Privacy policy

1. Who we are

Muntajat is operated by Team Dubai LLC, a limited liability company registered in Wyoming, United States (registered office: 30 N Gould St Ste R, Sheridan, WY 82801). Team Dubai LLC is responsible for the personal data described in this notice. Contact: hello@muntajat.app.

2. Account and content

Muntajat uses your email, verified sign-ins, language, market and onboarding preferences to operate your account. Your saved projects, product links, prompts and uploaded media are processed separately to provide the tools you request.

3. Owner analytics and live view

Our owner-only dashboard records pages and apps used, approximate visit times, and server-confirmed actions such as usage reservations, refunds, saves and prepared exports. Signed-in activity can be linked to your account. Reservations are distinguished from completed work; a prepared export does not prove a download finished.

Optional browser analytics uses a random session identifier and visible-tab heartbeats. The live view shows approximate country, city and rounded coordinates derived from hosting-provider network metadata. It does not collect GPS or your exact address. Counts can be affected by privacy preferences, bots and connection failures.

Analytics excludes raw prompts, chat messages, form values, uploaded content and page recordings. Stored paths omit query strings and replace project identifiers. Your app content can still be stored for its requested product function; it is not copied into analytics.

4. Account security and free trials

One active login per account helps prevent account sharing; tabs in the same browser can remain open. A signed first-party browser cookie binds the login. We store keyed hashes of that browser identifier and trusted network addresses. A separate coarse browser-family, operating-system and language hash helps detect signup bursts; raw user-agent strings and raw IP addresses are not stored in these security records.

Trial eligibility combines prior trial use, browser links, signup velocity, network evidence and, when available, a verified payment-method hash. Shared IP alone does not block a trial. Signals are uncertain and may be spoofed or shared legitimately. Suspicious trials may require review or be declined; you can contact support for a human review. Risk does not automatically prove fraud or cancel paid access.

5. Payments

When a payment provider is connected, verified server events may record transaction and customer identifiers, amounts, currencies, payment status and refunds. A provider-supplied card fingerprint may be stored only as a keyed hash linked through a trusted customer mapping. We do not store full card numbers, card security codes or raw card fingerprints. Analytics does not itself charge you or create a subscription.

6. Cookies and your choice

Essential first-party cookies support login, the browser security binding and your preferences. The security browser cookie lasts up to one year. Optional analytics uses a signed session cookie lasting 30 minutes. Affiliate referrals may use a separate referral cookie for up to 60 days.

Use the control above to disable future optional browser analytics here. We also honor Do Not Track and Global Privacy Control signals for this analytics flow. These choices do not disable necessary authentication, security, verified billing or server-side service-usage records.

7. Retention

Scheduled daily maintenance removes detailed analytics events after 90 days, live-presence records after one day, short-term anti-spam counters after two hours, and owner administrative audit records after 365 days. Deletion takes place on the next maintenance run.

Security network and coarse-browser associations are cleared after 30 days. Inactive browser trial links and verified payment trial associations expire after 365 days; security events expire after 90 days. Sessions inactive for 30 days are revoked and removed. Trial-use and review decisions remain with their account until account deletion.

Account profiles and saved content remain while needed to provide your account. Financial transaction and payment-event deduplication records are managed separately for billing, refunds and recordkeeping; the short-term analytics cleanup does not erase them. Contact support to request access, correction or deletion and to discuss any records that must be retained.

8. Providers, access and contact

We use Supabase for authentication and data, Vercel for hosting, and configured payment, email and AI providers for the functions you request. Relevant inputs can be sent to the provider performing that function. Owner analytics and account controls are restricted on the server; they are not public dashboards.

We do not sell your personal data or expose your private research or generated content to other users through this dashboard. To ask about these records, challenge a trial decision or exercise available privacy rights, email hello@muntajat.app. This notice may change when our data practices change.

9. Bot protection

We use Cloudflare Turnstile on login and contact forms to distinguish legitimate requests from automated abuse. Cloudflare processes technical browser and network signals for this security check. Verification tokens are sent to Supabase for authentication or to our server for contact validation. We do not include your contact message in the Turnstile verification request.