Privacy Policy

Last updated: July 11, 2026

Your privacy matters to us. This Privacy Policy (the "Policy") explains how the Masar platform ("we", "us") collects, uses, and protects your personal data when you use our website app-masar.com and our services (collectively, the "Platform"). This Policy is designed to comply with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia.

By using the Platform, you acknowledge that you have read this Policy and agree to the processing of your data in accordance with it.

1. Data We Collect

a. Data you provide directly

• Account data: name, email address, mobile number, password (encrypted), profile picture.
• Company data: company name, commercial registration, tax number, address, logo.
• Business data: project data, invoices, expenses, clients, employees, subcontractors, and the documents and attachments you upload.
• Payment data: processed by our payment provider (Stripe); we do not store your card numbers on our servers — we only keep subscription details and payment status.
• Communications: what you send us through contact or support forms.

b. Data collected automatically

• Usage data: pages you visit, features you use, login times.
• Technical data: IP address, browser type and operating system, device identifiers, error logs.
• Cookies: essential cookies for sessions, authentication, and language preferences. We do not use advertising trackers.

c. Data from third parties

If you sign in through services such as Google, we receive your name, email address, and picture from that service according to your privacy settings there.

2. How We Use Your Data

We use your data for the following purposes, based on the legal grounds indicated:

| Purpose | Legal basis | |---------|-------------| | Creating your account, operating the Platform, and providing its features | Performance of contract | | Processing subscriptions, payments, and billing | Performance of contract and legal obligation | | Providing technical support and responding to your inquiries | Performance of contract | | Improving the Platform, developing new features, and analyzing usage | Legitimate interest | | Protecting the Platform from fraud and abuse | Legitimate interest and legal obligation | | Sending operational notifications (alerts, important updates) | Performance of contract | | Sending marketing messages (optional) | Consent — you can withdraw it at any time | | Complying with regulations (such as e-invoicing requirements) | Legal obligation |

AI assistant: when you use the AI assistant, your questions and relevant context data are processed by external AI model providers to generate answers. Your data is not used to train those providers' models under our agreements with them.

3. Data Sharing

We never sell your personal data to anyone. We share data only with:

Service providers (sub-processors)

We rely on trusted service providers to operate the Platform. They process data on our behalf under data protection agreements:

• Hosting and infrastructure: Vercel (application hosting), Supabase (database and storage), Amazon Web Services (file storage).
• Payments: Stripe.
• Email: Resend (system notifications and messages).
• Authentication: Google (optional sign-in).
• Artificial intelligence: Anthropic and OpenAI (powering the AI assistant).
• Error monitoring: Sentry (diagnosing technical failures).

Other cases

• Within your organization: the business data you enter is visible to your team members according to the roles and permissions your organization defines.
• Authorities: if we are required to disclose by applicable law or a court order.
• Business transfers: in the event of a merger or acquisition, with prior notice of any material change to this Policy.

4. International Data Transfers

Your data may be stored or processed on servers outside the Kingdom of Saudi Arabia (our core infrastructure is currently located in regional data centers). We apply appropriate safeguards to protect your data when transferred, in line with the requirements of the PDPL.

5. Data Security

We apply appropriate technical and organizational measures to protect your data, including:

• encryption of data in transit (TLS/HTTPS) and at rest;
• password hashing, two-factor authentication (2FA), and passkey support;
• isolation of each organization's data (multi-tenancy isolation);
• a granular permission system controlling who sees what within your organization;
• audit logs for sensitive operations;
• regular backups and continuous system monitoring.

However, no method of electronic transmission or storage is 100% secure, so we cannot guarantee absolute security.

6. Data Retention

• We retain your data for as long as your account is active.
• When you delete your account or organization, your data is permanently deleted from our systems within a reasonable period, except for what we are legally required to retain (such as financial and tax records) for the statutory periods.
• We may retain anonymized data (which does not identify you) for statistical and analytical purposes.

7. Your Rights

Under the Personal Data Protection Law, you have the right to:

• Be informed: know how we collect and process your data (which this Policy explains).
• Access: request a copy of the personal data we hold about you.
• Rectification: update inaccurate or incomplete data (available directly from your account settings).
• Erasure: request the deletion of your personal data within the limits permitted by law.
• Withdraw consent: revoke any consent previously given (such as for marketing messages) without affecting the lawfulness of prior processing.
• Data portability: obtain your data in a machine-readable format via the Platform's export tools.

To exercise any of these rights, contact us at the email below and we will respond within the statutory timeframes.

8. Children's Privacy

The Platform is intended for business use and is not directed at anyone under 18 years of age, and we do not knowingly collect data from this group. If we learn that we have collected a child's data without lawful consent, we will delete it immediately.

9. Owner Portal and Share Links

When you activate the owner portal or create share links for documents, the covered data becomes accessible to anyone who holds the link. You are responsible for managing these links and revoking them when they are no longer needed.

10. Changes to This Policy

We may update this Policy from time to time. We will post the updated version on this page with the last-updated date, and we will notify you of any material change by email or an in-platform notice before it takes effect.

11. Contact Us

For any inquiry or request related to the privacy of your data:

• Email: support@app-masar.com
• The Contact page

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the competent personal data protection authority in the Kingdom of Saudi Arabia.