Privacy Policy

Madmaj is the controller of the personal data described in this policy: it decides how and why that data is processed. You can reach us about anything in this policy at support@madmaj.com.

We collect the following kinds of data:

• Account details: first and last name, email address, and a hashed form of your password (we never store the password itself). If you choose, a phone number and a profile photo. If you sign in with Google, we receive your name, email address, Google account ID and profile picture from Google.
• Billing details: your plan, billing dates, payment status, and from our payment provider a customer reference, the card brand and the last four digits of the card. The full card number goes directly to the payment provider and never reaches our servers.
• What you add: watchlists, portfolio entries (tickers, share counts, purchase prices), the questions you ask, and settings such as language and theme.
• Usage and technical data: the pages you visit and when, session start and activity times, your IP address, the approximate country and city derived from it, device type, browser and operating system.
• Messages you send us: support requests and any email you send.

We collect this data directly from you and from your device. We do not collect sensitive data such as health, religious or financial-account data, and we do not ask you to give it to us. Do not include it in the questions you ask.

We use this data:

• to create and run your account and to show you your watchlist, portfolio and brief;
• to process payments, renew subscriptions, and send receipts and renewal reminders;
• to keep the Service secure, detect abuse and enforce our terms;
• to understand how the Service is used so that we can fix problems and improve it;
• to send you service emails such as email verification, password reset and billing notices;
• with your consent, to send you product news, which you can stop at any time;
• to comply with legal duties and to establish or defend legal claims.

Under the Personal Data Protection Law of the Kingdom of Saudi Arabia we rely on the following bases:

• Performing our contract with you: running your account, billing, service emails and support.
• Our legitimate interests, where they do not override your rights: keeping the Service secure, preventing abuse, measuring and improving the Service, and defending legal claims.
• Your consent: marketing email, and analytics and advertising cookies where the law requires consent. You can withdraw consent at any time without affecting what was done before.
• Legal obligations: keeping billing and tax records, and answering lawful requests from authorities.

We use cookies for three jobs. Session cookies keep you signed in and remember your plan status; they are needed for the Service to work. Preference cookies remember your language and theme. Analytics cookies and pixels from Google Analytics and Meta tell us which pages are visited and whether our advertising worked; they may set identifiers on your browser and send them to those companies.

Analytics and advertising cookies are not needed to run the Service. Where the law requires it we ask for your consent before setting them, and you can withdraw that consent at any time. You can also block or delete cookies in your browser settings. The Service will still work, but you will need to sign in each time and some features may not work as expected.

We do not sell personal data. We share it only with the parties below. Service providers act on our instructions under contracts that require them to protect your data and to use it only to provide their service to us.

• our payment provider, Tap Payments, to take payments and manage renewals;
• our email provider, Brevo, to deliver service and marketing email;
• our hosting and infrastructure provider, Google Cloud, which stores and runs the Service;
• analytics and advertising providers, Google and Meta, as described in the cookies section;
• Google, when you choose to sign in with your Google account;
• language-model providers that help generate answers when you ask a question. The text of your question and the related market data are sent to them; your name, email and account details are not;
• authorities, courts or professional advisers, when the law requires it or when needed to establish, exercise or defend legal claims;
• a buyer or successor, if Madmaj is sold or merged, in which case this policy continues to apply to your data.

Our market data providers do not receive your personal data.

The Service runs on servers in the United States, and some of the providers above operate in other countries. Your data is therefore transferred outside the Kingdom of Saudi Arabia and processed in countries whose data protection rules may differ from those in your country.

We make these transfers in line with the Personal Data Protection Law and its transfer rules: we transfer only what the Service needs, we put contractual safeguards in place with each provider that receives personal data, and we keep the protections described in this policy wherever the data is. You can ask us at support@madmaj.com for more detail about the safeguards that apply to a transfer.

Account data is kept while your account is open. When your account is closed we delete or anonymise it within 90 days, except for what we must keep for tax, accounting, fraud prevention or other legal reasons. Usage logs are kept for up to 24 months. Billing records are kept for as long as the law requires. Data we no longer need for any purpose in this policy is deleted or anonymised.

We protect data with encryption in transit, hashed passwords, access controls and monitoring. No system is perfectly secure. Keep your password private and tell us at once if you think your account has been misused.

If a security incident affects your personal data in a way that may harm you, we will tell you and the competent authority as the law requires.

Under the Personal Data Protection Law of the Kingdom of Saudi Arabia, and similar laws elsewhere, you have the right to be told how your data is used, to see the data we hold about you, to receive a copy of it in a readable form, to correct it, to ask us to delete it, to restrict or object to some uses, and to withdraw a consent you have given.

Write to support@madmaj.com. We answer within 30 days and may ask you to confirm your identity first. You can also change your details from your profile page. If you are not satisfied with our answer, you may complain to the Saudi Data and Artificial Intelligence Authority or to the data protection authority of the country where you live.

The Service is for adults. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy from time to time. The date at the top of this page shows the current version. Material changes will be announced in the Service or by email before they take effect, and where a change needs your consent we will ask for it.

Questions about privacy can be sent to support@madmaj.com.