PRIVACY POLICY

Masarif (“Masarif”, “we”, “us”) is a personal finance application built in Beirut, Lebanon. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights as a user.

Contact for privacy questions: support@masarif.app.

We collect the following categories of personal data:

• Account info: name (first name only at sign-up), email address, country, optional phone number, hashed password.
• Authentication metadata: sign-in timestamps, IP address, browser/device type, audit-log events.
• Financial activity: transactions you log (amount, currency, category, merchant, notes, timestamp), budgets, goals, and recurring rules you set.
• Channel content: messages, voice notes, and photos you send to the Masarif Telegram bot or voice/photo intake; transcripts and OCR text derived from them.
• Support correspondence: emails you send to our support inbox.

We use the data we collect to:

• Operate the Masarif app, bot, and email service.
• Power AI features — transaction parsing, voice transcription, receipt reading, and personalized mentoring — through trusted AI partners under strict data-handling agreements.
• Authenticate sessions, detect abuse, and enforce rate limits via audit logs.
• Send transactional emails (verification, password reset, welcome, account notifications).
• Improve the product using aggregated, anonymized usage analysis only — never your individual financial activity.
• Comply with legal obligations.

To operate Masarif we work with a small set of vetted infrastructure and AI partners — for hosting, database, email delivery, voice transcription, receipt reading, error monitoring, and AI mentoring. Each is bound by a written data-processing agreement, processes only the data needed for its specific function, and is contractually prohibited from using your data to train its own models or for any other purpose.

We do not sell your personal data and we do not share it for cross-context behavioral advertising. We never share your data with anyone outside of operating the service for you.

If you'd like the specific list of sub-processors that handle your data, email support@masarif.app and we'll send it.

Masarif uses automated AI processing to parse messages, transcribe voice notes, read receipts, classify transactions, and generate financial insights. These automated decisions assist you — they do not produce legal effects on you, and you can edit, undo, or override any AI-suggested action from your account.

We keep your account and financial data for as long as your account is active. Audit logs are retained for up to 24 months for security and rate-limiting purposes. When you delete your account, we erase your personal data within 30 days, except where retention is required by law.

Subject to your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Export your data in a portable format.
• Delete your account and associated data.
• Object to or restrict certain processing.
• Withdraw consent where processing relies on it.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email support@masarif.app.

We protect data in transit with TLS, store passwords as salted hashes (we never see your raw password), and isolate database access behind private networking. No system is perfectly secure; if a breach affects you we will notify you in accordance with applicable law.

Masarif is not directed at children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy as the product evolves. We will post the new effective date at the top of the page and, for material changes, notify users by email.