App privacy notice

Last updated 19 October 2026. This notice applies to the MASAAR mobile app for Android (package name com.masaar.app) and the services behind it, and to the iOS app when it is released. The website has a separate privacy policy.

1. Who we are

The app is provided by [Legal entity name], [Registered office address], trading as MASAAR ("MASAAR", "we"). Under India's Digital Personal Data Protection Act 2023 we are the data fiduciary for the personal data described here.

Contact: [Contact email]. Grievance officer: [Grievance officer name], [Grievance officer email].

2. In short

You sign in with your mobile number and a one-time code. There are no passwords and no social logins.
Documents you upload (passport, photos, visa, tickets, certificates, CV) are stored privately in India, opened only through links that expire after five minutes, and every view is logged.
Counsellors and managers at your MASAAR branch see your file so they can arrange your stay. Nobody else does, unless the law requires it.
The app never shows prices, never shows advertising and never sells data.
Support chat starts with an automated assistant. You can ask for a counsellor at any time.
You can download your data and delete your account from inside the app: Me, then Privacy and data.
The app asks for camera, photo and notification permissions only when you use the feature that needs them. It never asks for your location, contacts or SMS.

3. What we collect and why

What: Mobile number and one-time sign-in codes
Why we need it: To create one account per number and sign you in. Codes are generated and checked by our sign-in service and are not kept after use.
Where it comes from: You. Codes are delivered by SMS through Twilio.
What: Preferred name; full name as it appears in your passport; date of birth; home branch; job interests; planned travel date; preferred language; an optional email address and profile photo
Why we need it: To address you, confirm you are 18 or over, match leads to the work you want, show the app in your language and let your branch know who you are.
Where it comes from: You, during onboarding and in your profile.
What: Documents: passport pages, passport photo, visa, flight ticket, educational certificates, experience letters, CV and attestation papers; passport expiry date; passport number
Why we need it: To verify your documents, arrange your stay and any add-ons you chose, and warn you before a document expires. The passport number is encrypted separately and shown to staff only when needed, with every reveal logged.
Where it comes from: You, or your branch on your behalf.
What: Stay details: room and bed, check-in and check-out dates, meal plan and serving times, metro card (last four digits and balance), SIM number and validity, flight and airport pickup details
Why we need it: To show you what is arranged and when.
Where it comes from: Your branch, as it books each service.
What: Job lead activity: leads you view, save, mark as interested or attended; reminders you set
Why we need it: To show relevant leads, remind you about interviews and let your counsellor follow up.
Where it comes from: You, as you use the Jobs section.
What: Support chat: messages, attachments and the rating you give at the end of a conversation
Why we need it: To answer your questions and hand over to a counsellor when needed.
Where it comes from: You.
What: Tool content: CV details, interview practice answers and feedback, budget plan, document checklist
Why we need it: To run the tools and keep your work between sessions.
Where it comes from: You.
What: Notification token, device type, app version, notification preferences and quiet hours
Why we need it: To deliver the notifications you have turned on, at times you accept.
Where it comes from: Your device.
What: Crash and error reports, with names, phone numbers and document names removed
Why we need it: To find and fix faults.
Where it comes from: Your device, through Sentry.
What: Consent records: each purpose you agreed to, your choice, the notice version and the date
Why we need it: To meet our duties under the Digital Personal Data Protection Act 2023.
Where it comes from: You, on the consent screen.

What	Why we need it	Where it comes from
Mobile number and one-time sign-in codes	To create one account per number and sign you in. Codes are generated and checked by our sign-in service and are not kept after use.	You. Codes are delivered by SMS through Twilio.
Preferred name; full name as it appears in your passport; date of birth; home branch; job interests; planned travel date; preferred language; an optional email address and profile photo	To address you, confirm you are 18 or over, match leads to the work you want, show the app in your language and let your branch know who you are.	You, during onboarding and in your profile.
Documents: passport pages, passport photo, visa, flight ticket, educational certificates, experience letters, CV and attestation papers; passport expiry date; passport number	To verify your documents, arrange your stay and any add-ons you chose, and warn you before a document expires. The passport number is encrypted separately and shown to staff only when needed, with every reveal logged.	You, or your branch on your behalf.
Stay details: room and bed, check-in and check-out dates, meal plan and serving times, metro card (last four digits and balance), SIM number and validity, flight and airport pickup details	To show you what is arranged and when.	Your branch, as it books each service.
Job lead activity: leads you view, save, mark as interested or attended; reminders you set	To show relevant leads, remind you about interviews and let your counsellor follow up.	You, as you use the Jobs section.
Support chat: messages, attachments and the rating you give at the end of a conversation	To answer your questions and hand over to a counsellor when needed.	You.
Tool content: CV details, interview practice answers and feedback, budget plan, document checklist	To run the tools and keep your work between sessions.	You.
Notification token, device type, app version, notification preferences and quiet hours	To deliver the notifications you have turned on, at times you accept.	Your device.
Crash and error reports, with names, phone numbers and document names removed	To find and fix faults.	Your device, through Sentry.
Consent records: each purpose you agreed to, your choice, the notice version and the date	To meet our duties under the Digital Personal Data Protection Act 2023.	You, on the consent screen.

