Privacy Policy

1. Introduction

Maestr (“we”, “our”, or “us”) is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we retain it, and what rights you have with respect to your data. This policy applies to all users of the Maestr web application and mobile app operating in the Arab Republic of Egypt.

2. Data We Collect

We collect the following categories of personal data:

Identity and Contact Information

• Egyptian mobile phone number (used for authentication and communication).
• Full name in Arabic and in English.
• Egyptian national ID number.

Financial Information

• Bank account number.
• Bank name.
• Account holder name (as registered with the bank).

Invoice and Transaction Data

• E-invoice data retrieved from Egypt's Tax Authority (ETA) system, including UUID, issue date, seller information, line items, amounts, and tax values.
• Financing application history, approved plans, and payout transaction records.

Technical and Usage Data

• Device type and operating system (mobile app only).
• App usage logs for debugging and service improvement purposes.

3. How We Use Your Data

We use your personal data for the following purposes:

• Authentication: Verifying your identity via OTP to provide secure access to your account.
• Service provision: Verifying your e-invoices against the ETA system and displaying relevant invoice data.
• Financing facilitation: Sharing your profile and invoice data with licensed financing partners to generate BNPL offers and process approved payouts to your bank account.
• Legal compliance: Meeting our obligations under Egyptian financial regulations, anti-money laundering (AML) rules, and Know Your Customer (KYC) requirements.
• Communication: Sending you OTP codes, service notifications, and important account-related information via SMS.
• Platform improvement: Analysing usage patterns (in anonymised or aggregated form where possible) to improve the reliability and features of the platform.

4. Third Parties We Share Data With

We share your personal data only with the following categories of third parties, and only to the extent necessary for the purposes described in this policy:

Infrastructure and Authentication

• Supabase: Our backend-as-a-service provider. Supabase stores your account data, authentication records, and invoice/transaction data in a secure hosted database. Supabase processes data on our behalf as a data processor.

SMS Delivery

• SMS provider (configured via Supabase): Your phone number is shared with our SMS provider solely to deliver OTP verification codes. The provider does not use your number for any other purpose.

Financing Partners

• Licensed BNPL financing partners: When you request financing offers, we share your name, national ID, bank account details, and relevant invoice data with our financing partners so they can assess your application and, if approved, disburse funds to your bank account. These partners are bound by their own privacy policies and applicable Egyptian financial regulation.

Tax Authority

• Egypt Tax Authority (ETA): Invoice UUIDs and issue dates are submitted to the ETA API to verify invoice authenticity. We do not share your personal profile data with the ETA.

We do not sell, rent, or trade your personal data to any third party for marketing or commercial purposes.

5. Data Retention

We retain your personal data as follows:

• Active accounts: Your data is retained for as long as your account is active and you continue to use the platform.
• Financial records: Transaction records, invoice data, and financing records are retained for a minimum of 7 years following account closure, in compliance with Egyptian financial record-keeping regulations and anti-money laundering law.
• Authentication logs: OTP and session logs are retained for a limited period for security and audit purposes.
• Deleted accounts: If you request account deletion, we will delete or anonymise your personal data within a reasonable period, subject to our legal obligation to retain financial records for 7 years post-closure.

6. Your Rights

Subject to applicable Egyptian law and our legal retention obligations, you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right of correction: You may update your personal and banking information directly within the app profile section, or by contacting us.
• Right of deletion: You may request the deletion of your personal data. Note that we may be required to retain certain financial records for 7 years after account closure under Egyptian law.
• Right to object: You may object to certain uses of your data where we are relying on legitimate interests as our legal basis.

To exercise any of these rights, contact us at privacy@maestr-cashback.com. We will respond within a reasonable timeframe.

7. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• Encrypted data storage and transmission (TLS/HTTPS).
• OTP-based authentication to prevent unauthorised account access.
• Row-level security (RLS) policies on our database ensuring users can only access their own data.
• Access controls limiting staff access to personal data to only those who need it.

No system is completely secure. If you believe your account has been compromised, contact us immediately at support@maestr-cashback.com.

8. Cookies and Tracking

Our web application may use session cookies and local storage to maintain your authenticated session. We do not use third-party advertising or tracking cookies. The mobile app does not use browser cookies.

9. Children's Privacy

Maestr is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated version will be posted in the app with a revised “Last updated” date. Your continued use of the platform after any update constitutes your acceptance of the revised policy.

11. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our privacy team at: privacy@maestr-cashback.com