What Madar touches, and what it never does.

Last updated 18 October 2026
That day's change is the wording of the AI note at the foot of our first emails to businesses; nothing changed in how a workspace's data is handled.

Who operates this

This policy covers this website, the Madar OS application and the Madar POS application. All three are built and operated by Ahmed Yahya Al Kindi Enterprise, a sole proprietor establishment registered in Muscat, Oman (commercial registration 1399884), whose brands are TSB Labs and Madar OS. We handle personal data under the laws of the Sultanate of Oman, including its Personal Data Protection Law. Questions or requests about your data go to privacy@madar-os.com. Our data protection officer is Ahmed Yahya Al Kindi, at the same address. To report a security problem, write to security@madar-os.com.

This website

The site sets no advertising or tracking cookies. It counts page views with Vercel Web Analytics, which sets no cookies and stores no internet address; it tells one visit from another only by a hash of the request that Vercel discards after 24 hours. The walkthroughs and the demos run a fictional company; every company, person and number in them is invented.

The site is hosted by Vercel, and its fonts come from our own site, not from Google or any other font service. When you send one of the forms below, a small function on Vercel, in the United States, passes what you sent on to our records, and Vercel keeps short technical logs of those requests. If one of the three request forms cannot be filed, that log also keeps your email and company for a short time, so we can still follow up. Your internet address is kept only in the memory of the function that received it, to limit how many requests one connection can send; it is not stored with your answers. The three request forms also send two things you never see: a field left empty, which only automated scripts fill in, and how long the page was open. Both are there to stop spam.

What each form sends

Apart from those two, each form sends what you type or choose in it; the Madar POS enquiry also marks itself as coming from a shop. What it sends is stored in our own records, on Supabase in Frankfurt, Germany. We use it to answer you, to prepare what you asked for, and to keep a record of our conversation in our sales records, and for nothing else.

• Design your Madar, at /start: your name, email, company, industry, team size, where you work and in which languages, your role, what you need help with, the tools you use now, the departments and channels you picked, how you want to approve work, where you want your workspace hosted, and the plan it suggested. Madar, our AI assistant, writes the first reply with Anthropic's Claude, so your answers are sent to Anthropic for that reply. The reply says it was written by AI. It is sent through Resend, your answer to it reaches our mailbox on Zoho, and Ahmed is sent a copy of every one.
• Enterprise. There is no separate Enterprise form. When Design your Madar suggests Enterprise, the same answers are also used to write a proposal with Claude, which is sent to you the same way, and the next step is a call you book on Cal.com's own page. What you enter there goes to Cal.com, Inc., under its privacy policy, and to us.
• Madar POS enquiry, the form at the foot of /pos: your name, the shop name, your email, a phone or WhatsApp number if you give one, the package, branches and billing you chose, your city and country, and your note. No AI reads it. Ahmed is told by email, with those details, and on Telegram, where the message names only the shop. A person from our team replies.
• Hypermarket request, at /pos/hypermarket: your name, company, email, a phone or WhatsApp number if you give one, your city and country, the number of branches, and, if you answer them, the counters at each branch, about how many items you sell, the system you use now, whether your scales print price labels, whether you are registered for VAT, when you want to go live, and your note. We file it with the list price for your branches, and Ahmed is told on Telegram, where the message names only the company. The first reply, which offers times for a call, is prepared from set rules, not by AI. We use your answers to contact you and prepare your quote.
• Support chat, at /support and inside the app: what you write, and your name and email if you give them for a ticket. Madar's support assistant answers with Anthropic's Claude, so the conversation is sent to Anthropic. If it opens a ticket, the ticket and the conversation are kept in our records, and a person is told on Telegram, where the message gives the ticket's number, its kind and the channel it came through, and the company, or else the workspace address, with a link to our record, and nothing you wrote.
• Mail to support@madar-os.com is read by Madar's support assistant on our own server, which writes its answers with Anthropic's Claude. It answers simple questions and passes anything about a refund, a complaint, privacy or security to a person. Its replies say they were written by AI. They are sent through Resend, your answer reaches our mailbox on Zoho, and Ahmed is sent a copy of every one.
• Sign in, at /signin: your email address, and nothing else. If a workspace is registered to it, its address is emailed to you from noreply@madar-os.com. The request is deleted after 30 days.

