This policy explains what personal data we collect when you use the Mutassfhati app, its website and the workshop sign-up form (together, the "Service"), how we use and protect it, and your rights under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "Data Protection Law").
1. Who we are and how to contact us
The controller of the data described in this policy is Neo Enterprise Limited, a limited liability company registered in the Masdar City Free Zone, Abu Dhabi, United Arab Emirates, licence no. MC 15078 ("Neo", "we" or "us").
- Address: Flexi Desk Lite, Unit FL498, Incubator Building, Masdar City, Abu Dhabi, UAE
- For anything about privacy: info@mutassfhati.app
2. In short
- We do not ask you to create an account, and we do not ask for your name, phone number or email address to use the app.
- We do not sell or rent your personal data, we do not show ads based on a profile of you, we do not track you across other apps or websites, and we do not use your device's advertising ID.
- The app does not currently contain any third-party analytics or advertising tools.
- Two main providers process data for us: our hosting provider, and Google for the AI helper only. What each receives is explained below.
- Your saved workshops and settings (such as language, theme and your AI helper consent) are stored only on your device.
3. The random install ID
- On first launch, the app creates a random number for this install and stores it on your device. It is not your device's serial number or advertising ID, and it changes if you delete the app or clear its data.
- The app sends this ID with its requests to our servers only. When it arrives, we immediately convert it, with a secret key, into a hashed value that does not reveal the original ID, and we do not store the original ID in our database.
- We use the hashed value to prevent abuse and apply request limits, to prevent repeated ratings, to count contacts with workshops and ad views without knowing who you are, and to link security reports to the same install.
- We treat this value as pseudonymous personal data and protect it accordingly.
4. Location
- The app accesses your location only if you allow it, only while you use the app, and it does not track your location in the background.
- When you ask for the nearest workshops or their distance, the app sends your coordinates with the search request to our server so that it can calculate distances and order the results. Our server rounds the coordinates to about 100 metres to calculate the distance, does not store them in its database, and does not link them to the install ID. They may appear for a short time in the hosting servers' technical logs (section 9).
- If you do not allow location access, the app works by letting you choose the area or sector yourself, and results are ordered by name.
- You can withdraw the permission at any time in your device settings.
5. Search and contacting workshops
- The search words and filters you choose (such as category, area or "Open now") are sent with the request to show results. We do not store them in our database.
- When you open a workshop's page or tap "Call", "WhatsApp", "Directions" or "Share", the app sends us a record containing: the type of action, the workshop, the screen it came from, the operating system, the app version, the time and the hashed install ID. It does not contain your number or the content of your call or message.
- Purpose: to understand how useful the directory is for each workshop, to prepare aggregated statistics for workshop owners and advertisers, and to protect those statistics from manipulation.
- We keep these detailed records for 90 days. We then turn them into daily aggregated counts per workshop (the total and the number of different installs) that contain no ID, and we delete the detail.
6. Ads and how they are measured
- When ads are switched on, our server records each ad it sends to the app (the ad, where and in which position it appears, the time and the hashed install ID), the app tells us when the ad actually appears on screen, and taps on it are recorded with the records in section 5.
- Purpose: to count views, reach and taps, to limit how many times the same ad is counted for the same install, to calculate what is invoiced to the advertiser, and to detect manipulation.
- We do not use your location, IP address or anything you type to choose or measure ads. An ad is chosen only by what you are browsing at that moment (such as the category, area or sector you selected), not by a profile of you.
- Advertisers receive aggregated figures only, never any data about you.
- We keep detailed ad serving and measurement records until 90 days after the campaign ends, to handle any dispute over the invoice, and then delete them. We keep daily totals that contain no ID as an invoicing record.
7. The AI helper
- We never send any text to the AI provider without your express consent in the app. You can withdraw your consent at any time under "More". Withdrawing it does not affect what happened before.
- When you use the helper, the app sends the problem text (up to 500 characters) and the app language to our server. Our server removes any phone numbers and email addresses it recognises from the text and then checks it for danger words. If it finds one, we show safety guidance and do not send the text to the AI provider.
