Privacy policy · Masrouf for Work

Your account. Name, email address, initials and password. We never store or log your password: our sign-in provider keeps only a one-way hash. You sign in with that provider directly; when you open the account, change or reset your password, or delete the account, the password passes through our server to it. If you ask for help signing in, our administrator can set a new one.

Your settings. Work week, time zone, firm, how often you submit, currencies, default rates, and your day rate if you work solo.

When you open an account. The country you pick (it sets your time zone and weekend; it is in the new-account notice our administrator receives, and when you sign up with an email link it is also kept with your sign-up request for about 8 days), an agency’s company name, and the version of the terms and this policy you accepted.

Your receipts. The photos, PDFs and text you send, what is read from them (merchant, dates, time, amount, currency, expense code), your notes, corrections and flags, the amount your bank charged when you type it in, and a fingerprint (SHA-256) of each file to spot duplicates. JPEG, PNG and WebP photos are stored without their metadata (no location, camera or time data); one we cannot re-encode is refused. GIFs lose their metadata whenever the file can be rewritten safely. A photo in another format, such as iPhone HEIC, becomes a JPEG without metadata when we can read it, and is otherwise kept exactly as sent, metadata included. PDFs are stored exactly as you sent them, with any metadata inside, such as the author.

Your periods and packs. Dates, timesheet (onsite, remote or off), rates, currencies, pack name, firm, and each pack’s history: when it was finished, downloaded, submitted, approved, paid, returned or re-opened, and by whom.

If you link WhatsApp. Your phone number, the identifier WhatsApp gives us for you, the messages and files you send to our number, our replies, and Meta’s technical details for each message (including a document’s file name and any delivery error). We do not store your WhatsApp profile name.

If you link Masrouf Personal. You link by email, from either side: the address you type in Settings is sent to Masrouf Personal, a separate service from the same operator, which emails it a link to confirm; and when someone types your address in Masrouf Personal, it sends us that address with their first name and a masked email address or the last two digits of their number, and we email you a link to confirm — or, if the address has no Masrouf account, an invitation to open one, already linked. Neither side is told whether an address has an account. Once linked, the bills you mark personal — day, amount, currency, shop, code and the bill’s image — are sent to Masrouf Personal, and bills you send from there arrive here. Before a bill comes here, Masrouf Personal asks where it would land, and our answer says whether a matching bill is already in your packs and whether that pack is still open. Your agency and firm never see the link or anything that crosses it; a bill you send to Work becomes part of your pack like any other.

From your agency. Your email address (for its invitation); the terms it sets for you (day rate, currency, margin, notes: you see the rate, not the margin or notes), whose day rate, currency and margin are also pinned to each pack you finish under it, so the pack keeps the terms it was finished under; the notes it writes when it returns a pack; and the status changes it makes.

Automatically. Our hosts receive your IP address, browser type and the pages you request. Cloudflare Turnstile checks some forms (section “Cookies and browser storage”). We record each automatic read and download (when, model, tokens, time taken, file size, success), never what the receipt said. To limit attempts we keep keyed codes (HMAC) of the email address, network address or phone number that asked; they are pseudonymised, not anonymous.

About other people.

• A receipt can name others, such as a driver or a co-traveller; we process them only as part of your receipt, and they can write to expenses@masrouf.ai. Send only receipts for your own work expenses.
• An agency gives us the email address of each person it invites; we use it only for the invitation.
• If someone without an account writes to our WhatsApp number, we keep a keyed code of their number until 3 days after their last message and send at most one “not linked” reply a day. We never open their files or send their messages to the AI.

What you must give. Name, email, password, initials, and the box for the terms; without them we cannot open an account. Everything else is optional.

Emails we send, from expenses@masrouf.ai: address confirmation (or, when the address already has an account, a reminder with links to sign in and to reset the password), password resets, agency invitations, agency approval, a pack returned by your agency (with its note), a pack you finish, to your agency’s reviewers (your name and the pack’s dates), a link to confirm linking Masrouf Personal when it was asked for with your address (or, if the address has no account, an invitation to open one), and account deletion. Our administrator receives notices of new accounts (name, email, account type, agency, country) and a weekly summary in our administrator’s mailbox. No marketing email.

WhatsApp messages we send first. Only when your agency acts, and only to a linked number: a reminder that a month’s pack is due, and a notice when a pack is returned (with the agency’s note), exported, submitted, approved or paid. At most one reminder and three notices of each kind a day. Your agency is told how many were sent, never your number. Reply STOP or use the switch in Settings → Privacy & data to turn them off; START turns them back on.

