Masar · مسارPrivacy Policy
Last updated: 2026-10-22 · Version: 2026-09
1. Who we are
This platform ("Masar") is operated by Masar · مسار ("we"), —, العراق / Iraq. Privacy contact: —.
2. What we collect
- Account data: username, role, language and optional fields (job title, phone). Passwords are stored as PBKDF2 hashes and cannot be recovered.
- Organisation data: organisation name, profile, preferred sectors and provinces, working settings.
- Business records (leads and directory): information about companies and businesses — name, sector, address, business phone numbers and e-mails, website, management names that appear in public sources, and published financials. Entered by the organisation or collected automatically from public internet sources (company websites, directories, maps, published official registers).
- Usage logs: an audit trail of who did what and when (sign-in, edit, delete, export) for security and accountability. IP addresses are not kept in the permanent log; they are used transiently in memory to throttle repeated sign-in attempts.
- Files: attachments the organisation uploads to business records.
- We do not collect geolocation or advertising identifiers, and we use no third-party tracking or analytics.
3. Why (purpose and basis)
- Providing the service your organisation contracted (performance of a contract).
- Protecting accounts and preventing abuse (legitimate interest).
- Helping your organisation reach businesses using published business contact data (legitimate interest, with the right to object respected).
- We never sell data or use it for advertising.
4. Processors
The platform runs on the operator's own servers. Parts of business records are sent to external providers only when the operator enables a feature that needs them (web search, AI analysis, cloud backup, notifications). Providers enabled on this installation: none at present. With a local AI model (Ollama) data never leaves the server.
5. Retention
- Account data: for the life of the account; removed when a deletion request is executed.
- Audit log: 365 days, then deleted automatically.
- Deleted records: kept in the trash for 30 days, then purged.
- Backups: per the operator's schedule; old ones are removed automatically.
6. Your rights
You may access and export your data, correct it, request deletion of your account and personal data, and object to specific processing. In the app: Settings → My account → My privacy & data (export / deletion request). If you are a person whose details appear in a business record and want them removed, write to —; we answer within 30 days.
7. Children
The platform is for business use and is not offered to anyone under 18; we do not knowingly collect data about minors. If a minor has created an account, tell us and we will delete it.
8. Security
Hashed passwords, time-limited sessions, optional two-factor sign-in, sign-in throttling, a browser content-security policy, and backups that contain no access keys. Securing the connection (HTTPS) and the server is the operator's responsibility.
9. Changes
When this policy changes materially you will be asked to review and accept it again at sign-in.
10. Contact
Masar · مسار — — — — — —