مكتبيMAKTABY

Privacy Policy

Effective date: 27 June 2026

1. Who we are

Maktaby ("we", "us", "our") is a B2B SaaS platform that provides workspace management, virtual office, business-setup CRM, and PRO-services tools to coworking and business-centre operators in the UAE, Saudi Arabia, and the wider GCC. This policy covers data processed by Maktaby as a data controller and, where applicable, as a data processor on behalf of our operator customers.

2. Data we collect

We collect data in two capacities:

a) Operator data (you, the workspace operator)

  • Account details: name, work email, phone number, company name
  • Billing details: subscription plan, payment method metadata (we never store raw card numbers)
  • Business identity: trade licence number, UAE TRN / KSA VAT registration number
  • Configuration: timezone, payment gateway API keys (encrypted AES-256)

b) Member data (your members, collected on your behalf)

  • Identity: full name, email, phone, WhatsApp number, nationality, date of birth
  • Government IDs: passport number, Emirates ID, Iqama number (encrypted AES-256 at rest)
  • Visa/residency: visa number, visa type, expiry date
  • Workspace usage: bookings, invoices, credit balances, access logs
  • Documents: uploaded files (trade licences, MOA, tenancy contracts, etc.) — stored in private, encrypted cloud storage
  • Communication preferences: WhatsApp opt-in status

3. Legal basis for processing

  • Contract performance: processing your account and billing data to provide the Maktaby platform.
  • Legitimate interests: product analytics (PostHog), error monitoring (Sentry), security logging.
  • Consent: WhatsApp marketing messages, optional product-update emails. You can withdraw consent at any time.
  • Legal obligation: VAT invoice retention (UAE Tax Procedures Law — 5 years minimum; KSA ZATCA — 6 years minimum), data erasure requests, government audit responses.

4. Third-party services and data sharing

We share data only with processors necessary to deliver the platform:

  • Supabase — database and authentication (hosted in Sydney, Australia; SOC 2 certified)
  • Dodo Payments — platform subscription billing (Merchant of Record for operator subscriptions)
  • Tap Payments / Moyasar — member invoice payment processing (UAE/KSA)
  • Meta (WhatsApp Business API) — transactional and support messaging
  • Resend — transactional email delivery
  • Wafeq / ZATCA — KSA e-invoicing compliance (KSA operators only)
  • Sentry — error monitoring (anonymised stack traces; no PII in errors)
  • PostHog — product analytics (session replay with inputs masked; no government ID data)
  • Inngest — background job orchestration (metadata only; no PII payloads)

We do not sell personal data to third parties. We do not use member data for advertising.

5. International data transfers

Our primary database is hosted on Supabase in Sydney, Australia (AWS ap-southeast-2 region). Data in transit is encrypted via TLS 1.2+. Supabase complies with GDPR and SOC 2 Type II.

If your jurisdiction requires local data residency (current KSA PDPL guidance is evolving), please contact us at privacy@maktaby.io to discuss options. We plan to offer a GCC-region data residency option before Phase 3 (KSA) launch.

6. Data retention

  • Tax invoices (UAE): retained for 5 years minimum (UAE Tax Procedures Law). Never automatically hard-deleted.
  • Tax invoices (KSA): retained for 6 years minimum from the end of the relevant tax period (KSA ZATCA record-keeping rules). Never automatically hard-deleted.
  • Booking records: retained for the same period as the tax invoices they support — 5 years (UAE), 6 years (KSA) — as part of the VAT audit trail.
  • Visitor logs: soft-deleted after 90 days (configurable). Retained for the minimum necessary period under UAE PDPL data minimisation principles.
  • Member PII (post-erasure request): anonymised in place — name replaced with "Deleted User", government IDs and contact details set to null. Audit record of the erasure is retained permanently.
  • Consent logs: retained permanently as an audit trail (append-only, never deleted).

7. Your rights

Under UAE PDPL and KSA PDPL, you (and your members via your operator account) have the right to:

  • Access: request a copy of all data held about you (available via your operator dashboard → Members → Export Data).
  • Portability: download your data in machine-readable JSON format.
  • Erasure: request deletion of a member's personal data (subject to legal retention requirements for financial records). Available via operator dashboard → Members → Erase Member.
  • Correction: update inaccurate personal data at any time via the platform.
  • Withdraw consent: opt out of WhatsApp notifications or marketing emails at any time via your profile settings.
  • Object: object to processing based on legitimate interests by contacting us below.

To exercise your rights, contact us at privacy@maktaby.io. We respond within 30 days.

8. Security

  • Government ID numbers (passport, Emirates ID, Iqama) are encrypted with AES-256-CBC before database write.
  • Payment gateway API keys stored encrypted; never transmitted to the browser.
  • Document files stored in private cloud buckets; access requires a signed URL that expires after 15 minutes.
  • All connections use TLS 1.2+. HSTS enforced with 2-year max-age.
  • Role-based access control — MEMBER users cannot access other members' data.
  • Multi-tenant isolation — each operator's data is strictly scoped by organization ID; no data is shared across operators.

9. Cookies

We use the following cookies:

  • Essential: Supabase authentication session cookie (required for login — cannot be disabled).
  • Analytics: PostHog session cookie (anonymised product usage analytics). You can opt out via your browser's cookie settings.

We do not use advertising or tracking cookies.

10. Changes to this policy

We may update this policy as the platform evolves or regulations change. Material changes will be notified via email and an in-app notice at least 14 days before they take effect. The effective date at the top of this page reflects the most recent update.

11. Contact

Data privacy questions, access requests, and erasure requests: privacy@maktaby.io

General enquiries: hello@maktaby.io

← Back to Maktaby · Terms of Service