Privacy policy
Who we are
[LEGAL TEXT PENDING DPIA]
[The controller is Shard Soft EOOD, a company in the European Union (Bulgaria). The registered address and how to reach the data protection contact go here.]
What data we collect
[LEGAL TEXT PENDING DPIA]
[In the app: phone number, profile, photos, messages, location to city level, usage data. On this website: your city, WhatsApp number or email, interface language and the time you consented, for the waitlist only. If you link Telegram: your Telegram user id and username, to send you notifications there; you can unlink in Settings.]
Sensitive data
[LEGAL TEXT PENDING DPIA]
[Religion and denomination are optional, with separate explicit consent, and can be deleted at any time.]
Why we collect it
[LEGAL TEXT PENDING DPIA]
[The legal basis for each use: providing the service, your consent (the waitlist and sensitive data), or a legitimate interest (safety and fraud prevention).]
Cookies and analytics
[LEGAL TEXT PENDING DPIA]
[This website uses Google Analytics 4 (Google Ireland Limited, with Google LLC in the United States as its sub-processor) to count visits. It sets the cookies _ga and _ga_<id>, which last up to two years and hold a random visitor identifier, and it receives the page address (without query strings, except campaign parameters such as utm_*), the referring site, device and browser data, an approximate location and a shortened IP address. It does not receive your name, WhatsApp number, email or anything you type into a form, and it is switched off on confirmation, account and link pages. Measuring starts on your first visit, without a banner; you can stop it by blocking the cookies or with Google’s opt-out browser add-on. Our forms use Google reCAPTCHA to stop spam: it runs only when you touch a form. Besides these, the website sets one technical cookie once you send a form. [The legal basis, the retention setting and the consent wording are for the business to confirm.]]
How long we keep it
[LEGAL TEXT PENDING DPIA]
[Account data until you delete the account. The waitlist until launch in your city or until you withdraw consent. Records of reports for as long as the law requires. When you edit a message or delete it for everyone, its earlier text or voice recording is kept, out of both members’ sight, for 30 days so a report about it can still be reviewed, then removed.]
Invitations
[LEGAL TEXT PENDING DPIA]
[Everyone has a private invite code. If someone you invite signs up with it and becomes a member, you get 7 days of Mahbas Plus (up to 10 invitees); we take it back if that member is banned within 30 days. We store the code and who claimed it, only for this and to stop abuse. Nobody sees who invited whom, not even you. To stop people inviting themselves, we keep a random install id of the app as a scrambled copy for 90 days; it is deleted with your account.]
Your rights
[LEGAL TEXT PENDING DPIA]
[Access, rectification, erasure, restriction, portability, objection, withdrawing consent, and a complaint to a data protection authority.]
Contact us
[LEGAL TEXT PENDING DPIA]
[For any question about your data, or to withdraw your waitlist consent, write to us.]
Privacy and deletion: Contact us