1. Who is responsible
Musharik, Cairo, Arab Republic of Egypt, is the controller of the personal data described here. For any question about this policy, or to exercise a right under section 7, write to privacy@musharik.tech.
2. What we collect
- Account data: your name, email address, phone number and governorate.
- Application data. For a company: its name, sector and the amount it is raising. For an investor: the organisation, investor type and typical ticket size.
- Verification documents: commercial registration, tax card, balance sheets and the other documents listed in the application form.
- Activity: the listings you own, the requests you send or receive, your watchlist and your matching preferences.
- Technical data: a session cookie so you stay signed in, and short-lived counters used to limit repeated sign-in and sign-up attempts. Those counters store a one-way hash, not your address or email.
- Security records. For each sign-in, failed sign-in, sign-out and refused access: when it happened, and your account or, for a failed attempt, a one-way hash of the email typed. The connection it came from is kept only as a one-way hash, never as an IP address.
- Error reports. When a page or an action fails, a record of what failed: the error, the page address, your browser and device type, and an approximate location (city and country) worked out from your connection. The report does not keep your IP address, and we take the values you entered in a form out of it before it is sent.
3. Why we hold it, and on what basis
- To verify that you are who you say you are, and that a company is real. This is necessary to perform the agreement between us, and the whole reason members trust the marketplace.
- To operate the marketplace: to publish an anonymised listing, to deliver a Request to Proceed, and to introduce two members to each other once both sides have accepted.
- To tell you when something happens to you, by email: an application decided, a request received, a request accepted.
- To keep the platform safe: rate limits against repeated attempts, a record of sign-ins and refused access so an attack can be noticed and looked into, and a record of every staff decision so it can be accounted for. This is our legitimate interest in a marketplace that is not abused.
- To find and fix faults, through the error reports described in section 2. This is our legitimate interest in a service that works.
4. Who can see it
Other members see an anonymised listing: sector, governorate and figures. They do not see your name, your company's name, your documents, or your contact details, and there is no point at which the product shows them. When a company accepts a Request to Proceed, Musharik's staff introduce the two members directly; that introduction is the only way either of them learns who the other is. Our notification emails never contain an identity.
Musharik's verification staff can see your real identity and your documents, because that is what reviewing an application means. Every approval, rejection and listing takedown is recorded against the member of staff who made it.
5. Processors and transfers abroad
We use Supabase for the database, authentication and document storage, hosted in Frankfurt, Germany; Vercel to host the website, which runs in Frankfurt and is reached through Vercel's worldwide network; Resend to deliver email; and Sentry to collect error reports, stored in its European Union region in Germany. Each acts on our instructions and may not use your data for its own purposes.
This means your data is stored and processed outside Egypt. Cross-border transfer under Law 151 of 2020 requires a licence or permit from the Data Protection Centre, or an adequate level of protection in the receiving country. We will not open the platform to real members before that position is settled and stated here.
6. How long we keep it
- A rejected application and its documents: twelve months, so a decision can be appealed, then deleted.
- Documents uploaded for an application that was never sent: two days, then deleted.
- An active member's account, listing and documents: for as long as the account is open.
- After you close your account: your profile, listing, requests, watchlist and preferences are deleted immediately, and your documents within thirty days.
- Records of staff decisions: five years, keeping only the action, its subject and the name of the member of staff. These survive account closure, because a record that disappears is not a record.
- Sent notifications: twelve months. Rate-limit counters: a day at most, and they hold no identifying data.
- Security records: twelve months, then deleted. When you close your account, yours are deleted with it.
- Error reports: deleted by Sentry after ninety days at most.
7. Your rights
Under Law 151 of 2020 you may ask us to show you the data we hold about you, correct it, or erase it. You may withdraw consent, and object to processing based on our legitimate interest. You can close your account and trigger erasure yourself from your dashboard; for anything else, write to privacy@musharik.tech and we will answer within thirty days.
If you are not satisfied with our answer, you may complain to Egypt's Personal Data Protection Centre.
8. How we protect it
- Documents are held in a private store. There is no public link to any of them; staff read them through links that expire.
- An uploaded file is identified by its contents, not its name, and only PDF and image files are accepted. Stored filenames are generated by us.
- Every page and every action checks who you are on the server before it reads anything, and the database refuses access through the public key entirely.
- Your location is recorded as a governorate, never a street address. In a blind marketplace a precise location plus a sector can identify a company.
9. Changes
We will email members before a material change to this policy takes effect, and the date above will change with it.