Calls with us. If you book a call with us, Madar writes us a short brief before it with Anthropic's Claude, from the invitation and what you already told us. We take notes, and we record the call only if everyone agrees at the start. Then either a note taker joins the call (Fireflies, Read.ai or Fathom) and sends us a written summary, or our own recorder on Ahmed's computer records it and turns it into text there. The recording is deleted after 7 days; the text and our notes stay in our own records. Madar reads them with Anthropic's Claude, with what we already know of your business and your company's public website, to list what was agreed and to draft our follow up. A person reads the draft and decides whether to send it.

Madar POS

Madar POS is the cashier and the stock side of Madar. A shop that buys it gets a workspace of its own, exactly as a Madar OS customer does: its own database, on our servers in Frankfurt, Germany, never shared with another customer, and backed up every night as described below.

What it keeps, all in that shop's own database:

• items: names in English and Arabic, barcodes, categories, units, cost and selling prices and every change of price, VAT rates, suppliers, and expiry dates where you track them
• stock at each branch: counts, deliveries, transfers between branches, and the level at which you want to reorder
• sales and receipts: each item sold, its price, discount and VAT, how it was paid, the branch, the cashier counter and the time, and which login made it; for a tax invoice, the buyer's name, VAT number and address, and every earlier buyer if it was changed, with when and by which login; voided sales, and who voided them; and sales made without the internet that Madar refused, with the reason
• returns and refunds to your shoppers, with the reason and who took them
• customers who buy on account: the name and phone number you enter, their credit limit, what they bought on account and what they paid
• suppliers: names, contact names, phone, WhatsApp and email, their terms, their deliveries, and what the shop owes and paid them
• staff logins: each person's name, role and branches, and their password kept only as a one way hash that cannot be turned back into it; the shifts each cashier counter opened and closed, with the cash counted
• your branches, your VAT number and the text on your receipts
• the phones and computers that turned alerts on: which login, what kind of device, when, and the address its browser's push service gave for it

The cashier screen also keeps the price list, any sale made while the internet was down, and the buyer of an invoice printed then, on the cashier device itself, in its browser, until it reaches Madar. A tax invoice's buyer name, VAT number and address are saved with the sale, so the shop keeps its own copy of the invoice, and they are part of Download my data. If the buyer is changed later, every earlier buyer is kept with the sale too.

Who can see it.

• The owner sees all of it.
• A manager sees the cashier screen and the Madar POS portal for the branches the owner gave them, including customer accounts, suppliers, cost prices, margins and profit. The owner can hide cost prices, margins and profit from managers in Settings, and chooses what a manager may change; our server enforces those choices.
• A cashier sees the cashier screen for their own branch, and never the shop's figures.
• No staff login reaches the chat, the books or the rest of Madar OS.
• Our own console shows each workspace's address, the owner's email, the plan, the number of branches, and whether it is running and backed up. It does not show the shop's records. The people who run our servers can reach a workspace. We look inside one only to keep it running, to restore it, when the owner asks us to, or when an authority requires it by a written order, and we tell the owner unless the order forbids it.

Alerts on phones. Alerts are turned on only by a person tapping Turn on, on their own device. A stock or expiry alert names the item and the branch and shows on the lock screen, so anyone holding the phone can read it; an approval alert says only that something is waiting. A manager's device gets stock alerts for the branches that manager works, unless the owner turns that off. Alerts travel through the push service of the device's browser, run by Apple, Google, Mozilla or Microsoft, encrypted so that service cannot read them. The owner sees every device with alerts on, and can remove any of them.

