Privacy Policyسياسة الخصوصية

Effective Date: 26 August 2026
Last Updated: 26 August 2026

Mara liltaqniyat alhadithah alraqimiah Company respects the privacy of users of the “Mara for Files – DocMara” application and is committed to protecting personal data in accordance with the laws and regulations applicable in the Kingdom of Saudi Arabia, particularly the Personal Data Protection Law and its Implementing Regulations.

This Policy explains the nature of the data processed by the Application, the data that may reach the Company, the purposes and legal bases for its processing, the parties to which it may be disclosed, the applicable retention periods, and the rights of Data Subjects and how to exercise them.

1. Identity of the Controller

The Controller of personal data that reaches the Company is:

Mara liltaqniyat alhadithah alraqimiah Company
Unified National Number: 7053388646
Address: Ad Diriyah 13714, Kingdom of Saudi Arabia
Email: support@iammara.com

This entity is referred to in this Policy as the “Company” or “Mara.”

The Company acts as Controller of data it actually receives through purchase transactions, the Website, or support channels. As for files, documents, and content processed locally on the User’s device that do not reach the Company, the Company cannot access, view, recover, or delete them on the User’s behalf.

2. Scope of the Policy

This Policy applies to:

• The “Mara for Files – DocMara” Application on supported Apple devices.
• The Website and web pages dedicated to the Application.
• Technical-support and privacy messages and requests relating to the Application.
• Purchase and Entitlement Data required to activate or restore Paid Services.

This Policy does not apply to independent services, websites, or applications to which the User chooses to export files, such as iCloud Drive, Files, Photos, email, or other sharing applications. Those services are governed by their own policies and settings.

3. Local File Processing

The Application is designed so that its core file-processing tools operate locally on the User’s device, without uploading files to the Company’s servers.

Depending on the tool used, this includes:

• Files, documents, and images selected by the User.
• Copies produced through conversion, compression, merging, splitting, or organization.
• Pages and images scanned with the camera.
• Text extracted using optical character recognition.
• Drawn or typed signatures.
• Passwords set by the User on supported files.
• Quick Response code content and logos added to such codes.
• Images resulting from background removal, resizing, or compression.
• Application settings and language and interface preferences stored locally.

The Company does not receive these files, store a copy of them on its servers, or use them for analysis, training, advertising, or the creation of User profiles. While performing a task, the Application may create temporary files or copies within the Application’s storage area on the device. Those data remain local and under the control of the operating system and the User.

When a file is exported to Files, Photos, iCloud, or another application, management of the exported copy passes to the destination selected by the User. That destination may synchronize the file or store it in the cloud in accordance with the User’s settings and the service provider’s policy.

4. Data the Company May Process

4.1 Purchase and Entitlement Data

When a User purchases a subscription, makes an in-app purchase, or restores a previous purchase, Apple processes the payment and transaction record. The Company does not receive the payment card number or full card details.

To validate the purchase and determine whether a paid feature or plan is active, RevenueCat or the Company may receive limited technical data, such as:

• A technical or pseudonymous identifier specific to the Application.
• The identifier of the purchased product or plan.
• Subscription or entitlement status.
• The Entitlement’s start, renewal, or expiry date.
• Cancellation, refund, or period-expiry status.
• Purchase-receipt or transaction-verification data to the extent made available by Apple.
• Apple store, currency, or offer data when needed to administer the transaction.

These data do not include the content of the User’s files, images, signatures, or passwords applied to files. Providing transaction data is necessary to activate and restore Paid Services and prevent unauthorized use.

4.2 Support and Communications Data

When a User contacts the Company, the Company may process data provided by the User, such as:

• The name or email address appearing in the message.
• The content of the inquiry or report.
• Device model, operating-system version, and Application version.
• A description of the issue, the tool used, the file type, and its approximate size.
• Screenshots or attachments the User elects to send.

Providing these data is optional; however, failure to provide basic technical data may prevent the Company from diagnosing the issue or responding effectively.

The User must not send private or confidential files, or files containing personal or sensitive data, unless necessary and after confirming that the User has lawful authority to send them. In the ordinary course, the Company does not request copies of official identification documents, banking data, or passwords.