• UAE: the law has no “legitimate interests” basis, so for UAE residents those rows rest on what the service you asked for needs, or on a legal obligation.
• Canada: using the service is your consent to the purposes marked contract; we ask separately for anything beyond them.
• A receipt can reveal health or religion (a pharmacy bill, say). We do not look for it or use it for anything else.

We never sell your data, share it for advertising, or train AI on your receipts.

What it reads. Claude, made by Anthropic, PBC (United States), reads through Anthropic’s commercial API: the receipts you send; WhatsApp text that is not a command or correction (a typed bill such as “taxi 15”, or anything else, which it tries to file as a bill); and corrections our own rules cannot understand.

What we send. The file, or the text (at most 300 characters), or a correction with the bill it corrects. With it, your expense codes, today’s date, your time zone and your default currency. Never your name, email address or phone number.

What comes back. Dates, time, merchant, amount, currency, an expense code and a confidence score. We bound it (an impossible amount is filed unread), the model is told to ignore instructions written on a receipt, and you can change every field.

At Anthropic. Anthropic is our processor and its terms forbid training on what we send. It deletes requests and answers within 30 days; a request its safety systems flag can be kept up to 2 years, and its safety scores up to 7 years.

Not read by AI: entries made with Add entry, bills filed over your monthly AI limit, messages from people without an account, commands, and corrections our rules understand.

People. People at Masrouf look at messages only to help you, fix a fault or stop abuse.

Automatic decisions. Readings are suggestions: Masrouf flags a bill that is uncertain, looks like a duplicate, is dated outside the period, has no file, or that you flagged, and a flag never changes what was read. Two kinds of bill are also held out of your totals and your pack automatically, and shown to you waiting: in a period in progress, the later of two bills that look like duplicates, until you keep it or drop it (finish the period without answering and it stays out of that pack, still listed); and a bill dated in a period you already finished, until you say where it goes. These are decided with no person involved:

• Read budgets: 120 reads an hour and 400 a day per account; on WhatsApp, 80 messages an hour per number. Over them nothing is filed; send it again later. Downloads have an hourly limit too.
• Monthly AI limit: accounts opened by sign-up or invitation have an estimated AI cost limit of US$5 a month, which our administrator can change. Over it, bills are still filed, unread, for you to fill in.
• Sign-up: refused for a throwaway inbox, an address that already opened an account by sign-up, or when sign-ups are full. An agency account opened by sign-up waits for a person’s approval.

Each tells you, when it happens, that it was decided automatically. None has legal or similarly significant effects: people decide what is submitted, approved or paid. Write to expenses@masrouf.ai and a person will review it and tell you the information used and the main reasons.

• Each handles your data on our instructions. Meta is also its own controller of your WhatsApp account, Vercel of its platform logs, and Cloudflare of the signals it uses to improve bot detection.
• GoDaddy (our domain), the exchange-rate feeds (they receive only a date) and GitHub (our code) receive no personal data.
• We list a new provider here, and tell you in the app or by email, 30 days before it receives your data.

Others who receive data

• Your agency, as the section “What your agency sees” describes.
• Our administrator (the founder), to support you and run the service, sees the accounts list (name, email, type, firm, agency, receipt counts, AI usage, WhatsApp status), an agency’s terms and the messages sent first, and can create, change, deactivate or delete accounts and approve agencies. To answer a privacy request or to support you, the administrator can also download an account’s whole data: the same zip as Download my data.
• Masrouf Personal, run by the same operator: its administrator screens show each Work account’s name with its AI usage and cost, for internal cost reports. No email, phone number or receipt.
• Authorities, only when the law requires it. We check each request, disclose no more than it needs, and tell you unless the law forbids it.
• A new owner. If the service moves to a company, or is sold or merged, your data moves with it under this policy. We tell you 30 days before, and you can delete your account first.

Where it goes

• India (Mumbai): storage and the application.
• United States: AI reading, Vercel’s logs and metadata, and the parent companies of our providers.
• Your agency’s country, for packs you finish under it: part of the arrangement you joined by accepting its invitation.
• Meta’s, Google’s and Cloudflare’s networks, in the countries each provider lists.

Nothing is stored in Singapore, where Supabase’s contracting company sits. Authorities in these countries may have powers to demand data under their own laws.

How it is protected

• The EU has no adequacy decision for India; for the United States, only for companies certified under the Data Privacy Framework.
• For residents of the UAE and Saudi Arabia, these are transfers needed to provide the service you asked for.
• Quebec residents’ information is communicated outside Quebec, to the countries above.
• Ask expenses@masrouf.ai for a copy of the safeguards.

