Privacy Notice

MAKN Privacy Notice

Version: 1.0 Effective date: 18 August 2026 Last updated: 18 August 2026

Summary in one paragraph: MAKN is a personal portfolio-tracking app. We collect your account details, the portfolio information you choose to enter, and basic technical and security data. We use it only to run the App for you, keep it secure, and support you. We do not sell your data, we do not use it for advertising, and we do not share your portfolio data with advertisers or data brokers. You can delete your account and your portfolio data at any time, subject only to the limited records we must keep — see Section 12. Contact us at Makn.Care@gmail.com.

1. Purpose of this notice

This notice explains how MAKN collects, uses, stores, shares, protects, and destroys personal data, and describes the rights available to you as a data subject. It is issued in accordance with the Saudi Personal Data Protection Law (Royal Decree M/19 of 1443H, as amended) and its Implementing Regulations.

You should read this notice before creating an account or entering personal data into the App. It should be read together with the Terms of Use and the Cookies and Local Storage Policy.

2. Data controller and contact details

Controller: MAKN App Name used: MAKN / مَكْن (unregistered) Status: An independently operated software application. MAKN is not currently a registered commercial company; we intend to incorporate a Saudi legal entity after the private-beta period, and this notice will be updated accordingly. National Address: Building No. 3116, Al Shaikh Abdullah Ibn Jibrin Street, Al Qairawan District, Riyadh 13531 – 7178, Kingdom of Saudi Arabia Short Address: RRQC3116 Privacy contact and all data-subject requests: Makn.Care@gmail.com Response time: We aim to acknowledge within 5 business days and to respond substantively within 30 days.

The controller is the party that determines the purposes and means of processing personal data. Email is the sole channel for written data-subject requests, which allows us to keep a verifiable record of every request; the App itself additionally provides self-service correction and deletion, as described in Sections 12 and 13.

Data Protection Officer: Not appointed. MAKN's processing does not meet the thresholds under the Implementing Regulations that require the appointment of a DPO — we do not carry out large-scale regular monitoring of individuals, and we do not process sensitive personal data as a core activity. All privacy matters are handled directly through the address above.

3. Personal data we process

Depending on how you use the App, we may process the following categories.

A. Account data

• name (or display name you choose);
• email address;
• user identifier assigned by the system;
• registration, invitation, and private-beta approval status;
• record of your acceptance of the Terms of Use and this notice, with date and version; and
• technical authentication and session information.

We do not have access to your password in readable form; authentication credentials are handled by our authentication provider using one-way hashing.

B. Financial portfolio data (entered by you)

• portfolios, holdings, asset names, and symbols;
• quantities, prices, and costs;
• purchases, sales, distributions, and splits;
• commissions, currencies, and exchange rates;
• manual valuations;
• income and deductions;
• loans, liabilities, and payment schedules; and
• classifications, sectors, tags, and notes you enter.

This data is entered voluntarily by you. It is not obtained from your bank, broker, or any financial institution, and the App does not connect to your financial accounts.

Loan and liability entries. Any loan or liability information is entered by you about your own affairs. It is not obtained from, shared with, or reported to any credit bureau, financing entity, or lender, and it is not used for any credit assessment, scoring, or lending decision. We record it on the basis of your explicit consent, which you may withdraw at any time by deleting the entry in the App.

C. Technical and security data

• device and browser type and operating system;
• IP address, used for security and abuse prevention only;
• login, logout, and session times;
• error, security, audit, and diagnostic logs;
• login attempts and activity associated with protecting the account.

We do not derive, store, or use any location — approximate or precise — from your IP address or from any other signal.

D. Communications and support data

• messages you send us;
• support requests and our replies;
• feedback, suggestions, and bug reports; and
• requests to exercise privacy rights, and our record of how they were handled.

E. What we do NOT collect

We do not collect or request: precise, approximate, or background location; contacts; photos or media library access; SMS or call logs; microphone or camera data; health data; biometric data; advertising identifiers; payment-card details; bank credentials; or national identity, iqama, or passport numbers or images.

The App contains no advertising SDK, no advertising identifier, no tracking pixel, and no third-party marketing or product-analytics SDK. Error and crash diagnostics are handled through our own server-side logs and, where a crash-reporting component is used, solely to diagnose faults — never for analytics, profiling, or marketing.

4. Sources of personal data

We obtain data from:

• information you provide directly;
• files you choose to import;
• transactions and records you enter in the App;
• technical data generated automatically when you use the service;
• our authentication and hosting providers, in relation to sign-in and delivery of the service; and
• market-data providers, in relation to prices, symbols, exchange rates, and financial-instrument information (this data is about instruments, not about you).

