Privacy

What we store

Your account: name, email, company, the preferences you set and the payment status of your plan. Payment card details are held by Stripe or Tap, never by us.

Your network: the contacts you import, scan or type, the connection scores you give them, interactions you log, goals, target lists and introduction requests.

Signals you connect: if you link Gmail or Google Calendar we read message and event metadata (who, when) to refresh scores. We do not read message bodies and we store OAuth tokens encrypted.

People in your network who are not users

Massar holds professional details of people our customers know (name, title, organisation, contact details) on the basis of legitimate interest in professional networking, as recognised by the GDPR, the Saudi PDPL and the UAE data protection law. We keep what a business card would carry and nothing more.

Anyone can ask to be removed, with no account, from the removal page. We aim to apply removal to every customer’s network within 72 hours; the address is then blocked from re-import.

We never sell contact data, share it with advertisers, or use it to train models that serve other customers.

Where it lives and who can see it

Data is stored in AWS Bahrain (me-south-1). Qatar residency is available on request. Each customer’s network is isolated; on a Team plan only the contacts you explicitly share are visible to the roles you choose. A person you open a door to can see which of the people they already know you also know, and how well; never anyone they do not already know, and never your company contacts. In an organisation, your Company space belongs to the organisation and your Personal space stays yours. Massar is responsible for anything shown to another Massar user.

Our staff can access accounts only for support with your request or for platform security, and every such access is logged for two years.

Processors we rely on: AWS (hosting), Clerk (sign-in), Stripe and Tap (payments), SendGrid (email), Anthropic (AI drafting, no training on your data), Google (when you connect it).

Your rights

Export everything as JSON from Settings at any time (contacts and the audit log also as CSV). Delete your account from Settings: it is suspended immediately and erased after a 30-day grace period; copies in backups expire within 90 days.

We notify affected customers of a data breach within 72 hours of confirming it.