Home

Privacy Policy

Effective date / Last updated: October 25, 2026

This Privacy Policy explains how Maloom ("مَعلوم", "Maloom", "we", "us", or "our"), operating the website and web application at https://maloom.co, collects, accesses, uses, stores, protects, and shares personal data when you visit our website, create an account, sign in with Google, or use our services.

1) Information we collect

Depending on how you interact with Maloom, we collect the following categories of information:

  • Account & identity data: your full name, email address, phone number (if you sign in via OTP), hashed password (if using password authentication), and account preferences.
  • Google account data (via Sign in with Google): when you choose to sign in or register using Sign in with Google, we access the basic profile you authorize through Google OAuth (openid, email, profile): your name, email address, profile picture URL, and unique Google Account identifier.
  • Business & property data: your business name, website domain, industry, city, country, and — only where you explicitly connect an integration — authorized search-performance, analytics, or business-profile details.
  • Website technical & diagnostic data: publicly accessible pages on your website, robots.txt, sitemap.xml, structured-data markup, and search/AI visibility diagnostic results.
  • Platform usage & billing data: task history, approval audit logs, subscription plan details, and tax invoice records (payment card details are processed directly by our payment provider and are never stored on Maloom's servers).

2) How we use your information

We use the information we collect strictly to provide, operate, secure, and improve Maloom's user-facing services, including to:

  1. create, authenticate, and manage your Maloom account and session security;
  2. diagnose your business's visibility across search engines and AI assistants, generate optimization recommendations, and — only with your authorization — execute approved improvements on your connected properties;
  3. communicate essential account, security, billing, and service updates, and issue statutory tax invoices;
  4. maintain security, prevent fraud or abuse, keep an audit trail of changes, and troubleshoot technical issues.

We do not sell or rent your personal data to third parties, and we do not use your personal data, Google user data, or website content to train generalized or public artificial-intelligence / machine-learning models.

3) Google user data: access, use, storage, sharing, and Limited Use compliance

Because Maloom supports Google OAuth authentication (and optional, user-authorized Google integrations), the following specific disclosures apply to all Google user data received through Google APIs.

3.1 Google data we access

  • Google Sign-In (openid, email, profile): your name, email address, Google user ID, and profile picture URL.
  • Optional Google integrations — accessed only if you explicitly connect them on the Google consent screen:
    • Google Search Console (.../auth/webmasters.readonly, read-only): your verified sites, indexation/coverage status, and search-performance metrics (impressions, clicks, queries).
    • Google Analytics (.../auth/analytics.readonly, read-only): aggregated traffic metrics such as organic sessions.
    • Google Business Profile / Maps (.../auth/business.manage) — only where this integration is enabled: your business-listing details; any publishing or modification occurs strictly upon your explicit approval inside Maloom.

3.2 How we use Google user data

  • Google Sign-In data is used solely to authenticate your identity, create and link your Maloom account, display your name/avatar inside your workspace, and send transactional account notifications to your account email.
  • Where you explicitly connect an optional Google integration, the accessed data is used solely to display diagnostics to you and to execute the specific updates you review and approve in the Maloom interface.
  • No advertising & no AI model training: we never use Google user data for targeted, personalized, retargeted, or interest-based advertising, and Google API user data is never used to develop, improve, or train non-personalized or generalized AI/ML models.

3.3 Sharing and transfer of Google user data

We do not sell, license, or share Google user data with data brokers, information resellers, or advertising platforms (including Meta Pixel / Conversions API). Google user data is only transferred or disclosed in these limited circumstances:

  • to essential cloud infrastructure, database hosting, and transactional email sub-processors strictly necessary to operate Maloom's user-facing features, bound by confidentiality and data-processing agreements;
  • with your explicit direction and consent (for example, publishing an update you approved);
  • when required to comply with applicable laws or lawful requests, or to protect security and prevent abuse.

3.4 Google API Services User Data Policy (Limited Use disclosure)

Maloom's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4) Access to your website and connected properties

We crawl publicly accessible pages on your website and respect robots.txt. Any publishing or modification on your connected properties (such as your website CMS, online store, or business profile) takes place only according to the permissions you grant, with sensitive changes requiring your explicit prior approval, recorded in the audit log with the ability to revert.