- Otherwise, we send the cleaned text, together with the list of service categories in the directory, to the Gemini service provided by Google LLC, to identify the right category. We do not send Google your install ID, your location, the app language or any other data about you.
- Google processes the text under the Gemini service terms and its privacy policy (Google Privacy Policy), and its servers are outside the UAE.
- We keep the cleaned text, the suggested categories and the app language for 90 days without any ID, to review and improve the helper's quality and safety, and then delete them automatically.
- Please do not type personal or health information, or information about other people, into the helper.
8. Reports, ratings and security reports
- Reports: when you report information, a price, a rating or an ad, we store the workshop, the item reported, the reason you chose from the list, the app language, the time and the hashed install ID, and then the action we took. We do not ask for your name. Purpose: to handle the report, prevent malicious reports and keep a record of our action. We remove the hashed ID from a report 12 months after it is closed, and keep the report record without an ID for up to 3 years, or longer if a competent authority requires it or it is needed to establish or defend a right.
- Ratings (when switched on): we store the stars, the tags, the workshop, the time and the hashed install ID. We use the hashed ID to prevent repeat ratings within 30 days and to fight manipulation. Ratings are shown in aggregate without any ID. We remove the hashed ID from a rating after 12 months; the rating stays, without an ID, while the workshop is listed.
- Security reports: the app contains a protection component that sends a report to our server if it detects signs that the app was modified, that the device is rooted or jailbroken, that tampering or debugging tools are present, that the app runs on an emulator, or that fake-location apps are installed. A report contains: the check results (on Android, the package names of any fake-location apps), the app version, install source and signing fingerprint, the device model, manufacturer and operating system, the device language and time zone, the network type and whether a VPN or proxy is in use, the report time, the install IDs (hashed on arrival) and the IP address. It does not contain your location or phone number. Purpose: to protect the Service and its users, and the integrity of statistics and invoicing from fraud. We keep these reports for 180 days and then delete them automatically.
9. Technical logs and the website
- Like any internet service, our hosting provider's servers record technical data about requests, such as the IP address, the time, the address requested (which may include search words or coordinates) and the browser or app type. These logs are used to run and protect the Service and are kept for a short time under the hosting provider's settings. We keep error logs in our own systems for 14 days.
- We also use IP addresses temporarily to apply request limits and block attacks.
- Our website uses only cookies that are necessary to run and protect its forms, such as the session cookie and an anti-forgery token. We do not use advertising or tracking cookies.
10. Workshop owners and applicants
- "Join the directory" form: the workshop name, the contact person's name, phone, WhatsApp, the sector, plot number, licence number and coordinates if you choose to enter them, and how you reached the form. We also keep a record of acceptance of the Workshop Listing Agreement: the agreement version, the date and time of acceptance, the name, the phone, the acceptance channel and the IP address.
- Licence check: the licence number, the issuing authority, the activity, the expiry date, the result of the check, and a copy of the licence or other evidence of the check.
- Workshop owner portal: if we create an account for you, we store your name, email address, your password in hashed form, and a record of the changes you make.
- Published workshop data (name, phone, WhatsApp, location, opening hours, services, prices and photos) is public in the directory by its nature. We first compiled workshop data from publicly available business sources. If a phone number published for a workshop is an individual's personal number, that person may ask us to correct or remove it.
- Purpose: to perform the Listing Agreement, check the licence, contact you about your listing and our services for workshops, meet our legal obligations and keep evidence of the contract. You can ask us at any time to stop sending you marketing offers.
11. Legal basis for processing
We process personal data on one of the grounds permitted by the Data Protection Law:
- Your consent: such as location access, and sending the AI helper text to a provider outside the UAE. You can withdraw consent at any time.
- Performing our agreement with you: providing the Service you ask for under the Terms of Use, such as showing results, handling your report or rating, and protecting the Service from abuse, and performing the Listing Agreement with workshops.
- Legal obligations: such as keeping accounting records and complying with orders from the competent authorities.
- Establishing, exercising or defending rights: such as keeping the record of acceptance of the agreement, and ad records during the dispute period.
- Data made public by the person concerned: such as business contact details a workshop has published.
12. Who receives data
- Our hosting provider (currently Hostinger): the Service's data and our email are stored on its servers, and it processes them on our behalf. Its servers may be located outside the UAE.
