Privacy Policy

Last updated: October 2026

This Privacy Policy explains what personal data Mouktar ("we", "our", "us") collects when you use mouktar.com and the client portal, marketplace and invoicing tools available through it (the "Service"), why we collect it, who we share it with, and the choices you have.

Who we are

We are an independent software development studio based in Doha, Qatar, and we operate the Service at mouktar.com. For any question about this policy or your data, contact us at mouktar@mouktar.com.

1. Information We Collect

Account information you give us when you register or sign in:

  • Name, email address, company name and phone number.
  • Your password, stored only as a one-way hash. We never store it in readable form and we never ask you for it by email.
  • If you sign in with Google, the Google account identifier, email address, name and profile picture returned by Google. We never receive your Google password.

Information you provide while using the Service:

  • Project proposals, briefs and messages you send through the portal.
  • Project, invoice and payment records linked to your account.
  • Requests for downloadable deliverable files attached to your projects.

Information collected automatically:

  • Cloudflare Turnstile is used to verify that you are a real person when you register, log in or reset your password.
  • A small number of essential cookies needed to keep the Service working (listed in section 4).

We do not run advertising or third-party analytics trackers on the Service.

2. How We Use Your Information

  • To create and maintain your account and dashboard.
  • To review, answer and manage your proposals and projects.
  • To process asset purchases, deliver downloads and issue invoices.
  • To send service emails: verification, password reset, invoices and payment confirmations.
  • To protect the Service against spam, abuse and unauthorised access.
  • To meet our legal, accounting and tax obligations.

We do not sell your personal data, and we do not use it for advertising.

3. Third-Party Services

We keep the number of external providers as small as possible. These are the only ones that process personal data on our behalf:

  • Polar (polar.sh) — payment processing for paid digital assets, invoices and subscriptions. Polar acts as the merchant of record: card details are entered on Polar's checkout and never reach our servers.
  • Cloudflare Turnstile — bot and abuse protection on registration, login and password reset. It processes your IP address and browser signals to decide whether you are human.
  • Google — only if you choose "Sign in with Google". We use Google Identity Services to authenticate you and receive your Google account ID, email address, name and profile picture.
  • Namecheap Private Email — SMTP delivery of our service emails (verification, password reset, invoices and receipts).
  • Our own infrastructure — the Service runs in containers on our own servers. We self-host the MongoDB database, an S3-compatible object storage service for uploads and deliverable files, and Gotenberg for PDF invoice generation. Your data is stored on our own infrastructure rather than in a third-party content platform.
  • AI assistant — an internal tool available only to site administrators, which we use to manage content. Pages and collection entries may be processed by the AI model providers we configure for it. Customers have no access to this assistant, and we do not use your personal data to train AI models.

4. Cookies

We set only the cookies the Service needs in order to work:

  • customer_session — keeps you signed in. It is encrypted and HTTP-only, so scripts on the page cannot read it.
  • NEXT_LOCALE — remembers whether you are browsing in English or Arabic.
  • Short-lived cookies during the Google sign-in flow, and a Cloudflare cookie used for bot verification.

We do not use advertising, tracking or profiling cookies.

5. Data Retention

We keep your account data for as long as your account is active. Deleting your account removes your personal data from the Service; limited records (for example invoice and payment records) may be kept where the law or our accounting and tax obligations require it.

6. Security

Passwords are stored as one-way hashes, the site is served over HTTPS, registration and login are protected by Cloudflare Turnstile, and access to the database and admin panel is restricted to administrators. We hold no card details at all, because payments go straight to Polar. No system can be guaranteed perfectly secure, so please use a strong, unique password.

7. Your Rights

  • Access and update your name, company and phone number from your dashboard.
  • Change your email address or password from your account settings.
  • Delete your account and all associated data from the Settings page. This removes your personal information, proposals and asset purchases and unlinks you from projects.
  • Contact us to ask what we hold about you, or to request a correction.

Where applicable data protection law gives you further rights (for example to object to processing or to receive a copy of your data), tell us and we will honour them.

8. Changes to This Policy

We may update this policy as the Service changes. The revision date at the top of this page always shows the current version, and material changes will be announced on the Service.

9. Contact

Questions, requests or complaints: mouktar@mouktar.com