4.3 Website Technical Data

When the Website is visited, the hosting provider or content delivery network may process technical data required to deliver and protect the pages, such as:

• Internet Protocol address.
• Date and time of the request.
• Browser type and operating system.
• Requested page.
• Security and automated or malicious-use prevention logs.

These data are used to operate and protect the Website and diagnose faults. They are not used to target the User with behavioral advertising.

4.4 Compliance Records

The Company may retain limited records relating to Data Subject requests, complaints, objections, consents, or security incidents, to the extent necessary to demonstrate compliance with legal requirements and address disputes.

5. Sources of Data

The Company may obtain data from the following sources:

1. Directly from the User when the User contacts support or submits a privacy-related request.
2. From Apple and RevenueCat in relation to transaction and Entitlement status.
3. Automatically and on a limited basis when the Website is visited, through hosting and security systems.
4. From competent authorities where required by law or an enforceable order.

6. Purposes and Legal Bases of Processing

The Company processes data for the following purposes and on the following legal bases:

Performance of the Agreement with the User

• Operating the tools selected by the User locally.
• Verifying subscriptions and purchases.
• Activating and restoring Paid Services.
• Providing technical support and responding to requests.

Compliance with a Legal Requirement

• Retaining records that must be retained by law.
• Responding to lawful requests and orders.
• Addressing complaints, disputes, and legal rights.

The Company’s Legitimate Interests

• Protecting the Application and Website against fraud and misuse.
• Verifying transaction validity.
• Protecting networks and systems.
• Measuring plan and purchase performance on a limited basis.
• Improving service reliability, without analyzing file content or building a behavioral profile of the User.

The Company does not rely on legitimate interests to process sensitive data, and it documents a legitimate-interest assessment whenever required by law.

Consent

The Company may rely on the User’s consent when:

• A sample file or optional attachment is sent to support.
• An optional operating-system permission is enabled.
• New optional processing is introduced that is not covered by another legal basis.

Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.

7. Device Permissions

The Application may request specific operating-system permissions to perform a function selected by the User, including:

• Camera: To scan documents or capture an image.
• Photo Library: To select an image or save a resulting image.
• Files: To select a file or save a result in a destination specified by the User.

These permissions are managed through the device settings and may be refused or withdrawn at any time. Withdrawing a permission may disable the function that depends on it, without disabling other functions that do not require it.

8. Disclosure and Service Providers

The Company does not sell or rent personal data, share it for targeted-advertising purposes, or use advertising identifiers to track the User across the applications or services of other companies.

The minimum data necessary may be disclosed to the following categories:

Apple

Apple processes payments, subscriptions, and purchase records in accordance with its direct relationship with the Apple Account holder and its own policies and terms.

RevenueCat

The Company uses RevenueCat to validate purchase receipts, manage Entitlements, and provide limited purchase-related analytics. The User’s files and their content are not sent to RevenueCat.

Hosting, Security, and Email Providers

Entities that provide Website hosting, content delivery, security, or corporate email services may process the minimum data necessary to perform their services on the Company’s behalf and subject to appropriate contractual obligations.

Advisers and Competent Authorities

Data may be disclosed to legal or technical advisers or auditors where necessary and subject to confidentiality obligations, or to public, judicial, and regulatory authorities where there is a legal basis or enforceable order.

9. Transfer of Data Outside the Kingdom

The User’s files and their content are not transferred to the Company’s servers or to RevenueCat.

However, limited technical transaction and Entitlement Data may be processed outside the Kingdom. Before making any transfer subject to the Personal Data Protection Law, the Company shall identify the applicable legal basis, limit the transfer to the minimum necessary, adopt appropriate contractual, organizational, and technical safeguards, and conduct a transfer risk assessment whenever required.

Apple may process transaction data in the locations it uses to provide its services, in accordance with its terms and policies and its direct relationship with the User.

10. Data Retention and Destruction

Local Files

The Company does not retain a copy of the User’s files. The original file, resulting file, and temporary local files remain under the control of the User and the device.

Local data may be deleted by:

• Deleting the file from the destination in which it was saved.
• Deleting the original file.
• Deleting the Application’s data or removing the Application from the device.

Copies of Application data or files may remain in a device backup or a cloud service enabled by the User, such as iCloud Backup, iCloud Drive, or Photos. Such copies are subject to the User’s settings and Apple’s policies, and the Company cannot delete them on the User’s behalf.