- Google LLC (Gemini service): only the cleaned AI helper text, as described in section 7.
- Workshop owners and advertisers: aggregated statistics only, containing no ID.
- Government and judicial authorities: where the law requires it or under an order from a competent authority.
- Our professional advisers (such as lawyers and auditors): where needed, under a duty of confidentiality.
- If the Service is transferred to another operator: the data needed for the Service to continue moves to it, under this policy, and we will announce this in the app.
When you tap "Call", "WhatsApp", "Directions" or "Share" you move to apps provided by others, and your data there is governed by their policies.
13. Transfers outside the UAE
- Your data may be processed on servers outside the UAE: by our hosting provider, and by Google for the AI helper text.
- We rely on the grounds the Data Protection Law allows, including your express consent to the transfer of the AI helper text, our providers' contractual data protection commitments, and the transfer being necessary to provide the Service you ask for. We keep what we transfer to the minimum needed.
14. How long we keep data
- Install ID: on your device until you delete the app or clear its data. We do not store the original ID on our servers.
- Workshop contact records: 90 days, then aggregated counts with no ID.
- Ad serving and measurement records: until 90 days after the campaign ends, then daily totals with no ID.
- AI helper texts: 90 days, with no ID.
- Reports: the hashed ID for 12 months after the report is closed; the report record without an ID for up to 3 years.
- Ratings: the hashed ID for 12 months; the rating without an ID while the workshop is listed.
- Security reports: 180 days.
- Error logs in our systems: 14 days.
- Applications that are not listed: 12 months from the decision.
- Agreement acceptance records and licence check data: for as long as the workshop is listed and 5 years after the listing ends.
- Emails: as long as needed to handle your request, and at most 24 months, unless a longer period is needed to establish or defend a right.
- Invoices and accounting records: for the period required by UAE tax and company law.
15. How we protect data
We take reasonable technical and organisational measures suited to the nature of the data, including: encrypted connections (HTTPS) between the app and our servers, hashing the install ID as soon as it arrives, removing phone numbers and email addresses from AI helper text, role-based access to the admin panel, and automatic deletion on the schedules above. No system is completely secure, so we cannot give an absolute guarantee of security. If a breach puts your data at risk, we will notify the competent authorities and you as the law requires.
16. Your rights
Under the Data Protection Law, and within its limits, you have the right to:
- get information about the data we process about you, its purposes and who receives it, and a copy of it;
- receive data you gave us in a structured, machine-readable format, where this applies;
- have inaccurate data corrected or completed;
- have your data deleted when it is no longer needed for its purpose, when you withdraw consent, or if the processing is unlawful;
- restrict processing in certain cases, such as when you dispute the accuracy of the data;
- object to processing or ask us to stop it, including direct marketing;
- withdraw your consent at any time;
- object to decisions based solely on automated processing that have legal effects or significantly affect you. We do not make such decisions: the AI helper's suggestion is only a suggestion.
How to exercise your rights: write to info@mutassfhati.app with your request. Because we do not know who app users are, we may only be able to link app records to you through the install ID; we will explain how to do this, and we may ask for what is needed to verify your identity or capacity. You can also delete the app or clear its data at any time: a new ID is then created, and earlier records are no longer linked to your device.
We answer your request free of charge within 30 days of receiving it. We may extend this once by the same period if the request is complex, and we will tell you why. We may refuse all or part of a request where the law allows, for example when we must keep a record the law requires, and we will tell you the reason.
17. Children
The Service is intended for people aged 18 or over and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you learn that a child has given us personal data, write to us and we will delete it.
18. Complaints
If you have a complaint about your data, please write to us first at info@mutassfhati.app and we will work to resolve it. You also have the right to complain to the UAE Data Office.
19. Changes to this policy
- We may change this policy when the Service or the law changes. The version number and the date of the last update appear at the top of the page. If a change is material, such as a new type of data or a new recipient, we will announce it clearly in the app before it takes effect and ask for your consent where the law requires it.
- This is version 1.2, effective 14 October 2026.
20. Language
This policy is written in Arabic and English. If the two texts differ, the Arabic text prevails.