5) Data sharing and sub-processors

To operate the platform, we share only the minimum necessary data with trusted service providers acting as data processors on our behalf:

  • Cloud hosting & database infrastructure: to host the application and store encrypted account and workspace data.
  • Transactional email provider: to deliver OTP codes, account alerts, and invoices.
  • Payment gateway (Lemon Squeezy): to process subscription payments and issue invoices.
  • AI model providers: used strictly to run visibility diagnostics on public queries/pages; we do not send your Google OAuth credentials or private account tokens to AI providers, and API calls are configured so inputs are not used to train public models.

Each service provider is bound by a written data-processing agreement requiring appropriate confidentiality and security safeguards.

6) Analytics, advertising on public pages, and cookies

On our public marketing pages (outside the authenticated dashboard), we use cookies and measurement tools to understand visitor traffic and measure our own marketing campaigns:

  • Google Analytics: aggregated, de-identified statistics about page visits and traffic sources on our public pages.
  • Microsoft Clarity: to understand how visitors interact with public pages (scrolling, clicks). Input fields are automatically masked.
  • Meta (Pixel and Conversions API): to measure the effectiveness of our Instagram and Facebook ads for visitors who interact with our marketing funnels (using technical identifiers such as IP address, browser information, and cookies; any form emails are hashed via SHA-256). Important exclusion: data obtained from Google APIs / Google Sign-In is never shared with or transferred to Meta or any advertising platform for ad targeting, measurement, or profiling.

Your authenticated dashboard is excluded: Google Analytics, Microsoft Clarity, and advertising pixels do not run inside your authenticated /app workspace, and your internal workspace activity is never recorded by them. You can manage or block non-essential cookies through your browser settings, ad-preference centers, or by contacting us at privacy@maloom.co.

7) Data storage and security protection

We implement industry-standard technical and organizational measures to protect your personal data and Google user data against unauthorized access, alteration, disclosure, or destruction:

  • Encryption in transit: all data transmitted between your browser, Maloom's servers, and Google APIs is encrypted using HTTPS / TLS 1.2+.
  • Encryption at rest: databases, backups, and any stored OAuth access/refresh tokens are encrypted at rest (AES-256 or equivalent cloud-native encryption).
  • Logical isolation & access control: workspace data is logically isolated per business account, and internal administrative access is restricted on a least-privilege basis.

8) Data retention and deletion

  • Active accounts: we retain your account information and connected Google user data only for as long as your Maloom account remains active and as needed to provide our services.
  • Audit & billing logs: security/task audit logs are retained for up to 12 months, and statutory tax invoices and billing records for the period required under applicable tax and commercial laws in the Kingdom of Saudi Arabia.
  • Account deletion & revoking Google access: you may disconnect any integration or request complete deletion of your Maloom account and associated Google user data at any time from your account settings or by emailing privacy@maloom.co. Upon a verified deletion request (or when you disconnect a Google integration), we revoke stored OAuth tokens and permanently delete or anonymize your personal data and Google user data from our active systems within 30 days (except statutory billing records required by law). You may also revoke Maloom's access at any time from your Google Account permissions.

9) Your privacy rights & Saudi PDPL compliance

We comply with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia. Subject to applicable law, you have the right to:

  • know how your personal data is collected and processed;
  • request access to and obtain a copy of your personal data in a readable format;
  • request correction or updating of inaccurate or incomplete personal data;
  • request destruction/deletion of your personal data when no longer needed;
  • withdraw consent to data processing or third-party integrations at any time.

Cross-border data transfers: Maloom's cloud hosting infrastructure and certain sub-processors (including Google, Meta, Microsoft, and our payment and AI providers) operate on secure servers located outside the Kingdom of Saudi Arabia. Transfers are limited strictly to what is necessary to deliver the service and are governed by data-processing agreements and appropriate safeguards.

10) Changes to this policy & contact us

We may update this Privacy Policy from time to time to reflect changes in our practices, features, or legal requirements. If we make material changes — especially regarding how we handle Google user data — we will update the "Last updated" date above and notify registered users via email or an in-app notice.

  • Website: https://maloom.co
  • Privacy email: privacy@maloom.co
  • General / legal contact: legal@maloom.co