Privacy Policy

Last updated: 2026-08-14

1. Data Controller

The platform is operated in the Saudi market by the following entity, which issues its clients' invoices:

2. Data We Collect

Account data

• Name, email address, and password (stored as a cryptographic hash, never as plain text).
• Business name, industry, and target market.

Advertising platform data

• Meta User ID and Business ID.
• Ad account IDs، only those you explicitly choose to share.
• Campaign, ad set, ad, and associated creative data.
• Performance results: spend, reach, impressions, clicks, and conversions.
• Access tokens and the permissions you granted.

Technical data

• IP address, browser and device type, sign-in timestamps, and error logs.
• Content and requests you enter into the platform.

3. How We Obtain Meta Data

We access no Meta data without your explicit consent. Authorization happens through the official Facebook Login for Business flow, where you select which ad accounts to share. Access tokens are exchanged directly between the Munjiz server and Meta, never through your browser.

3.5 How We Obtain and Use Google User Data

Munjiz accesses no data in your Google account without your explicit consent through the official Google OAuth consent screen. Access tokens are exchanged directly between the Munjiz server and Google, never through your browser, and are stored encrypted with a key held outside the database.

Scopes we request, and why

• webmasters: Read access to your site’s Google Search performance (impressions, clicks, search queries, average position) from Search Console, to display it in your dashboard and to propose content topics grounded in real ranking gaps. The same scope is used for exactly one write operation: submitting the sitemap that Munjiz generates for your site to your own Search Console property after each publish, so new content reaches indexing sooner. We do not request manual indexing, do not change your account settings, and never delete or modify any property or sitemap that Munjiz did not create.
• analytics.readonly: Read-only access to your Google Analytics statistics (sessions, users, traffic channels, conversions) to measure what happens after the click and to attribute the real outcome of each article we publish. This scope is read-only.
• adwords: Read access to your Google Ads accounts and their campaign performance (spend, clicks, impressions, conversions) to display it in your dashboard and reports alongside your SEO results. Google offers no read-only variant of this scope, so it technically permits changes; Munjiz never creates, edits, pauses, or re-budgets a campaign except on your explicit instruction from your dashboard, and every such change is recorded in your account log.
• openid · userinfo.email · userinfo.profile: To identify the account that granted access (identifier, email address, display name) so the connection can be tied to your Munjiz account and shown to you. We use these for nothing else and build no advertising profile from them.

What we never do with Google user data

• We never sell, rent, or trade it.
• We never use it for advertising, and never share it with ad networks or data brokers.
• We never use it to train artificial-intelligence models, and no model is permitted to retain it.
• No human reads it except at your request for support, or where legally required.

AI processing of your content

To propose and draft content, summaries of your performance data (search queries and their metrics) are sent to our language-model provider, Anthropic, acting as a processor on our behalf under a data-processing agreement. This data is not used to train models and is not retained after the request completes.

Retention and deletion

• Performance data is retained while your account is active and deleted within thirty days of its closure.
• You can disconnect your Google account at any time from your dashboard; access tokens are deleted immediately and all data collection stops.
• You may also revoke access directly from your Google Account permissions page.

4. Why We Use Your Data

• Displaying your campaigns and results inside the Munjiz dashboard.
• Creating or modifying campaigns at your request and after your confirmation.
• Analyzing performance and suggesting improvements.
• Executing actions you have explicitly approved.
• Protecting the platform and preventing abuse or fraud.

5. Access Token Protection

• Access tokens are stored encrypted on our server and never appear in the interface or in logs.
• Access tokens and app secrets are never sent to any AI provider.
• The Meta app secret is stored only in a server environment variable، never in code or in the repository.

6. We Do Not Sell Your Data

Munjiz does not sell Meta user data or any customer data to third parties, and does not use it for our own advertising purposes.

7. Service Providers

We rely on providers necessary to operate the platform:

• Hostinger: Server and database hosting.
• Anthropic: Natural-language processing for analysis and responses.

What reaches the AI provider

When you use the AI assistant, your message together with the performance data needed to answer it (such as campaign names, spend figures, and results) is sent to Anthropic for processing. Access tokens, app secrets, and passwords are never sent. This data is not used to train models.

8. Data Retention

• Account data: for the duration of your subscription, then 90 days after closure.
• Access tokens: deleted immediately upon disconnection or permission revocation.
• Cached campaign data: 12 months maximum.
• Audit logs and invoices: 5 years, for accounting and legal obligations.

9. What Happens When You Disconnect Meta

• Access tokens are deleted immediately and all future access stops.
• Meta identifiers, ad account IDs, and cached campaign data are deleted within 30 days.
• The audit log (who did what and when) is retained without Meta data, for legal compliance.

10. Your Rights

• Access a copy of your data.
• Correct any inaccurate data.
• Delete your data.
• Withdraw your consent at any time.
• Object to specific processing.

To exercise any right, contact us at privacy@munjiz.ai from the email associated with your account. We respond within 30 days.

11. Data Deletion

To request deletion of your data, follow the steps on the Data Deletion page.

12. Security Measures

• HTTPS/TLS encryption for all pages and APIs.
• Access tokens encrypted before database storage.
• Passwords stored as irreversible cryptographic hashes.
• Per-customer data isolation، no customer can access another customer's data.
• Session cookies set with Secure, HttpOnly, and SameSite attributes.
• An audit log for every action affecting a customer account.

13. International Data Transfers

Our servers are hosted with Hostinger in Europe. When you use the AI assistant, data is processed by Anthropic in the United States. By using the platform you consent to this transfer.

14. Minors

Munjiz is a business platform and is not intended for use by anyone under 18.

15. Compliance with Meta Platform Terms

We comply with the Meta Platform Terms and Meta's Developer Policies. We use Meta data solely to deliver the services described above, do not share it with third parties beyond the service providers listed, and delete it upon permission revocation or your request.

16. Changes to This Policy

For any material change we will update the "last updated" date above and notify you at your registered email.

17. Contact