Privacy policy · Masrouf Personal

Your account. Your name, your email address if you give one, your role and your settings (your own country, currencies, default for new bills, summary choice, display). How and when you joined, and which version of the terms and this policy you accepted. Our sign-in provider keeps only a one-way hash of your password.

Your WhatsApp. A keyed code (HMAC) made from your number, with its last four digits and country code; WhatsApp's id for you; your WhatsApp profile name, which names you until you change it. We never store your full number. The keyed code is pseudonymised, not anonymous: we can match it against a number you give us.

How you started. With START, your number's country code sets your household's country, currency, weekend and time zone, and we ask once whether you live there. With email sign-up, your name, email address and the country you pick; your browser's time zone and your internet address's country only suggest one. With a family's invite, your profile name and your number's country code.

Your household. Its name, home currency, time zone, weekend, country, payday and Lebanese pound rate.

What you send: photos, PDFs, screenshots, typed lines such as "taxi 15", bank text messages, statements and spreadsheets. For each bill we keep:

• what was read: date and time, shop or payee, amount and currency, any second currency and its rate, category, wallet, a statement's period, and how sure the reader was;
• what you or your family add: a note, tags, who it was for, who paid, and whether it is Home or Personal;
• the file, with a fingerprint (SHA-256) to spot duplicates. Photos are stored upright without their location, camera or time data: a JPEG, PNG, WebP or GIF we cannot store that way is refused. A HEIC, HEIF, AVIF, TIFF or BMP photo becomes a JPEG without that data; one we cannot open is never refused: it is stored exactly as you sent it, that data included, and filed unread for you to fill in. PDFs are stored as you sent them.

Not kept: your WhatsApp messages as text (only the bills read from them, and the words of a bill that waits for your review — see WhatsApp records), the text of a forwarded bank message, your card's last four digits (we may show them in our reply), and voice notes, which we neither listen to nor transcribe.

WhatsApp records. For each message to or from our number: direction, time, message id, kind, what we did and which bill it filed; no text. While a question from us is open, we keep the words it is about, with card, account and phone numbers removed. A bill from your message that waits for your review keeps those words, and what was read, until you confirm it on the website — then the bill keeps what it records — or for up to two days after you confirm it on WhatsApp or drop it, so either can be undone for a day; only you see it.

Usage and technical data. For each AI reading, correction, import and export: its kind, whether it worked, the model, size, time, cost and the bill it touched, never what the bill said. Our hosts receive your internet (IP) address, browser type and the pages you request; to limit attempts we keep keyed codes of your internet address and of the numbers and codes used to sign in.

People who write without an account. We keep a keyed code of their number, reply "not linked" at most once a week, and never open what they send or pass it to the AI.

What you must give. A name, a WhatsApp number or an email address, and a country; without them there is no account. Everything else is optional.

• Personal bills are seen by you alone. No other member, the owner included, can see or count them, and they are in no Home figure.
• Home bills are seen by the household's adults: the owner, adults and view-only adults. Senders, as everyone who joins by invite starts, see only their own bills.
• Only you can move your bill between Home and Personal. Adults can change or delete a Home bill, whoever filed it; a view-only adult cannot.
• A file with several bills on it, such as a statement, opens only for someone who can see every bill on it.
• Your default for new bills. Invited members start on Personal; a member made an adult is asked once. Alone, the owner files as Personal; once someone joins, the owner is asked once whether to share those earlier bills, and new ones go to the Home (change it in Settings). If you message us from a number with a Quebec area code, your new bills are filed as Personal from then on, whatever your role, until you choose otherwise in Settings. We check once, on the first message that reaches us with your number, and tell you when we change it.
• What members see of each other: names, roles, when each joined, whether they linked WhatsApp or can sign in, and whether they left. Adults also see a number hint (country code and last two digits, such as +961 …21), and are told it with the name when someone joins. Nobody sees another member's email or full number. Nothing crosses households.