An agency sees you only after you accept its invitation. From then on:

• About you: your name, email address, initials, firm, the date you joined and whether you are active.
• Periods in progress: their dates, stage and history. Never their contents.
• Packs you finish under it: a summary (receipts, totals, days worked, firm, history, its invoice line) and the whole pack: expense sheet, timesheet and every receipt file, also as part of a monthly bundle with a summary of every receipt.

It can set your day rate and margin, send a pack back with a note, move a pack forward (submitted, approved, paid), and ask us to send you WhatsApp reminders and notices.

It never sees packs you finished before you joined it or under another agency, another agency’s actions on your periods, your phone number or WhatsApp messages, or your own rate when you work solo.

When you leave, it stops seeing you in Masrouf, and the terms it set for you stay as section “How long we keep it” says. What it downloaded stays with it, under its own privacy notice, and we cannot delete it. For those copies, and the margin and notes it keeps, ask the agency; if you cannot reach it, we pass your request on.

You have these rights wherever you live:

We never treat you worse for using your rights.

How to ask. Write to expenses@masrouf.ai from your account’s email address. We may ask you to confirm the request from that address. Someone can ask for you with your written authority. It is free unless a request is plainly unfounded or excessive. If we refuse, we tell you why and how to appeal to us and to your regulator. We log requests and answers.

Deleting your account (email, password and the human check) deletes at once your periods, receipts and files, rates, WhatsApp link and messages, history, usage records, invitations to your address and your sign-in, and we email you to confirm. What remains for a while: backups (7 days), copies at Anthropic and Meta, the sign-up key (24 months, for self-made accounts), and records of terms accepted and requests (5 years). An agency account can be deleted once nobody reports to it. A deactivated account keeps its data until you ask us to delete or reactivate it.

By region. We answer within 30 days everywhere. If a request is complex we may extend once, within the limit below, and tell you why within the first 30 days.

• It is offered in the Middle East and is not directed at Europe, so we have not appointed an EU, UK or Swiss representative. Used from there, every right above applies in full.
• Quebec: the person in charge of protecting personal information is Mark Nourallah, Privacy Officer.
• United States: we do not sell or share personal information, target ads, or use sensitive information to infer things about you. To appeal a refusal, reply “Appeal” to our answer.

• A private database and file store, encrypted in transit (HTTPS with HSTS) and at rest by our host. Every table has row-level security, with no public access.
• Your browser never reaches the database: every request goes through our application, which checks who you are and shows each account only its own data. Signing in, signing out and keeping your session fresh go straight to Supabase’s sign-in service; every other request, including password changes, goes through our application.
• Passwords of at least 10 characters; your current one to change it or delete your account; limited attempts.
• Files checked by their content and capped in size, pages and pixels. WhatsApp messages accepted only with Meta’s signature.
• Logs scrubbed of email addresses, long numbers and keys.

No system is perfectly secure. If a breach affects your data, we notify each regulator the law requires within its deadline (72 hours in Qatar, Saudi Arabia and the EU, for example), and tell you without undue delay what happened and what to do, whenever your law requires it. We record every breach in a register.

Masrouf is meant for adults. If you've added bills or photos about your children and want them gone, delete them in the app, or write to expenses@masrouf.ai and we'll delete them for you. Deleted data is removed at once and is gone from our backups within 7 days.

Masrouf sets only what it needs and remembers choices you make. No analytics, advertising or tracking cookies or scripts, so nothing to consent to; Global Privacy Control has nothing to switch off. Fonts come from our own domain.

Cookies

Cloudflare Turnstile, on the sign-in, sign-up, join, password-reset, change-password and delete-account forms, reads your IP address, browser and connection signals to check that a person is filling in the form. Cloudflare also uses those signals, as its own controller, to improve its bot detection.

Browser storage, on your device until you clear it

Session storage, cleared when you close the tab

• We tell you about a change that matters, in the app or by email, at least 30 days before it applies. Where the law requires your consent to a change, we ask for it.
• We record which version you accepted when you opened your account, and which later version you were shown and acknowledged.
• Corrections that do not change how your data is used apply when published.
• Earlier versions are sent on request.

Nothing in this policy limits the rights you have under the law where you live.

• Responsible for your data: Mark Nourallah, trading as Masrouf. We are reached by email.
• Privacy Officer: Mark Nourallah, Privacy Officer, expenses@masrouf.ai. Write here about anything in this policy, including the requests above, and for support.

This policy covers Masrouf for Work: masrouf.ai, its WhatsApp number and the emails it sends. Masrouf Personal (my.masrouf.ai) has its own policy.