Privacy Policy

What we collect

• Your account: your name, email and password (stored scrambled, never readable). If you use Google to sign in, we get your name and email from Google.
• Your business: legal names, TRN, address, logo and settings.
• What you enter or send: customers and their contact details, invoices, quotes, credit notes, payments, cheques, expenses, receipts and contracts.
• Messages: what is sent to your customers on your behalf, and their replies.
• Technical records: an audit log of who did what and when (including IP address), and basic server logs. We keep invoice contents, TRNs, phone numbers and message text out of our general logs.

Why we use it

• To run the service: send invoices and reminders, record payments, produce reports and submit e-invoices.
• To keep your account secure and to help you when you contact us.
• To bill you for your subscription.
• We don't sell your data and we don't use it for advertising.

Where it is stored

Your business data, files, e-invoice files and backups are stored on Amazon Web Services in Frankfurt, Germany.

A few services below work outside that region. We send them only what they need for the task.

Who else handles it

• Amazon Bedrock (Anthropic's Claude) for AI features such as reading a customer's reply or a receipt. We send only the fields needed for that one task, never your whole records, and we log every AI action. Bedrock currently routes these requests across regions, so they may be processed in other countries.
• Stripe for card payments, on your subscription and on invoices if you connect your Stripe account. Card details go directly to Stripe; we never see them.
• Meta (WhatsApp Business) to deliver WhatsApp messages, which means the recipient's number and the message go through Meta.
• Amazon SES (Amazon Web Services) to send invoices and account emails.
• An Accredited Service Provider, when you use e-invoicing, as UAE rules require.
• Cloudflare to deliver the website and protect traffic. It isn't used to store your business data.
• Google, only if you choose to sign in with Google.

Your customers' data

You decide which customers you add and what you send them, and we handle their details on your behalf. It's your job to make sure you may contact them, including getting their agreement to WhatsApp messages. When a customer replies STOP, reminders to them stop right away.

How long we keep it

This isn't final yet. Our plan is to keep invoices, ledgers, e-invoice files and audit logs for at least 7 years, because of UAE record-keeping rules.

If your account becomes read-only because a trial or subscription ended, you can still sign in and download your data. We don't delete it automatically, and we'll update this page before that changes. You stay responsible for keeping your own tax records.

Keeping it safe

Data is encrypted in transit and at rest, each company's data is kept apart, and message text is sealed in our database. You can turn on two-factor sign-in in Settings.

Cookies

We use a cookie to keep you signed in and one to remember your language. We don't use advertising or analytics cookies.

Your choices

You can see and correct most of your data in the app, and owners and admins can download it from Settings → Plan & billing. To ask for a copy, a correction or deletion, email privacy@mazbook.app. We may have to keep some records where the law requires it.

Changes and contact

We'll update this page when things change and tell you about important changes. Questions: privacy@mazbook.app.