Privacy Policy

ℹ️ 1. Overview

M3allem ("we", "our", or "us") operates a marketplace mobile application that connects clients with local artisans and skilled tradespeople. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our iOS and Android application.

By creating an account or using M3allem, you agree to the collection and use of information in accordance with this policy. If you do not agree with any part of this policy, please do not use our app.

📋 2. Data We Collect

The following table summarises every category of data our app collects, why it is collected, and whether it is linked to your identity.

Data We Do NOT Collect

• Card numbers, CVV, or full payment card details (handled exclusively by Stripe outside our app)
• Device contacts or address book
• SMS or native email content
• Browsing history or search history
• Health or biometric data
• Sensitive personal information (race, religion, political opinions, etc.)

⚙️ 3. How We Use Your Data

App Functionality

• Authenticate your account and keep your session secure
• Display your profile and connect you with artisans or clients
• Enable real-time chat between clients and artisans
• Process point purchases and manage your wallet balance
• Show nearby artisans on the map using your location
• Deliver push notifications for chat messages and booking updates

Product Personalisation

• Sort and display artisans based on proximity to your location
• Display your profile photo and name in listings and conversations

Analytics & Administration

• Review payment and transaction records (admin dashboard only)
• Detect and prevent fraud or abuse on the platform

Diagnostics

• Monitor app stability and fix crashes via Firebase
• Measure and improve app performance

🤝 4. Third-Party Services

We use the following third-party services to operate M3allem. Each provider has their own privacy policy.

🔒 5. Data Sharing & Disclosure

We do not sell, rent, or trade your personal information. We may share data only in the following limited circumstances:

• With other users: Your name, profile photo, rating, and service information are visible to other users of the platform as part of the marketplace's core functionality.
• With service providers: Only the third-party services listed in Section 4, strictly to provide the app's functionality.
• For legal compliance: If required by law, court order, or governmental authority.
• For platform safety: To prevent fraud, abuse, or harm to users or our platform.
• In a business transfer: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before this occurs.

🗓️ 6. Data Retention

We retain your personal data only as long as necessary to provide our services:

• Account data (name, email, profile): Retained while your account is active. Deleted within 30 days of a verified account deletion request.
• Chat messages: Retained while the associated chat exists. Deleted when a chat is deleted by an admin or user.
• Payment records: Retained for 7 years to comply with financial record-keeping obligations.
• Device token (FCM): Cleared immediately upon logout. Refreshed on each new login.
• Crash & performance logs: Retained for up to 90 days by Firebase.
• Location data: Processed in real-time and on-device only — not stored in our database.

🛡️ 7. Security

We take the security of your data seriously and implement the following measures:

• All data in transit is encrypted using TLS 1.2+
• Data at rest is stored in Supabase, which uses AES-256 encryption and row-level security (RLS)
• Payment processing is handled by Stripe, a PCI-DSS Level 1 certified provider — we never store card numbers
• Authentication tokens are securely managed via Supabase Auth with JWT
• FCM tokens are cleared on logout to prevent unauthorized push delivery

While we implement industry-standard safeguards, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

👶 8. Children's Privacy

M3allem is not directed to children under the age of 13 (or 16 in jurisdictions where that is the applicable minimum age). We do not knowingly collect personal information from children.

If you believe a child has provided us with personal data without parental consent, please contact us immediately at the address below and we will delete the data promptly.

⚖️ 9. Your Rights

Depending on your country or region, you may have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you.
• Right to rectification: Correct inaccurate or incomplete data.
• Right to erasure: Request deletion of your account and associated data ("right to be forgotten").
• Right to restriction: Ask us to limit how we process your data.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to certain types of processing.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at the address in Section 11. We will respond within 30 days.

Account Deletion

You can request full account deletion by contacting us directly. Upon a verified request, we will delete your account data within 30 days, subject to retention obligations (e.g., financial records).

📝 10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last updated" date at the top of this page
• Notify you via an in-app notification or email for material changes

We encourage you to review this policy periodically. Continued use of the app after changes constitutes acceptance of the updated policy.

📬 11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out: