Masahati

Privacy policy

Last updated: 6 November 2026

We respect your privacy and protect your personal data in line with the Saudi Personal Data Protection Law and its regulations. This policy explains what we collect, why, how we protect it and your rights over it.

1. What we collect

Account details: name, email, mobile number, job title and password (stored with one-way hashing).
Content you enter: tasks, projects, companies, subscriptions, amounts, reports, uploaded files and logins saved in the vault.
Connected email: inbox messages the service fetches (in Gmail, the Primary tab only), what you send from it, and the mailbox connection details.
Usage data: AI points used, activity times, and a log of sensitive actions such as revealing a saved password.
Visit data: pages opened, device type and where the visit came from, with a one-way hashed code derived from the IP address to count unique visitors, without tracking cookies and without storing the IP address itself.

2. Why we use it

We process your data to perform our contract with you (providing the service), with your consent, for our legitimate interests and to meet legal obligations, in order to:

create your account, run the service and show you your data;
sync your mailbox and send your messages when you ask;
provide AI features when you use them;
send necessary account emails (email confirmation, password reset and the alerts you turn on);
protect the service, prevent abuse and improve it through aggregate statistics.

We do not use your data for advertising and we never sell it.

3. Who we share it with

We use service providers that process data on our behalf, only as needed and under agreements that require them to protect it:

Anthropic (United States): processing AI requests. Only the text a request needs is sent, which may include an email or task if you use it in the request, and it is not used to train their models.
Hostinger: hosting the website and database.
Cloudflare: protecting and speeding up the website.
Resend: sending account emails and alerts.
Your email provider (such as Google): when you connect a mailbox, we connect to it on your behalf.

We may disclose data when a competent government authority requires it by law. Project share links you create are visible only to people you give the link to, and you can turn them off at any time.

4. Transfers outside the Kingdom

Your data may be stored or processed on servers outside Saudi Arabia by the providers listed above. We limit this to what the service needs, within the limits of the Personal Data Protection Law and its regulation on transfers outside the Kingdom, with appropriate safeguards.

5. How we protect it

Encrypted connections (HTTPS) on every page.
Each user's data is kept separate, so no user can reach another's.
Email passwords and vault data are encrypted in the database.
Files open only for their owner, after sign-in.
Limits on sign-in attempts, and sessions are ended when the password is changed or reset.

If a breach affects your data, we will notify the competent authority (SDAIA) within 72 hours as the law requires, and tell you if it may harm you.

6. How long we keep it

Account details and content: while your account exists; deleted when you delete it.
Fetched emails: deleted from our side when deleted in your mailbox or in Masahati, or when you disconnect the mailbox.
Aggregate visit statistics: about 13 months.
Backups (if any): replaced within 30 days.
Records the law requires, such as payment records: for the period the law sets.

7. Your rights

The Personal Data Protection Law gives you the right to:

be informed how and why your data is collected and processed, as this policy explains;
access your data and get a copy in a readable format;
correct or update your data, which you can do yourself on your profile page;
ask for your data to be destroyed when it is no longer needed (you can delete your account yourself);
withdraw your consent at any time, for example by disconnecting a mailbox or turning off alerts.

To use any of these rights, write to us from the contact page; we reply within 30 days. You may also complain to the Saudi Data & AI Authority (SDAIA).

8. Cookies

We use only the cookies the website needs to work: the session cookie that keeps you signed in, form protection, your language, and "remember me" if you choose it. We use no advertising or third-party tracking cookies.

9. Children

The service is not meant for anyone under 18, and we do not knowingly collect their data.

10. Changes to this policy

We may update this policy and will publish the new version here with its date, telling you about material changes before they take effect.

11. Contact

For any request or question about your data, write to us from the contact page.