Purchase and Entitlement Data

These data are retained for the period necessary to verify an active Entitlement, administer restoration, renewal, refunds, and disputes, and prevent fraud. They are then destroyed or anonymized when no longer needed, unless applicable law requires retention for a longer period.

Apple and RevenueCat may retain certain records in accordance with their legal and contractual obligations and their own policies.

Support Correspondence

Support correspondence is retained until the request is closed and thereafter for the period necessary to address recurring reports, disputes, or legal obligations. Once its purpose has ended, it is destroyed or anonymized.

Website and Security Logs

These logs are retained for the shortest period necessary to operate and protect the Website and investigate incidents. Retention may be extended where a log relates to an active security incident or legal claim.

The Company periodically reviews the need for data and does not retain it merely because it might be used in the future.

11. Data Subject Rights

Under the Personal Data Protection Law, and subject to the applicable circumstances and legal limitations, the Data Subject has:

• The right to be informed of how the Data Subject’s data are collected and processed.
• The right to access data available to the Company.
• The right to obtain a copy of such data in a clear and readable format.
• The right to request correction, completion, or updating of inaccurate data.
• The right to request destruction of data where the conditions for destruction are satisfied.
• The right to withdraw consent where consent is the legal basis for processing.
• The right to submit a complaint to the competent authority.

Rights may be exercised by email at: support@iammara.com.

The Company may request reasonable information to verify the identity of the requester or the requester’s relationship to the transaction and will not use that information for another purpose. The Company shall implement the request within the periods prescribed by law. Those periods may be extended in the cases and within the limits permitted by the Implementing Regulations, with notice to the requester in accordance with legal requirements.

The Company cannot provide the User with a copy of files it never received. Requests relating to payment card data or an Apple purchase record retained by Apple may also require the User to contact Apple directly.

12. Data Security and Personal Data Breach Incidents

The Company applies organizational, administrative, and technical measures proportionate to the nature of the data and the risks of processing, including as appropriate:

• Restricting access to authorized persons.
• Protecting accounts, keys, and systems.
• Using encrypted connections when transmitting data to service providers.
• Minimizing data to the extent necessary.
• Managing and reviewing permissions.
• Maintaining incident records.
• Reviewing entities that process data on the Company’s behalf.
• Maintaining incident-response and recovery procedures.

No electronic method can guarantee absolute protection; however, the Company takes reasonable and proportionate measures to prevent unauthorized access, leakage, alteration, or destruction.

Where a Personal Data Breach requires notification, the Company shall notify the competent authority and Data Subjects within the periods, cases, and procedures specified in the Personal Data Protection Law and its Implementing Regulations.

13. Children and Persons Lacking or Having Limited Legal Capacity

The Application does not require the creation of an account or profile and does not seek to collect or analyze the content of children’s files.

Purchases must be made by a person having full legal capacity or with the consent of the legal guardian, in accordance with Apple Account settings and legal requirements. A legal guardian may exercise the Data Subject rights of a person lacking or having limited legal capacity in accordance with the law.

The age rating displayed in the App Store does not mean that a User lacking legal capacity has independent authority to enter into a purchase contract.

14. Automated Decisions and Tracking

The Company does not use data from the User’s files to make automated decisions that produce legal or material effects concerning the User, does not build behavioral profiles about the User, and does not use the User’s data for advertising tracking across applications and websites.

RevenueCat analytics are limited to the purchase and Entitlement Data needed to operate and measure plans and do not include the content of documents, images, or signatures.

15. Updates to this Policy

This Policy may be updated when the Application, service providers, or legal requirements change.

The Company will state the date of the latest update and will use an appropriate means to notify the User of material changes before they take effect whenever possible. Updates will not be used to expand data processing retroactively without a legal basis, and new consent will be requested where consent is required.

16. Complaints and Contact

For privacy inquiries, rights requests, or complaints:

Email: support@iammara.com
Mara liltaqniyat alhadithah alraqimiah Company
Ad Diriyah 13714, Kingdom of Saudi Arabia

If a complaint is not resolved satisfactorily, the Data Subject has the right to submit a complaint to the competent authority through the approved channels in the Kingdom of Saudi Arabia.

17. Governing Language

This Policy is available in Arabic and English. In the event of any difference in meaning or interpretation, the Arabic version shall govern, without prejudice to any mandatory rights granted by applicable law.