The owner can remove a member. The member loses access at once, and their number cannot rejoin for 90 days. We keep their Personal bills and files out of the household's sight for 30 days, then erase them. We send them a link to download them by email if they gave one, and on WhatsApp if they wrote to us in the last 24 hours and had not turned off the messages Masrouf sends first (STOP, or the switch in Settings); when neither reaches them, the owner is told, and they can write to expenses@masrouf.ai for their data within the 30 days. The Home bills they filed stay, and once their data is erased they show "Former member".

Moving into a family. If you already have a Masrouf, your bills move with you and stay Personal. While the move is under way we keep a copy of what is moving, so an interrupted move can finish; it is deleted when the move finishes, or 30 days after the move began.

What the operator sees. Our admin page shows each member's name, email, household, country, role, last-active date, AI usage, and whether their reading was paused or their messages flagged; never a bill. People who run Masrouf can reach the database and files through our providers' tools, and do so only to answer your request, fix a fault, stop abuse, handle a security incident or meet a legal duty.

We never ask for your bank login, connect to your bank or move money. We hold only what you send.

Forwarded bank text messages. One-time codes and declined payments are dropped unread. Before the rest reaches the AI, we remove bank account numbers (IBANs), card numbers and phone numbers written the way phone numbers are (international ones, and local ones in a shape an amount never takes), never amounts; the same runs on lines you type. A phone number written like an amount, such as one ending in 000, can still reach the AI. We keep the details read (date, amount, currency, merchant, category), not the message.

Bank statements (PDF).

• What the AI receives. A statement's pages go to the AI as they are, with everything the bank printed on them, including your name, address and account number.
• What we keep. One bill per row (date, amount, currency, payee, category, period) until you delete it, and the statement file, so you can check a row, for 90 days after reading. A long statement's working copy is deleted within a day.

Screenshots of bank apps and messages are kept whole, like any photo. Crop out full card or account numbers if you can.

Spreadsheets from your bank. The file itself is never stored: on the website it is read in your browser, on WhatsApp in our server's memory. Its rows reach us for the preview, including rows you then leave out, and are deleted when you import or cancel, or after 24 hours. To learn the columns, the AI sees a masked sketch.

Learned layouts. A bank's first statement or spreadsheet may teach us its layout: column positions, date and number formats, label patterns. It is learned from masked text and holds no amount, date, balance, name, payee, account number or statement period. A layout checked against the statement's own totals in two different households is shared with every household whose bank uses that format. Your household's layouts, and the record that it confirmed a shared one, are deleted with the household; a layout unused for 12 months is deleted sooner. To keep your statements from confirming shared layouts, write to expenses@masrouf.ai; they are still read normally.

Only if you link it. Masrouf for Work is a separate service from the same operator, for the expense packs consultants send their agency or firm. You can link your Masrouf Personal to a Masrouf for Work account you made yourself: on either side, type the email address you use on the other, and that service emails it a link to confirm, or to create an account there if it has none. Nothing crosses until you have asked on one side and confirmed by email on the other.