The assistant. When the owner asks Madar about the shop, for example what sold most this week or what to order, Madar works the figures out inside the workspace and sends Anthropic the question and the short lines it needs to answer, which can include item, customer and supplier names, their phone numbers, and what customers owe and when they last paid. Selling, the cashier screen and the product list import do not use AI: an imported file is read by fixed rules and is never sent to an AI model.

Messages. Madar POS never messages a supplier or a shopper by itself. An order to a supplier opens WhatsApp or your phone with the text already written, and a person sends it.

Your shop's own customers. For the people in a shop's records, such as its customers on account, its suppliers and its staff, the shop decides what to keep and why, and we keep it for the shop, on its instructions, as our terms of service set out. If you shop at a store that uses Madar POS and want to know what it holds about you, ask the store; we help it answer.

Your workspace address

Each workspace gets its own web address on madar-os.com. It is made from your company name when you give us one, and otherwise from random letters and numbers, such as shop-7kq2m9.madar-os.com, never from your name or your email address. Like every address with a security certificate, it is listed in public certificate logs by Let's Encrypt, which issues the certificate, so the address itself is public, even though nothing inside the workspace is.

Sign ins

Every workspace, for Madar OS and Madar POS alike, records each sign in and each failed attempt, with the login name typed and the internet address it came from, and for a sign in, the kind of device and browser. The workspace also keeps, for each login, the devices it signed in on and when. These records are there to slow down anyone guessing a password, and to trace a sign in that should not have happened. They are part of the workspace's own log. Our server keeps a copy of that log from before each update for eight weeks, and deleting a workspace deletes its log and those copies.

Your own mailbox and tools

An owner can connect the business's own mailbox, such as Gmail, Google Workspace, Zoho, Yahoo or iCloud, with an app password, on the Tools page. Madar then searches and reads that mail to answer the owner, and saves draft replies in the mailbox's own Drafts folder; it sends only after the owner says yes. Mail it reads is sent to Anthropic when Madar needs it for an answer. The app password is kept in the workspace, is never shown to the AI, and is included in the encrypted nightly backup. The owner can disconnect the mailbox on the Tools page at any time, and should also delete the app password at the mail provider. Tools the owner connects to Madar receive what the owner asks Madar to send them, under their own terms.

Payments

Plans and Madar POS packages bought on this website are sold through our online reseller Paddle.com, the Merchant of Record for those orders. Paddle takes your card or payment details directly, and your full card number never reaches us. Paddle tells us your name, email, country, the plan or package you chose, the number of branches, and the status of your subscription and payments. Its notices about a card payment also mention the card type, its last four digits, its expiry and the name on the card; we drop those before anything is saved. We keep the rest in our own records, on our own server and on Supabase, both in Frankfurt, Germany, to set up and run your workspace, invoice correctly and answer you. Questions about a payment or a refund go to billing@madar-os.com. Paddle's own handling is described in its privacy notice. An order agreed with us directly, such as Madar POS Hypermarket, Madar OS Enterprise or a package we invoice to you ourselves, follows its written quote or invoice: it is invoiced either through Paddle or by us, for payment by bank transfer.

Emails from us

If you have an account, we email you about it, your trial and your payments; those are part of the service. Product news, offers, or a reminder when you started a checkout and did not finish are sent to customers and site visitors only if you agreed to receive them, for example by ticking the box in the checkout, and each has a one click unsubscribe. We keep a record of what was sent and whether it was opened or clicked, so you are never contacted twice by mistake.

Updates you sign up for

The box at the foot of each page on this website, and on the home page, signs you up for updates by email. You choose which: Madar OS updates, TSB Labs updates, or The System Builder, Ahmed Yahya Al Kindi's letters. The box sends straight to our own server, not through Vercel.

What it collects. Your email address, your first name if you give it, the lists you ticked, the sentence you agreed to and the time you sent it, which of our websites you signed up on, a one way hash of your internet address, never the address itself, and a short string saying which browser you used. Like our other forms, it also sends a field left empty, which only automated scripts fill in, and how long the page was open, to stop spam.