Each purpose (verifying documents, arranging the stay, sharing job leads, support chat, notifications) has its own consent, recorded with the version of this notice you saw. You can change any of them later under Privacy and data. Notifications stay off until you turn them on.

4. What we do not collect

Your location. The app never asks for it.
Your contacts, call logs or SMS. The one-time code is filled in by your phone's own autofill, not by reading your messages.
Advertising identifiers, or analytics of any kind without your consent. No analytics tool runs in this version of the app.
Prices or payment details. Payments are made at your branch under your written agreement, never inside the app.

5. The support assistant and AI tools

Support chat begins with an automated assistant. It answers from MASAAR's published guidance and questions and from your own plan, bookings, document status and leads. It hands over to a counsellor when you ask, when it cannot help, or when a question concerns payment, a complaint, a legal matter or your visa. A message from a person is always shown as one.

To generate its replies, the assistant sends the conversation to an AI model provider, currently Groq, under our agreement with them. Your messages are used to produce the reply and are not used to train the provider's models. [Confirm against the AI provider's data-processing terms before publishing]

The CV and interview practice tools send only the text you type, in the language you type it, to the same provider. They never receive your name, phone number, passport details or documents. Interview practice transcripts are shared with your counsellor only if you choose to share them.

Every automated reply is checked before it reaches you, so that it never quotes a price or promises a job or a visa.

7. Where your data is kept and how it is protected

Data is stored in India, in the Mumbai region of our cloud provider, and encrypted in transit.
Every record carries access rules enforced by the database itself, so a branch can only read its own customers and you can only read your own data.
Documents are stored in private storage under random file names, never your original filename, and are opened only through links that expire after five minutes. Every open, download and share is logged.
Your passport number is encrypted separately from everything else and revealed to staff only when needed, with the reveal logged.
Staff sign in with a password and a second factor; managers and administrators must use one.
Verified documents you have opened are saved in the app's private storage on your phone, so you can show them at the airport without a connection. They are removed when you sign out or delete your account. You can add a fingerprint or face lock to the Documents section.

8. How long we keep your data

Your account and profile: while your account is active.
Passport, visa and other identity documents: [Retention period for passport and visa scans] after your stay ends, then deleted.
Chat messages and attachments: [Retention period for chat messages and attachments].
CVs and tool content: until you delete them or your account.
Data export files: 24 hours.
Access and audit logs: 24 months.
After you delete your account, your messages are replaced with a placeholder, your files are removed, and your branch keeps a record of the services it provided for [Retention period for branch records after account deletion], as its agreement with you and the law require.

9. Your rights and how to use them

Download your data: Me, then Privacy and data, then Download my data. A file is prepared and you are notified when it is ready; the link works for 24 hours.
Correct your details: preferred name, language, job interests and notification settings in the app; anything else, including your phone number, through your branch.
Delete your account: Me, then Privacy and data, then Delete my account. The app explains what is deleted and what your branch keeps before you confirm.
Withdraw consent for any purpose: the toggles under Privacy and data. Some features stop working when their purpose is withdrawn, and the app tells you which.
Nominate someone to exercise these rights for you if you are unable to.
Complain: to our grievance officer, [Grievance officer name], at [Grievance officer email]. We acknowledge within 24 hours and respond within the time the law allows. If you are not satisfied, you may approach the Data Protection Board of India.

10. Children

MASAAR services are for adults. The app asks for your date of birth during onboarding and does not let anyone under 18 continue.

11. Changes to this notice

This is version [Privacy notice version]. When we change the notice in a way that matters to you, the app asks you to read and accept the new version before you continue, and your consent records show which version you agreed to.

12. Contact

[Legal entity name], [Registered office address].

Email: [Contact email]. Phone and WhatsApp: +91 85915 30401.

Grievance officer: [Grievance officer name], [Grievance officer email].

Privacy notice for the MASAAR app