• What crosses, and only when you say so. A bill you send to Work — its date and time, amount, currency, shop, category, and its own photo or PDF — goes to Masrouf for Work, and a bill you mark personal there arrives here as your own Personal bill, its photo or PDF with it. A bill you send to Work becomes part of your Work pack like any other: your agency or firm sees it once you finish the pack.
• What never crosses: notes, wallets, tags, splits, who a bill was for or who paid, your household and its members, and your phone number. A bank statement, an import, a message or a picture holding several bills is never sent as a bill's image.
• What each side shows to confirm the link. Masrouf for Work shows you your first name with the last two digits of your WhatsApp number, or your email address masked (such as m•••@gmail.com). We show you the Work account's short name, masked email address and the day it was opened.
• Nobody else in your household sees the link or a bill that came from Work: it arrives as your own Personal bill, and if you move it to Home it shows there as an ordinary bill.
• What we keep: the link — when it was made, confirmed and ended, and how Work named its account — and, for each bill that crossed, where it lives now and how many times it moved, for as long as you are a member, so that it is never filed twice. If you merge a bill from Work with a line from your bank statement, that record also keeps the bill's own amount, currency, exchange rate and day for as long as the bill exists, so it can go back to Work as Work sent it; they are erased with the bill. A bill you send to Work stays here out of sight, with its photo or PDF, for 7 days so Work can fetch the file, then it is erased. A part you split off a bill and deleted is kept, out of sight, while that bill is in Masrouf for Work or on its way there — at most 7 days, longer only while Work's answer is still awaited — and then erased. When you leave, are removed or delete your account, all of it is erased at once and Masrouf for Work is told the link ended; if the Masrouf for Work account is deleted, we erase the link and how Work named it. Masrouf for Work keeps its own record of the link under its policy. Your download in Settings → Privacy & data includes it.
• Unlink whenever you like, in Settings → Masrouf for Work or on WhatsApp (unlink work). Unlink and remove everything that came from Work, in Settings, also deletes every bill that arrived from there.

What Claude (Anthropic, PBC, United States, through its commercial API) receives:

• photos, screenshots and PDFs, and statements as Bank statements describes;
• typed lines and bank text messages, after the removal above;
• payee names, and masked sketches of spreadsheets and statements;
• when the assistant answers a message or makes a change you asked for: your last five bills, the bill you replied to if you can see it, your household's category names and most-used shops, and each member's first name and role. Never another member's Personal bills, and never notes.

At Anthropic. Anthropic is our processor, and its terms forbid training its models on what we send; we do not train on it either. It deletes requests and answers within 30 days; a request its safety systems flag can be kept up to 2 years, and its safety scores up to 7 years.

Testing a new assistant. We may run a new version of the assistant beside the current one on the messages you type, with the same household details, and throw its answers away. This rests on our legitimate interest in the quality of the service; write to expenses@masrouf.ai to object and we stop testing on your messages.

The AI can be wrong. It asks when it is unsure, and you can correct every bill. Masrouf is a record of spending, not financial advice. We record no health conditions, beliefs or diagnoses: categories describe what was bought, and Pharmacy & personal care sits under Shopping.

Decided automatically. These happen with no person involved:

Each tells you, when it happens, that it was decided automatically. None has legal or similarly significant effects. Write to expenses@masrouf.ai and a person will review it and tell you the information used and the main reasons.

• UAE: the law has no "legitimate interests" basis, so for UAE residents those rows rest on what the service you asked for needs, or on a legal obligation.
• Canada: you consent to the uses in this table by using the service, and can withdraw by deleting your account.
• A bill can reveal health, religion or family matters. We use it only as part of your household's record.

• Each handles your data on our instructions. Meta is also its own controller of your WhatsApp account; Vercel of its service data; Cloudflare of the signals it uses for its own bot detection.
• GoDaddy (our domain), the exchange-rate feeds (they receive only a date) and GitHub (our code) receive no personal data.
• We list a new provider here 30 days before it receives your data.

Others who receive data

• Your household, as How your household sees it describes. A spreadsheet a member downloads is theirs.
• Our administrator (the founder), as What the operator sees describes. Our administrator's mailbox is emailed when a household is opened or someone joins: household name, the person's name and country, how they joined, and the email address for a household opened by email.
• Masrouf for Work, run by the same operator: its admin screens show each Personal member's name and household with their AI usage and cost, and a weekly summary names new households and members. No email, phone number or bill.
• Authorities, only when the law requires it. We check each request, disclose no more than it needs, and tell you unless the law forbids it.
• A new owner. If the service moves to a company, or is sold or merged, your data moves with it under this policy. We tell you 30 days before, and you can delete your account first.

• India (Mumbai): storage and the server.
• United States: AI reading, Vercel's logs and service data, and the parent companies of our providers.
• Meta's, Google's and Cloudflare's networks, in the countries each lists.