Why. To send you what you asked for, and only that. Nothing is sent until you confirm: we first email you a link from updates@news.madar-os.com, and you are added only when you open it. The record is kept in our own records, on Supabase in Frankfurt, Germany, and the updates are sent by Brevo.

How long. Until you unsubscribe. After that we keep the record, marked unsubscribed, as proof of what you agreed to and when you left, and we send you nothing more.

How to stop. Every email has a link to unsubscribe. You can also write to privacy@madar-os.com and we take you off.

If we wrote to you first

We sometimes write to a business we think Madar or TSB Labs could help. Ahmed Yahya Al Kindi writes from his own address, ahmed@ahmedyahyak.com, through our mailbox at Zoho, to a business email address that was published on the company's own website or in a business directory. We record where and when we found each address. We write this way to businesses in the United Arab Emirates, Bahrain, Kuwait, the United States and Oman. In Oman that can be a named person's address on the company's own domain; everywhere else it is a company address only, such as info@ or sales@. We never write this way to personal free mail addresses, and we do not write this way to anyone in Saudi Arabia or Qatar unless they agreed first.

We write at most three times: a first email and up to two short follow ups in the same thread, and we stop as soon as you answer or book a call. Each email says at its foot that it was written with AI help and that Ahmed replies personally, and carries no tracking image and no tracked links. Every address is checked against our do not contact list before the first email. Every email has a one click unsubscribe link that stops all further emails at once; if you reply "stop" instead, we stop within 24 hours. Either way we keep your address only on that list, so it is never used again. When you answer, Madar reads your reply with Anthropic's Claude to sort it and, where you asked something, to draft an answer that Ahmed reads and sends himself.

You can ask where we found your address, or have it deleted, at privacy@madar-os.com; we answer within 30 days. Our data protection officer is Ahmed Yahya Al Kindi, at the same address.

The application, and Google account data

Separately from this website, Madar OS is an application the operator runs to manage their own business. It connects to a Google account only when the account holder explicitly authorises it through Google's own consent screen. Customer workspaces do not use Google sign in or Google's APIs; an owner can connect a Gmail mailbox with an app password, as described above. The operator's own install requests these permissions:

• gmail.modify so it can read messages, apply labels, and prepare draft replies
• gmail.settings.basic so it can read basic mailbox settings
• calendar.readonly and calendar.events so it can see free time, and book or cancel a meeting once a person approves it
• spreadsheets so it can read and update Google Sheets in that account, and drive.file so it can open files it created or was given

Where the data goes

Each customer's workspace, for Madar OS and for Madar POS alike, runs in its own isolated space, with its own database, on servers we operate, not on a shared platform. Today every workspace is in Frankfurt, Germany. A choice of a Gulf region is coming; until it opens, nothing is hosted in the Gulf. Using Madar therefore means your data is handled outside Oman: it is stored in Germany, and some of the companies below process it in the United States and in Japan. These are the companies that handle data for us, and what each one does:

