Privacy Policy

1. Information We Collect

1.1 Account Information

When you register on Mawaheb, we collect your full name, email address, phone number, city of residence, and a password. You may also provide an optional profile photo, bio, and professional details such as skills, portfolio items, and certificates.

1.2 Identity Verification Documents

To verify your identity as a freelancer or to comply with regulatory requirements, we may request government-issued identification documents (such as a national ID or passport). These documents are stored in a private storage bucket and are accessible only through time-limited signed URLs that expire after one hour.

1.3 Payment and Payout Information

When you add a payout method, we collect your financial details such as Palestinian bank IBANs, Jawwal Pay phone numbers, or cash pickup preferences. These details are encrypted using AES-256 encryption and stored in encrypted form. We also maintain records of all transactions processed through the Platform, including escrow payments, commission amounts, and payout disbursements.

1.4 Usage Data

We automatically collect information about how you interact with the Platform, including pages visited, features used, job searches, proposals submitted, messages sent, and timestamps of activity. We also collect device information such as browser type, operating system, and IP address for security and analytics purposes.

1.5 Communications

Messages exchanged between users through the Platform's built-in messaging system are stored to facilitate contract execution and dispute resolution. These messages may be reviewed by administrators in the context of dispute proceedings.

2. How We Use Your Information

• Account Management: To create and maintain your account, verify your identity, and enable you to act as both a client and a freelancer on the Platform.
• Payment Processing: To facilitate escrow payments from clients, calculate and apply platform commissions, process payout requests to freelancers via Jawwal Pay, bank transfer, or cash pickup, and maintain immutable financial audit records.
• Communication: To send you transactional notifications about contract updates, payment confirmations, delivery submissions, dispute escalations, review prompts, and payout status updates via email, SMS, and real-time in-app notifications.
• Security and Fraud Prevention: To detect unauthorized access, enforce account lockout after repeated failed login attempts, flag users with excessive dispute histories, and protect the integrity of escrow funds.
• Platform Improvement: To analyze usage patterns, improve platform features, and optimize the user experience.
• Dispute Resolution: To provide administrators with necessary context — including contract details, communications, and submitted evidence — when resolving disputes between users.

3. Information Sharing

3.1 With Other Users

When you use Mawaheb, certain profile information is visible to other users. This includes your display name, profile photo, city, average rating, number of completed contracts, skills, and portfolio items you have chosen to make visible. Clients can see freelancer profiles when evaluating proposals, and freelancers can see client profiles when considering job posts. Your email address, phone number, and payout details are never shared with other users.

3.2 With Payment Processors

We share necessary transaction details with our Palestinian payment gateway partners to process client payments into escrow. Payout processing to freelancers is handled manually by Platform administrators through external payment channels (Jawwal Pay, bank transfers, or cash pickup agents).

3.3 With Administrators During Disputes

When a dispute is raised on a contract, Platform administrators may access contract details, delivery files, in-platform messages between the parties, and evidence submitted by both sides during the three-tier dispute resolution process. This access is limited to what is necessary to reach a fair resolution.

3.4 Legal Requirements

We may disclose your information if required to do so by law, regulation, or legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Mawaheb, our users, or the public.

3.5 No Sale of Personal Data

We do not sell, rent, or trade your personal information to third parties for marketing or advertising purposes.

4. Data Security

We implement multiple layers of security to protect your information:

• Payout Details Encryption: Your financial information (bank IBANs, Jawwal Pay numbers) is encrypted at rest using AES-256 encryption. Decryption occurs only when an administrator processes your payout request.
• Password Protection: Passwords are hashed using bcrypt with a work factor of 12. We never store passwords in plain text.
• Document Security: Identity verification documents are stored in private storage and are accessible only through signed URLs that expire after one hour.
• Session Security: Access tokens expire after 15 minutes. Refresh tokens are valid for 30 days and are stored exclusively in httpOnly cookies to prevent client-side script access.
• Account Protection: Accounts are locked after 10 consecutive failed login attempts to prevent brute-force attacks.
• Access Control: Role-based access control (RBAC) is enforced on every protected endpoint. Administrative functions are restricted to authorized personnel only.

5. Data Retention

• Financial Records: All payment records, commission calculations, and transaction histories are maintained as immutable records and are retained permanently. These records are never modified or deleted, as they serve as a legal and financial audit trail.
• Contract Records: Contract details, including deliverables, milestones, and dispute outcomes, are retained permanently for legal compliance purposes even after account deletion.
• Account Deletion: When you request account deletion, your account is soft-deleted and all personally identifiable information (name, email, phone number, profile details) is overwritten and anonymized. Financial and contract records are preserved but are no longer linked to identifiable personal data.
• Authentication Tokens: Expired refresh tokens are automatically purged from our systems daily.

6. Your Rights

You have the following rights regarding your personal data:

• Access: You may request a copy of the personal information we hold about you at any time by contacting us.
• Correction: You may update or correct inaccurate personal information through your profile settings or by contacting us.
• Deletion and Anonymization: You may request deletion of your account. Upon deletion, your personally identifiable information will be anonymized. Please note that financial records and contract data are retained in anonymized form for legal compliance.
• Data Portability: You may request an export of your personal data in a machine-readable format.

To exercise any of these rights, please contact us at info@mawaheb.app.

7. Cookies and Local Storage

• Authentication Cookies: We use httpOnly cookies to store refresh tokens for secure session management. These cookies are essential for the Platform to function and cannot be disabled.
• Language Preference: We store your language preference (Arabic or English) to provide a consistent experience across sessions.
• No Third-Party Tracking: We do not use third-party tracking cookies or advertising cookies. We do not serve targeted advertisements on the Platform.

8. Children's Privacy

Mawaheb is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a person under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at info@mawaheb.app.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email or through a prominent notice on the Platform prior to the changes taking effect. Your continued use of Mawaheb after the updated policy becomes effective constitutes your acceptance of the revised terms.

10. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at: