Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

Sama Digital Innovation LLC
United Arab Emirates
Email: privacy@samadigitalinnovation.com
Website: samadigitalinnovation.com

2. Data We Collect

2.1 Account & Identity Data

1. Name, email address, and password (hashed — never stored in plain text)
2. PIN (hashed using industry-standard cryptographic functions, stored in device SecureStore)
3. Biometric identifiers — processed locally on your device only; never transmitted to our servers
4. Country of residence and age confirmation

2.2 Broker & Trading Data

1. cTrader OAuth tokens (encrypted, stored in device SecureStore)
2. Connected broker account identifiers
3. Trading history generated through MACSAP (trade direction, entry/exit prices, P&L, lot size, AI score)
4. Demo Account balance, reset history, and simulated trade log
5. Bot configuration settings (lot size, session preferences)

2.3 Device & Technical Data

1. Device type, operating system, and version
2. App version and build number
3. IP address and approximate geolocation (country level only)
4. Push notification tokens
5. Crash reports and error logs

2.4 Usage Data

1. Features accessed and frequency of use
2. Session duration and interaction patterns
3. Subscription status and billing history (managed by RevenueCat)
4. In-app navigation events

2.5 Data We Do NOT Collect

1. We do not collect, store, or transmit your broker account password or full login credentials
2. We do not access your banking or payment card details directly
3. We do not read, access, or store any data from other apps on your device
4. We do not collect biometric data from your device — biometric authentication is processed entirely by your device's operating system (Face ID / Touch ID)

3. How We Use Your Data

We process your personal data for the following purposes and legal bases:

1. Service delivery — To operate the MACSAP Platform, authenticate your identity, execute bot trading signals, and provide customer support. (Contractual necessity)
2. Safety & security — To detect fraud, prevent unauthorised access, and protect the integrity of the Platform. (Legitimate interest)
3. Subscription management — To process payments, manage trials, and administer your Subscription through RevenueCat. (Contractual necessity)
4. AI signal improvement — Aggregated, anonymised trading outcome data may be used to improve bot engine accuracy. Individual trades are never shared with third parties for this purpose. (Legitimate interest)
5. Legal compliance — To comply with applicable UAE laws, regulatory requirements, and lawful requests from competent authorities. (Legal obligation)
6. Communications — To send you service notifications, security alerts, and — with your consent — product updates. (Consent)

4. Data Sharing & Third Parties

We share data only with the following categories of third parties, strictly as necessary to provide the Services:

1. cTrader / Spotware Systems — Broker connectivity and order execution API. Data shared: OAuth tokens, trade instructions. Privacy Policy →
2. RevenueCat — Subscription and in-app purchase management. Data shared: device ID, purchase history. Privacy Policy →
3. Anthropic — AI confidence scoring via Claude API. Data shared: anonymised market signal parameters only — no personal identifying information. Privacy Policy →
4. Expo / EAS — App build, deployment, and push notification infrastructure. Privacy Policy →
5. TwelveData — Market price data feed. Data shared: API requests only — no personal data. Privacy Policy →
6. Legal & regulatory authorities — We may disclose data if required by UAE law, court order, or competent regulatory authority.

5. Data Storage & Security

1. Sensitive credentials (OAuth tokens, PIN hash) are stored exclusively in your device's encrypted SecureStore — they never leave your device.
2. Server-side data is stored on secure infrastructure with encryption at rest (AES-256) and in transit (TLS 1.3).
3. We implement industry-standard security measures including access controls, audit logging, and regular security reviews.
4. In the event of a data breach affecting your personal data, we will notify you and relevant authorities within the timeframes required by UAE PDPL.
5. We retain your data for as long as your account is active and for a period of 3 years thereafter for legal compliance purposes, unless a longer retention period is required by law.

6. Your Rights Under UAE PDPL

Under the UAE Personal Data Protection Law, you have the following rights:

1. Right of access — Request a copy of all personal data we hold about you
2. Right of rectification — Request correction of inaccurate or incomplete data
3. Right of erasure — Request deletion of your personal data, subject to legal retention obligations
4. Right to object — Object to processing based on legitimate interest
5. Right to data portability — Receive your data in a structured, machine-readable format
6. Right to withdraw consent — Withdraw consent for marketing communications at any time

To exercise any of these rights, contact us at privacy@samadigitalinnovation.com. We will respond within 30 days.

7. Cookies & Analytics

1. The MACSAP mobile application does not use browser cookies.
2. The MACSAP website (macsap.com) may use essential cookies for functionality and analytics cookies to understand usage patterns. Non-essential cookies require your consent.
3. Analytics data is aggregated and anonymised — individual users are not tracked across sessions for advertising purposes.
4. We do not use third-party advertising cookies or cross-site tracking technologies.

8. Children's Privacy

MACSAP is not intended for users under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has provided personal data, we will delete it promptly. If you believe a minor has registered, contact us at privacy@samadigitalinnovation.com.

9. International Data Transfers

Your data may be processed in jurisdictions outside the UAE by our third-party service providers. Where data is transferred internationally, we ensure adequate protections are in place through contractual safeguards consistent with UAE PDPL requirements.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified via in-app alert or email at least 14 days before taking effect. Continued use of MACSAP constitutes acceptance of the updated Policy.

11. Contact & Complaints

For privacy-related queries or to lodge a complaint:

Data Protection Officer
Sama Digital Innovation LLC
Email: privacy@samadigitalinnovation.com

You also have the right to lodge a complaint with the UAE Data Office at uaedataoffice.ae.