• Oracle Cloud, in Frankfurt, Germany: the servers your workspace runs on, our own server, and the storage that keeps the backups.
• Anthropic, in the United States: writes Madar's answers in your workspace and in the support chat on this website. What you ask, and the parts of your business Madar needs in order to answer, are sent to Anthropic's Claude models for each reply. Anthropic's Claude also writes for our own team: the first reply to Design your Madar, the Enterprise proposal, the answers to mail sent to support@madar-os.com, the drafts of our answers when you reply to an email from us, our brief before a call you booked with us, our follow ups after a call, and the list of what was agreed on a call we recorded.
• Paddle, our Merchant of Record for plans and Madar POS packages bought on this website: takes your payment and handles tax, receipts and refunds.
• Resend, a company in the United States, which sends through Amazon Web Services in Tokyo, Japan: delivers the product's own mail from noreply@madar-os.com, such as your welcome link, the link to your workspace, password resets, reminders, the warnings before an ended workspace is deleted, and, unless the owner turns it off, the morning report, which names clients and what they owe. A reply to a warning reaches support@ or hello@madar-os.com on Zoho. Resend also sends our automatic replies, from hello@ and support@madar-os.com. If Resend cannot send one, it is not sent another way: it waits for a person.
• Zoho, in the United States: our company mailboxes, such as hello@ and support@madar-os.com, so a message you send to one of our addresses, or your answer to one of our replies, is kept there, and the replies a person on our team writes to you are sent from there.
• Supabase, in Frankfurt, Germany: our own records, including what you send through the forms on this website, support tickets, and the account details Paddle sends us.
• Brevo (Sendinblue SAS), in France: sends the updates by email that you sign up for on this website, and the email that asks you to confirm.
• Vercel, in the United States: hosts this website, runs the small functions its forms and its support chat send through, and counts its page views without cookies.
• Google: our own Gmail and Google Calendar, where bookings and the written summaries of calls with us arrive, and where Madar leaves its drafts of our answers and follow ups. Google also serves the fonts of some pages inside a workspace, such as its first set up page, so it sees the internet address of the computer that opens them.
• Telegram: tells our team at once that a request, a ticket, a reply to our mail, a purchase, a payment, a trial reminder, a plan change or a new workspace came in. Each of these alerts names the kind and the company, or the domain of a company email address, with a link to our own record where there is one. It never names the person, and never carries their email address, phone number or what they wrote, with one exception: when someone answers one of our first emails to a business, the alert to Ahmed's phone, or on Telegram when the phone cannot be reached, gives their address, a one line summary of their answer and our draft reply. Our daily follow up list and morning summary there name companies and counts only. Telegram is also where our team works with Madar: our brief before a call you booked with us, which names the people invited and repeats what they told us, our summary of a call we recorded with everyone's agreement, our weekly digest of those calls, and our own chat with Madar, with its approval requests and the results of its scheduled jobs, which can name a person and repeat what they told us when we ask about them.
• Cal.com, Inc., in the United States: takes the booking when you book a call with us, on its own page.
• Fireflies, Read.ai and Fathom, in the United States: note takers that record a call with us and summarise it, only when you agree at the start of the call.
• Let's Encrypt: issues the security certificate for each workspace address, and sees only the address.
• Apple, Google, Mozilla and Microsoft: their push services carry alerts to the phones and computers that turned them on, encrypted so they cannot read them.

For the operator's own Gmail connection, Madar reads the messages it needs on the operator's own server and computer, and sends them to Anthropic's Claude to write a draft reply or a follow up. That runs on our own Claude subscription, whose model training setting is turned off, so Anthropic does not use this data to train its models. Access tokens are stored in restricted files on those machines. We run no service that receives mail for anyone else; a workspace reads only the mailbox its owner connects. We keep no shared database of message content, and we do not sell, rent or trade any data to anyone, for any purpose, ever.

Language models are used to write answers and drafts. Only the material needed for an answer is sent to the model provider. What customer workspaces and the support chat on this website send goes through Anthropic's commercial service, under whose terms it is not used to train their models. Our own replies, drafts, briefs and notes, listed above, are written with Anthropic's Claude through our own Claude subscription. Its setting that lets Anthropic train on our conversations is turned off, so Anthropic does not use them to train its models either. Anthropic keeps them for up to 30 days. It may keep one longer, and use it to improve its models, only if its safety systems flag it for review, or if we report it to Anthropic as feedback, which we do not do. Answers are written by AI and can be wrong, so check anything that matters before you rely on it; nothing is sent on your behalf without your approval.

Backups

Every night, each workspace (its database, including its Madar POS records, its files and its memory) is packed into one archive and encrypted with a key that is held on no server, so neither server can read a backup. The archive is kept for seven days on our servers, and a copy is stored in Oracle Cloud Object Storage in Frankfurt, apart from the server that runs your workspace. Our own records on Supabase are copied to the same storage every night, and that copy is checked by reading it back. Our own server's files, such as the payment notices Paddle sends us, are copied there every night too, encrypted in the same way. Each night the backup succeeds, it deletes the backup copies in that storage that are more than 30 days old. The one exception is the newest copy of a workspace that is still running, which stays until a newer copy replaces it, so a run of failed nights never leaves a customer with no backup.