5. Purposes of processing

We process personal data to:

• create, verify, and administer accounts;
• authenticate users and manage login and sessions;
• administer invitations and access to the private beta, including administrator approval;
• store, organise, and display your portfolio data back to you;
• calculate values, returns, distributions, allocations, and analytics from data you entered;
• convert currencies and display combined totals;
• retrieve and refresh market data relevant to the instruments you track;
• save your language, currency, and appearance settings;
• provide support and respond to your requests;
• protect accounts and the App, detect and prevent misuse, fraud, and unauthorised access;
• identify faults, debug, and improve performance and reliability;
• retain records of consent and acceptance as evidence of compliance;
• comply with legal obligations and respond to lawful requests from competent authorities;
• establish, exercise, or defend legal claims; and
• create aggregated or anonymised statistics that do not identify you.

We do not use your portfolio data for targeted advertising, we do not sell your personal or financial data, and we do not share it with advertisers or data brokers.

6. Legal basis for processing

We process data under the legal basis appropriate to each purpose:

Where we rely on legitimate interest, we have assessed that our interest is not overridden by your rights and freedoms, and you may object at any time as described in Section 13.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

7. Data minimisation and what you must not enter

We collect only the data reasonably necessary to provide the service.

What is mandatory and what is optional:

• Mandatory: your email address and a display name. Without these we cannot create, secure, or support an account, and access to the App cannot be granted. Your record of acceptance of the Terms is also mandatory, as it is our evidence of lawful processing.
• Optional: all portfolio data — holdings, transactions, valuations, income, liabilities, notes, and classifications. You are free not to enter any of it; the only consequence is that the corresponding features will not display anything. There is no penalty and no loss of access.
• Generated automatically: technical and security data (Section 3C) is produced whenever you use the App and cannot be switched off while you use it, because it is required to authenticate you and keep the account secure.

You must not enter passwords to financial accounts, one-time verification codes, digital-wallet private keys or seed phrases, full bank-account or payment-card numbers, national identity or iqama numbers, or identity-document images. The App does not need this information and we do not want to hold it. Use non-sensitive descriptions such as "Main portfolio" instead of full account numbers.

8. Disclosures and service providers

We do not sell personal data. We engage a limited number of service providers who process data on our behalf, under our instructions:

We identify providers by role rather than by brand name because our infrastructure may change during the beta. If you would like to know the specific providers currently used, email Makn.Care@gmail.com and we will tell you. We will update this notice if the categories of provider change materially.

A provider receives data only to the extent reasonably necessary to deliver its service. We subject providers to appropriate confidentiality, security, and data-protection obligations, and we do not permit them to use your data for their own independent purposes.

We may also disclose personal data where disclosure is:

• required by law, regulation, or an order from a competent authority or court;
• necessary to protect the rights, property, or safety of MAKN, our users, or the public, or to prevent or investigate fraud, abuse, or a security incident;
• part of a restructuring, incorporation of a legal entity, merger, or transfer of the business, subject to applicable safeguards and to notifying you; or
• made at your request or with your consent.

We do not disclose portfolio data to advertisers or data brokers for their marketing purposes, and we have never done so.

9. Transfers outside Saudi Arabia

Some of our service providers process or store data outside the Kingdom of Saudi Arabia. Based on our current infrastructure, personal data may be processed in the United States and in the European Union / European Economic Area, and market-data queries may be routed to providers in those regions.

Ground for transfer. We transfer personal data outside the Kingdom only where it is necessary to perform the contract with you — that is, to operate, host, and secure the App you have asked us to provide. We do not transfer data outside the Kingdom for any other purpose.

Where a transfer is subject to the Personal Data Protection Law and the Data Transfer Regulations, we implement the required measures before transferring data. Depending on the circumstances these include: conducting a risk assessment before any continuous transfer; assessing the level of protection in the destination jurisdiction; relying on an adequacy decision issued by the competent authority where one applies; entering into standard contractual clauses or equivalent contractual safeguards with the provider; limiting the transfer to the minimum data necessary; and applying encryption in transit and access controls. We satisfy ourselves in each case that the transfer does not prejudice national security or the vital interests of the Kingdom.

We will update this section if the regions used change materially. You may request further details of the safeguards applied by emailing Makn.Care@gmail.com.

10. Retention periods

We retain personal data only for as long as necessary for the purposes described in this notice.

When the lawful purpose ends, data is deleted, securely destroyed, or irreversibly anonymised.

11. Data security

We apply technical and organisational safeguards appropriate to the App and the data involved, currently including:

• encryption in transit using TLS;
• encryption at rest applied by our infrastructure provider;
• authentication managed by a specialist third-party provider, with passwords stored only as one-way hashes;
• server-side authorisation checks on every request;
• database Row-Level Security policies, so a query can only ever return the requesting user's own rows;
• logical separation of each account's data;
• least-privilege access controls, with administrative access limited to what is necessary to operate the App;
• technical, security, and access logging;
• regular backups managed by the infrastructure provider; and
• invitation-only access during the beta, which limits exposure.

No online service is completely secure. You should protect your password and device, use a unique password, sign out on shared devices, and notify us promptly at Makn.Care@gmail.com of any suspected unauthorised activity.

12. Deleting your account and your data

You can delete your account and your portfolio data at any time, subject only to the limited records listed below that we are required to keep.

