Privacy policy

MIZAN collects the minimum personal data needed to sell and support digital products, and to run the free diagnostic and Lens tools. This page says what that means in practice.

The data controller is Annas Dahrouj, doing business as MIZAN, Dubai, United Arab Emirates. Questions, or any request below, go to hello@mizan.work.

What we collect

• Purchase data. Name, organization (for Organization licenses), email address and order details, provided at checkout and shared with us by our checkout provider. Payment card details are handled entirely by the payment processor and never reach MIZAN.
• License records. Where a file is stamped to an order, that record — name or organisation, tier, order number — is retained as the record of your license.
• The free culture diagnostic. Your email address, and nothing else. The 21 answers are read in your browser, and neither they nor anything derived from them is transmitted to us or to anyone else. Until August 2026 this also sent three summary numbers; it no longer does, and those fields have been retired rather than replaced.
• Early-access and enquiry forms. The email address, and anything else you type into the form, on campaign pages that offer one.
• Correspondence. Emails you send us, kept so we can answer and honour the license you bought.
• Site analytics. Aggregate, non-identifying usage statistics, if analytics are enabled. No advertising trackers, no sale of data, no cross-site profiling.

The free Lens tools

The Lens instruments are deliberately built to hold as little as possible, but they do not all behave the same way, so here is each one:

• Structure analysis. The org chart you upload is analyzed in memory and the result is returned to your browser. The file and its contents are not written to disk or to a database, and nothing is retained.
• Values alignment. Stateless. The values you enter are read, scored and returned in the same request; nothing is stored.
• Culture survey. This one does store something. Your responses are written to an anonymous row — no name, no email, no account, nothing that identifies you — so the report can be generated and then fetched by the one-time link. That row carries a 24-hour expiry and an automated job deletes expired rows every hour. Your report exists only on the page you downloaded it from. One thing is kept beyond that window: when your report is built, the scores it shows — the two figures for each of the seven domains, plus your values-match and engagement answers — are written to a separate table and retained. That row holds no name, no email, no account, no company details, none of your individual answers and no link to your report, and it records a date rather than a time, so it cannot be matched to a server log. We keep it because the balance threshold in the instrument has to be set from a real distribution rather than picked, and no other record of that distribution survives the 24-hour deletion above.
• The free culture diagnostic. Read entirely in your browser. Only your email address leaves the device, and only when you submit it — see above.

Why we hold it, and on what basis

• To deliver what you asked for — purchased files, license verification, support, and answering you about a diagnostic you ran. This is necessary to perform our agreement with you, or in our legitimate interest in responding to someone who contacted us.
• To meet tax and accounting obligations — a legal obligation.
• To send you marketing — only where you have ticked the optional consent box. It is never a condition of getting your score, a download, or any other service, and every message carries a one-click unsubscribe. You can withdraw consent at any time, by unsubscribing or by emailing us; withdrawing it does not affect anything processed before you did.

We do not sell or rent personal data, ever, and we do not use it for automated decision-making that produces legal effects.

How long we keep it

Order and license records are retained for as long as tax law requires and your license is active. Culture survey response rows are deleted within 24 hours, automatically; the anonymous score rows described above are kept indefinitely, because they hold nothing to delete on anyone's behalf — there is no identifier in them to look you up by, which is also why we cannot remove an individual one on request. Diagnostic and enquiry contacts are kept in our CRM until you ask us to remove them, or until they have been dormant long enough to be of no use. Correspondence is kept while relevant to an open matter.

Your rights

You may ask what data we hold about you, ask for corrections, ask for deletion of anything not legally required to be retained, ask for a copy in portable form, object to processing based on legitimate interest, or withdraw marketing consent. Email hello@mizan.work; requests are answered within 30 days. If you are in the UK, EU or another jurisdiction with a data protection authority, you have the right to complain to it.

Third parties and where data goes

• HubSpot (EU region) is our CRM and email provider, and processes contact data on our behalf: the diagnostic submissions and any campaign form. Campaign pages that embed a HubSpot form load HubSpot's script, which sets its own cookies to attribute a submission to a visit. The rest of the site does not.
• Our merchant of record provides checkout, payment and file delivery under its own privacy policy, linked at checkout.
• Our API (api.mizan.work) runs the Lens analyses described above, and its hosting provider processes technical logs.
• Site hosting providers process technical logs (IP addresses, request data) as any web host does.

MIZAN operates from the United Arab Emirates, so data handled by us is processed outside the UK and EEA. Where you are covered by UK or EU data protection law, transfers rely on the appropriate safeguards available to us and to our providers, and the providers above are used on terms that bind them to process data only on our instructions.

Contact

Annas Dahrouj, doing business as MIZAN, Dubai, United Arab Emirates — hello@mizan.work