Limited use

Retention, and how to end it

We do not keep message content after a draft is prepared. What we keep is an operational record: which addresses were written to and when, so the same person is never contacted twice by mistake.

You can revoke access at any moment at myaccount.google.com/permissions. Revoking takes effect immediately and the application loses all access. To have the operational record deleted as well, email privacy@madar-os.com and it will be removed within 30 days.

Your workspace is kept while your subscription runs. A package ends when a subscription paid through Paddle ends, or, for a package paid by invoice, at the end of the last day it was paid for. When both are known, the timeline below counts from the later end, so a period paid for is never cut short. When a subscription paid through Paddle ends, nothing more is charged and Madar's assistant stops answering. From the end, every workspace, Madar OS and Madar POS alike, follows one timeline:

• 30 days of grace. Madar POS keeps selling.
• Then 30 days read only for Madar POS: no new sales, returns, payments on an account, stock changes, transfers, shifts, settings or staff logins. A tax invoice can still be given for a past sale, and a sale Madar refused can still be settled. A sale made without the internet before that day is still recorded when the connection comes back, within the three days Madar takes any offline sale for.
• Then the workspace is deleted, with everything in it, at least 60 days after the end. It never happens by itself: we email the owner 14 days and 3 days before, in the language chosen at setup, and a person at Madar confirms the deletion. If an email cannot go, nothing is deleted until it has gone, and the deletion is never sooner than 14 days after the first email and 3 days after the second. Its backup copies expire 30 days after the deletion.

Until the deletion, the owner can see, download and, with Madar POS, print everything in the workspace. From the day the package ends, Plans and usage names the day the workspace is deleted, and the cashier screen and the Madar POS portal also name the day it goes read only. If the owner renews before the deletion, or asks us to restart the workspace, everything in it is kept. Separately, we delete a workspace within 30 days of its owner's request, and its backup copies expire 30 days after that.

Requests you send through the forms on this website are deleted from our database 12 months after our last exchange with you, unless you became a customer. Support tickets, with their conversations, are deleted from our database 24 months after they are answered or closed, and sign in requests after 30 days. These are deleted automatically, and leave our backup copies within a further 30 days. Copies in our mailboxes, our server's logs and our Telegram chat have no set end date yet, and neither do our sales records of the businesses we talk to, which keep your name, company, contact details and notes of our exchanges; you can ask us to delete yours at any time. Purchase and invoice records are kept for as long as tax law requires.

Your rights

You can ask for a copy of the personal data we hold about you, have it corrected, have your workspace exported, have it deleted, or object to marketing, including our first emails to businesses, and withdraw consent to it at any time. These are your rights under Oman's Personal Data Protection Law. The owner of a workspace downloads its data in Settings, with Download my data, at any time; for a shop on Madar POS that includes every sale, with the buyer's details on its tax invoice and any earlier buyer, the sales Madar refused, with their reason, and every return, refund, shift count, item, stock level, customer account and supplier, one file for each table. Delete my workspace, also in Settings, sends us the owner's request, confirmed with the password. We delete the workspace within 30 days of your request, and its backup copies expire 30 days after that; we email the owner when the workspace is deleted. For anything else, or if you would rather write, email privacy@madar-os.com and it is done within 30 days.

If Madar decided something about you by itself, such as the reply or the next step it offered you, you can object at privacy@madar-os.com, and a person will look at it again.

If something ever goes wrong with personal data we hold, we tell the people affected, and Oman's Ministry of Transport, Communications and Information Technology where the law requires it, within 72 hours of learning of it. Where we hold the data for a business, such as a shop's customer accounts, we tell that business first, within 24 hours, so it can meet its own duties.

Children

This is a business tool. It is not directed at, or intended for, anyone under 18.

Changes

If this policy changes materially, the date at the top changes with it, and every workspace owner, and anyone who has authorised the application, is told by email before the change takes effect.