This Privacy Policy describes how MMMX SOLUTIONS COMPANY (the operator of the MMMX software platform and related websites, including mmmx.app and associated application endpoints; “MMMX”, “we”, “us”, or “our”) collects, uses, discloses, retains, and protects information. By accessing or using the Service, you acknowledge that you have read this Privacy Policy.
MMMX SOLUTIONS COMPANY provides a multi-tenant software-as-a-service platform under the MMMX brand for licensed Money Service Operators and similar regulated financial businesses. Because the Service processes sensitive operational and compliance-related information, you should read this policy carefully and ensure that your use of the Service complies with applicable law in your jurisdiction.
1. Roles and scope
Depending on how you use the Service, MMMX SOLUTIONS COMPANY may act as a data controller for account, billing, and platform administration data, and as a data processor (or service provider) with respect to Customer Content that you upload or generate in your workspace (including entries, balances, KYC records, entity data, and related operational records).
As a Customer, you are responsible for establishing a lawful basis for collecting and processing data about your employees, counterparties, and end users, and for providing any notices and obtaining any consents required under applicable privacy and data-protection laws.
2. Information we collect
2.1 Account and billing information
We may collect:
- Identity and contact details (name, business email, telephone number, company name, job title);
- Authentication credentials and security settings (password hashes, session identifiers, multi-factor data where enabled);
- Subscription, invoicing, and payment-related metadata (plan tier, billing history, tax identifiers where supplied, payment processor references — we do not store full payment card numbers on MMMX servers when a third-party processor is used);
- Communications you send to us (support requests, contact forms, sales enquiries).
2.2 Customer Content and operational data
When you use the Service, we process data you submit or that is generated through your use of the platform, including ledger entries, deal records, balance snapshots, entity and counterparty profiles, KYC documentation and screening results, audit logs, configuration settings, exports, and similar tenant operational data.
2.3 Technical and usage information
We automatically collect certain technical data, including:
- Device and browser type, operating system, language preferences, and approximate location derived from IP address;
- Log data (access times, pages viewed, API calls, error reports, security events);
- Usage metrics (feature adoption, session duration, performance telemetry) used to operate, secure, and improve the Service;
- Cookies and similar technologies as described in Section 9.
3. How we use information
We use collected information to:
- Provide, maintain, secure, and improve the Service;
- Authenticate users, enforce access controls, and maintain multi-tenant isolation;
- Process subscriptions, trials, upgrades, and billing;
- Respond to support requests and communicate about the Service;
- Detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Terms of Service;
- Comply with legal obligations and respond to lawful requests from authorities;
- Analyse aggregate or de-identified usage to develop features, adjust plan inclusions, and manage capacity (see also our Terms of Service regarding plan changes).
We do not sell your personal information. We do not use Customer Content to train public third-party artificial intelligence models unless you have given separate written consent.
4. Legal bases (where applicable)
Where data-protection laws require a legal basis, we rely on one or more of: performance of a contract; legitimate interests in operating and securing a B2B SaaS platform; compliance with legal obligations; and consent where required (for example, certain marketing communications or non-essential cookies).
5. Disclosure and subprocessors
We may disclose information:
- To hosting, infrastructure, email delivery, payment, FX reference data, analytics, and security vendors that assist in operating the Service, subject to contractual confidentiality and data-protection obligations;
- To professional advisers (lawyers, accountants, insurers) under confidentiality;
- In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards;
- When required by law, regulation, court order, or governmental request, or to protect the rights, property, or safety of MMMX SOLUTIONS COMPANY, our users, or others.
A current list of material subprocessors may be made available on request or published on our website. We remain responsible for subprocessors processing personal data on our behalf to the extent required by applicable law.
6. International transfers
MMMX SOLUTIONS COMPANY may store and process information in Hong Kong and in other countries where we or our subprocessors maintain facilities. Where required, we implement appropriate safeguards for cross-border transfers (such as standard contractual clauses or equivalent mechanisms).
7. Security
We implement administrative, technical, and organisational measures designed to protect information against unauthorised access, alteration, disclosure, or destruction — including tenant isolation, access logging, encryption in transit, and restricted production access.
No method of transmission or storage is completely secure. You are responsible for safeguarding credentials, configuring roles and permissions within your workspace, and promptly notifying us of suspected unauthorised access.
7.1 Incidents. If we detect a security event that may affect customer data or platform integrity, we will investigate and respond using the approach outlined in our Terms of Service (Section 11). That may include temporary restrictions while we work through containment and recovery. Where practicable and allowed by law, we will inform affected customers via the Service or the contact details we hold.
7.2 Exports and copies. We maintain infrastructure backups to help restore the Service after technical failures. For your own audit and licensing needs, we recommend regular exports of Customer Content and keeping independent copies, as noted in our Terms of Service (Sections 3.1 and 11.4).
8. Retention
We retain information for as long as necessary to provide the Service, fulfil the purposes described in this policy, comply with legal and regulatory obligations, resolve disputes, and enforce our agreements. Retention periods may vary by data category and applicable law.
Upon termination of your subscription, we may delete or anonymise Customer Content after a reasonable period, unless retention is required by law or you obtain an export within any window we make available. Short-lived operational backups may remain briefly before rotation; please export anything you need before cancellation if unsure.
9. Cookies and similar technologies
We use essential cookies and local storage for authentication, session management, security, and language preferences. We may use analytics (for example Google Analytics 4) to understand how the marketing site and application are used. On the public marketing site we may collect normal page paths. Inside the operator application we configure analytics in a privacy-conscious way: page paths are generalised so that individual record identifiers and search or filter query strings are not sent; we do not use analytics for advertising personalisation of the Service. You can control non-essential cookies through your browser settings; disabling essential cookies may impair Service functionality.
10. Your rights and choices
Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or object to certain processing of personal data, or to data portability. Requests should be submitted to the contact details in Section 13. We may need to verify your identity and may decline requests where an exception applies.
If you believe we process personal data on behalf of your organisation, please contact your workspace administrator first; we will assist Customers in responding to data-subject requests as required by our agreement and applicable law.
11. Children
The Service is intended for business use and is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children.
12. Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top will reflect the revision. Material changes may be communicated via the Service, email, or website notice. Continued use after the effective date constitutes acceptance of the revised policy, except where prohibited by law.
13. Contact
Privacy enquiries for MMMX SOLUTIONS COMPANY: Contact MMMX (subject line: Privacy) or the address published on our website for legal notices.