Privacy policy

This policy explains what personal data Mudawwana collects about account holders and visitors, why, and the choices you have. Mudawwana is operated by the company operating Mudawwana (legal entity to be confirmed), which is responsible for this data.

What we collect

• Account: your email address and name (from sign-up), and when your account was created.
• Marketplace activity: datasets you list, licences you buy, credit top-ups, sales, payouts, data requests and messages you send or receive, and the API keys you create (we store only a hash of each key).
• Agent usage: the text of queries your agents run against datasets, with time, price and number of results.
• Payments: card details go straight to Stripe; we only receive the payment result, amount and a reference.
• Technical: IP addresses are used briefly to enforce rate limits (counters are kept for about an hour) and appear in server logs.
• Support: what you send us through the support or takedown form, including your email address.

Why we use it

• To run the marketplace: accounts, payments, licences, downloads, payouts and messages (performance of our contract with you).
• To prevent fraud and abuse and keep the service secure (legitimate interests).
• To keep financial records we are legally required to keep (legal obligation).
• To send you emails about your account: receipts, sales, payouts, messages, and listing reviews. We do not send marketing email without your consent.
• To understand how the product is used, through server-side analytics that record your account id and the action (never your email or data contents), without browser cookies.

Who processes it for us

• Clerk (sign-in), Stripe (card payments), Convex (database and file storage, in the EU), Vercel (hosting), Resend (email) and PostHog (product analytics, EU). Each acts on our instructions.
• Other users see your display name on your listings, requests and messages. Sellers do not see buyers' email addresses.
• We disclose data to authorities only where the law requires it.
• Our staff can view accounts, listings, ledgers, messages and agent queries to review listings, handle payouts, investigate abuse and answer support requests. Private messages and query text are opened only for those purposes, and every such access is recorded in an internal audit log.

How long we keep it

• Account data is kept while your account is open. When you delete your account we erase your name and email, withdraw your listings and delete their data, unless a buyer holds a licence to a snapshot (the licensed file is kept so the buyer can still download it).
• Transaction records (credits, sales, payouts) are kept for as long as tax and accounting law requires, linked to an anonymised account.
• Email delivery records are kept for 90 days; rate-limit counters for about an hour.

Your rights

• Access and portability: download everything we hold about your account from your dashboard (“Download my data”).
• Deletion: delete your account from your dashboard at any time.
• Correction, objection and other requests: contact us through the support form.
• If your personal data appears in a dataset listed by someone else, send a takedown notice.
• You can also complain to your data protection authority.

Transfers

Our providers may process data outside your country, including in the EU and the United States, under contractual safeguards.

Changes

We will post changes here and email account holders about material ones.