Nothing is stored in Singapore, where Supabase's contracting company sits. Authorities in these countries may have powers to reach data under their own laws.

• The EU has no adequacy decision for India; for the United States, only for companies certified under the Data Privacy Framework.
• For residents of the UAE and Saudi Arabia, these are transfers needed to provide the service you asked for.
• Quebec residents' information is communicated outside Quebec, to the countries above.
• Ask expenses@masrouf.ai for a copy of the safeguards.

We never treat you worse for using your rights.

How to ask. Write to expenses@masrouf.ai from your account's email address; if you use only WhatsApp, from any address, and we confirm it is you with a code sent to your linked WhatsApp. Do not make requests on WhatsApp itself: the AI reads it. Someone can ask for you with your written authority. It is free unless a request is plainly unfounded or excessive. If we refuse, we tell you why and how to appeal to us and to your regulator. We record each request and our answer.

By region. We answer within 30 days everywhere. If a request is complex we may extend once, within the limit below, and tell you why within the first 30 days.

• We have not appointed a representative in the EU, the UK or Switzerland. If you live there, every right above applies in full, and you can write to us directly.
• Quebec: the person in charge of protecting personal information is Mark Nourallah, Privacy Officer.
• United States: we do not sell or share personal information, target ads, or use sensitive information to infer things about you. To appeal a refusal, reply "Appeal" to our answer.

What remains for a while: backups (7 days); copies at Anthropic and Meta (up to 30 days; a request Anthropic's safety systems flag, up to 2 years); records without text (gone within 13 months); records of what you accepted (5 years); and a keyed code of your number or email address (24 months), so one number or address makes one household. It holds nothing else, and you can object to it. Download what you want to keep first.

• A private database and file store, encrypted in transit (HTTPS with HSTS) and at rest by our host. Every table has row-level security with no public access; only our server reaches the database, and it checks each request against who you are and what your role lets you see.
• Phone numbers, codes and internet addresses are kept as keyed codes.
• Files checked by their content and capped in size and pages; WhatsApp messages accepted only with Meta's signature; limits on sign-in attempts, messages and uploads.

No system is perfectly secure. If a breach affects your data, we notify each regulator the law requires within its deadline (72 hours in Qatar, Saudi Arabia and the EU, for example), and tell you without undue delay what happened and what to do, whenever your law requires it. We record every breach in a register.

Masrouf is meant for adults. If you've added bills or photos about your children and want them gone, delete them in the app, or write to expenses@masrouf.ai and we'll delete them for you. A deleted bill can be undone for 24 hours, is then erased, and is gone from our backups within 7 days after that.

Masrouf sets only what it needs and remembers choices you make. No analytics, advertising or tracking cookies or scripts, so there is nothing to consent to; Global Privacy Control has nothing to switch off. Fonts come from our own domain.

Cookies

Cloudflare Turnstile, on the email sign-up form and, where shown, the phone sign-in page, reads your IP address, browser and connection signals to check that a person is filling in the form. Cloudflare also uses those signals, as its own controller, for its own bot detection.

Browser storage, on your device until you clear it

Session storage, cleared when you close the tab

• We post a change that matters here at least 30 days before it applies, and tell you on the website and in our next WhatsApp reply. Where the law requires your consent to a change, we ask for it.
• We record which version you accepted when you joined, and which later version you were shown and acknowledged.
• Corrections that do not change how your data is used apply when published.
• Earlier versions are sent on request.

Nothing in this policy limits the rights you have under the law where you live.

• Responsible for your data: Mark Nourallah, trading as Masrouf.
• Privacy Officer: Mark Nourallah, Privacy Officer, expenses@masrouf.ai. Write here about anything in this policy, including the requests above.
• Help using Masrouf: expenses@masrouf.ai, or help on WhatsApp.

This policy covers Masrouf Personal: my.masrouf.ai, its WhatsApp number +1 514 347 7562 and the emails it sends. Masrouf for Work (masrouf.ai) has its own policy.