What Madar OS touches, and what it never does.
Last updated 26 September 2026
Who operates this
Madar OS is built and operated by Ahmed Yahya Al Kindi Enterprise, a sole proprietor establishment registered in Muscat, Oman, trading as TSB Labs. Questions or requests about data go to akenterprise.om@gmail.com.
This website
The site sets no advertising or tracking cookies and runs no third party analytics. The walkthrough and the demo workspace run a fictional company; every company, person and number in them is invented. If you use Design your Madar, the answers you give (your name, email, company and what you need) are stored so we can reply and reserve your early access, and for nothing else.
Payments
Our order process is conducted by our online reseller Paddle.com, the Merchant of Record for all our orders. Paddle collects your card or payment details directly; we never see or store them. Paddle tells us your name, email, country, the plan you chose and the status of your subscription and payments, which we keep to run your account, invoice correctly and answer you. Paddle's own handling is described in its privacy notice.
Emails from us
We email you about your account, your trial and your payments; those are part of the service. Anything else, product news, offers, or a reminder when you started a checkout and did not finish, is sent only if you agreed to receive it, for example by ticking the box in the checkout. Every such email has a one click unsubscribe, which stops them at once. We keep a record of what was sent and whether it was opened or clicked, so you are never contacted twice by mistake.
The application, and Google account data
Separately from this website, Madar OS is an application the operator runs to manage their own business. It connects to a Google account only when the account holder explicitly authorises it through Google's own consent screen. It requests two permissions:
gmail.modifyso it can read messages, apply labels, and prepare draft repliesgmail.settings.basicso it can read basic mailbox settings
It never sends email on your behalf without you. Replies are written as Gmail drafts and left for a human to read, edit and send. Drafting is reversible. Sending is not.
Where the data goes
Each customer's workspace runs in its own isolated space on servers we operate, not on a shared platform, in the region chosen at signup: the Gulf, or our global region (today Germany). The subprocessors that can touch data are Paddle for payments, Anthropic for the AI model (and, only when Claude is at a usage limit and the stand in is switched on, Google for its Gemini model), our hosting provider, and the email provider that delivers our mail. For the Gmail integration: Message content is read and processed there to prepare a draft, and access tokens are stored in a restricted file on that server. The database is copied to object storage every night and the copy is checked by restoring it. We run no service that receives mail on anyone else's behalf, we keep no shared database of message content, and we do not sell, rent or trade any data to anyone, for any purpose, ever.
Language models are used to draft text. Only the material needed to write a reply is sent to the model provider, it is not used to train their models, and no separate copy is retained by us.
Limited use
Madar OS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Retention, and how to end it
Message content is not retained after a draft is prepared. What is kept is an operational record: which addresses were written to and when, so the same person is never contacted twice by mistake.
You can revoke access at any moment at myaccount.google.com/permissions. Revoking takes effect immediately and the application loses all access. To have the operational record deleted as well, email the address above and it will be removed within 30 days.
Your rights
You can ask for a copy of the personal data we hold about you, have it corrected, export your workspace, have it deleted, or withdraw consent to marketing at any time. Email the address above; we answer within 30 days. If something ever goes wrong with your data, we will tell you, and the authority where the law requires it, within 72 hours of learning of it.
Children
This is a business tool. It is not directed at, or intended for, anyone under 18.
Changes
If this policy changes materially, the date at the top changes with it, and anyone who has authorised the application is told by email before the change takes effect.