voice clips — discarded once transcribed. The text is kept as part of the conversation.
• Technical logs — kept for a limited operational period and then removed.
• Your account — access is removed when your authorisation ends. Work you created stays in the business record.

Keeping it secure

• Traffic between the app and our servers is encrypted in transit.
• Sign-in credentials and your session are held in the operating system's secure keystore on your device.
• What you can see is limited by your role and position in the org chart.
• Screens display your name and employee number as a watermark, so a photographed or screenshotted screen can be traced. This is a deliberate control and you should assume it is always on.
• Changes to significant records are recorded with who made them and when.

No system is perfectly secure. If you believe your account has been misused, tell us immediately using the contact below.

Your choices and rights

Depending on where you live, you may have the right to ask for a copy of your personal information, to have it corrected, to object to certain uses, or to ask for deletion. Deletion is limited in practice: business records the company must keep cannot be erased on request.

You can turn off notifications, camera, microphone and biometric unlock at any time in your device settings. The rest of the app continues to work.

To make a request, contact us at [CONTACT EMAIL]. We may need to confirm your identity first.

Children

MESA is a workplace tool for authorised staff. It is not directed at children and we do not knowingly collect information from anyone under 18.

Changes to this policy

If we change this policy substantively, we update the date below and ask you to accept the new version the next time you sign in on mobile. Continuing to use MESA after that means you accept the change.

Contact us

Zoomlion Gulf FZE

[REGISTERED ADDRESS]

Email: [CONTACT EMAIL]

Effective 14 August 2026. Version 2026-08-14.