Privacy notice
Who is responsible
Your data is kept by ZalTech [its trade licence number and registered address: to be added before Mutabaqa is sold], who operates Mutabaqa. The other people of your company see its submittals, their reports, your email address and the submittals you uploaded. The operator's administrator can open your company's submittals and their reports, to support you and to run checks you ask for; no other company can.
What we keep
Your email address, your company and your role in it, who invited you, and your password as a one-way hash (never the password itself). The documents you upload and the reports of your checks, and who uploaded each; your company's projects, with their specification files and drawings, who added each, and the list of required submittals read from them; a resubmission's comment sheets, which hold the consultant's comments and may name the consultant's people, and the names you list to be hidden; pictures of your documents' pages, made to show where a finding's quote is, kept with the submittal. Your company's answers on findings and checklist points, with their notes, who gave each and when; and counts of answers by kind of check and outcome, across all companies, with no company, submittal or person in them. How many pages your company has used each month, and the pages of each document uploaded. The address of a person invited to join, until they join or the invitation is cancelled or expires. A log of account and case events, holding ids, times and counts only: no email address, name, file name or document text.
Why
To run the checks you ask for, to keep your account safe, and to apply the monthly page limit; and, from the counts of answers only, to measure and improve how often Mutabaqa's findings are agreed with. We do not sell your data or use it for advertising.
Where it is stored
On Render's servers in Frankfurt, Germany (European Union), on a disk that is encrypted at rest. Render copies the disk once a day and keeps each copy for at least seven days, also encrypted, so something you delete can remain in those copies until they expire (Render, Persistent Disks).
In a pilot run on the operator's own computer, before Mutabaqa is hosted, your documents are stored on that computer, in a folder synchronised with Microsoft OneDrive, whose files are stored in your region or in the United States, often with a backup in another region (Microsoft Privacy Statement).
AI processing
Text from your documents is sent to Anthropic (Claude), with the email addresses, phone numbers, signature blocks and names after labels such as “Inspected by” that Mutabaqa recognises removed first, and, for a resubmission, the names you listed for its comment sheet. Names written elsewhere in the text, where no label introduces them, may be sent. Under Anthropic's default setting the processing may run in any geography Anthropic operates, and what Anthropic keeps at rest is stored in the United States (Anthropic, Data residency). The documents themselves are never sent.
Neither we nor Anthropic use your documents to train AI models.
We send you emails to confirm your address, to reset your password, and, when someone invites you to their company, to invite you. They are sent through Resend, an email service in the United States, which receives your email address and the email.
Transfers outside the UAE
Your data is stored and processed outside the United Arab Emirates, in the places named above: the European Union and the United States. We use providers who protect it under their own security and privacy commitments, and send them only what the service needs.
Security
Everything between your browser and Mutabaqa travels encrypted (HTTPS). Passwords are kept only as a one-way hash, accounts are locked after repeated failed log-ins, each company's documents are kept apart, and account and submittal events (sign-ups, log-ins, checks, deletions, views of cited pages) are recorded in an event log that holds no document text. No system is perfectly secure; if a breach affects your data, we will tell you without undue delay.
Cookies
Mutabaqa uses one cookie, to keep you logged in, deleted when you log out or your session ends. It uses no advertising or tracking cookies and no analytics that follow you to other sites.
How long we keep it, and your choices
We keep your data until you delete it. Deleting a submittal removes its documents, comment sheets, names listed to hide, reports, page pictures and answers; deleting a project removes its files and its list of required submittals, and its submittals keep their own copies; the counts of answers, which hold nothing of it, stay. Deleting your account removes the account, and the answers you gave stay with your company's submittals; your company's submittals stay with its other people, and go when its last person leaves or the operator deletes the company. When this record of accounts changes form, a copy of it as it was is kept for a week, then deleted. The event log keeps its record of the account's events, with ids, times and counts only: no email address, name, file name or document text.
You can ask for a copy of your data, for its correction, or for its deletion, object to how it is used, and ask any question about this notice, at [a contact email address: to be added with Mutabaqa's domain]. We answer within 30 days. Where the UAE's personal data protection law (Federal Decree-Law No. 45 of 2021) applies, you have the rights it gives you, and you may also complain to the UAE Data Office.
Children, and changes
Mutabaqa is not meant for anyone under 18, and we do not knowingly keep their data.
When this notice changes in a way that matters to you, we tell you in Mutabaqa before it applies, and you are asked to accept the new version before your next check.
Version draft-2026-10-19.1