In the App: go to Settings → Account → Delete account and confirm. This deletes your account together with your portfolios, holdings, transactions, valuations, notes, and settings.

By email: send a request to Makn.Care@gmail.com with the subject line "Account deletion" from the email address registered to your account. If you no longer have access to that address, we will ask for other information reasonably sufficient to verify that the account is yours.

What happens next:

• we verify the request and confirm receipt, normally within 5 business days;
• active data is permanently deleted within 30 days of verification;
• copies held in encrypted backups are overwritten or destroyed within 90 days;
• limited records are retained where necessary for compliance or the protection of legal rights — specifically: security and audit logs (24 months), proof of consent and acceptance (24 months), and support correspondence (24 months from the last message), as set out in Section 10. These records do not include your portfolio data; and
• we confirm to you in writing once deletion is complete.

Deleting only some data: you can delete an individual portfolio, holding, transaction, or note within the App at any time without deleting your account. You may also ask us to delete specific data by email.

Get a copy first: before deleting, use the in-app export function where available, or email Makn.Care@gmail.com and we will send you a copy of your data in a common machine-readable format within 30 days. Deletion is irreversible and we cannot restore deleted data.

13. Your rights

Subject to applicable law, you have the right to:

• be informed about how your data is processed — this notice is how we provide that;
• access your data and obtain a copy of it;
• correct or complete inaccurate or incomplete data — most data can be corrected directly in the App;
• delete your data where legally available — see Section 12;
• request destruction of data when its purpose has ended;
• withdraw consent where processing relies on consent, at any time;
• object to or restrict processing where applicable, including processing based on legitimate interest;
• obtain your data in a readable, machine-readable format — we will send you a copy by email within 30 days of a verified request, whether or not an in-app export function is available — and request its transfer where required by law; and
• be informed of the parties to whom your data has been disclosed.

How to exercise a right: email Makn.Care@gmail.com stating which right you wish to exercise. We may request information reasonably necessary to verify your identity before acting — this protects you against someone else making a request in your name.

Our response: we will respond within 30 days of receiving a verified request. Where a request is complex or where we have received several requests from you, we may extend by a further 30 days and will tell you if we do. Exercising your rights is free of charge; we may charge a reasonable fee only for a manifestly excessive or repetitive request, and we will tell you before doing so. If we cannot fulfil a request in whole or in part, we will explain why and tell you how to complain.

14. Personal-data incidents (breaches)

If a personal-data breach occurs, we will:

• assess its nature, scope, and likely impact without delay;
• take immediate containment and remediation measures;
• notify the competent authority (SDAIA) within 72 hours of becoming aware of a breach that may cause harm to personal data or to data subjects, in accordance with the Implementing Regulations;
• notify affected data subjects without undue delay where the incident may damage their personal data or prejudice their rights or interests, in simple and clear language, describing what happened, what data was involved, what we are doing about it, and what you can do; and
• record the incident and the actions taken.

15. Screen privacy — the "Hide amounts" feature

The "Hide amounts" feature obscures figures displayed on the device you are using. It is a display setting only.

It does not delete your data, does not anonymise it, and does not provide any separate encryption of the underlying stored data.

16. Children's data

The App is not intended for anyone under 18 years of age, and we do not knowingly collect personal data from children. Access during the beta is by invitation and administrator approval, which further limits this risk.

If you believe a child has provided personal data to us, contact Makn.Care@gmail.com and we will delete the account and its data promptly.

17. Automated decision-making and profiling

MAKN does not use your portfolio data to make automated decisions that produce legal effects or similarly significant effects for you.

Analytics, classifications, allocation breakdowns, and alerts are informational outputs calculated from data you entered. They are not automated investment management, credit decisions, or personalised recommendations, and no decision is taken about you on their basis.

Two decisions are taken about you, and both are made by a human, not automatically: admission to the private beta, and suspension or termination of an account for security, misuse, or breach reasons. These are based on account and security data, not on your portfolio data. If either decision affects you, you may ask for an explanation and contest it by writing to Makn.Care@gmail.com.

18. Private-beta specific notes

During the private beta:

• your data may be migrated as the data model changes;
• we may contact you by email about the beta, service changes, and issues affecting your account — these are service messages, not marketing, and are necessary to operate the service;
• we may review error and diagnostic logs that could incidentally contain data you entered, solely to fix faults; access to these is limited to what is necessary; and
• if we end the beta, we will give you reasonable notice and an opportunity to export your data before deletion, where practicable.

19. Marketing

We do not send marketing or promotional messages during the private beta. If we introduce them in the future, we will ask for your consent first and every message will include an unsubscribe option. Withdrawing consent to marketing will not affect your access to the App.

20. Changes to this notice

We may update this notice when the service, providers, security practices, or legal requirements change.

We will update the "Last updated" date and notify you of material changes by email or in the App at least fourteen (14) days before they take effect. If a new purpose requires separate consent, we will obtain that consent before the processing begins. Previous versions are available on request.

21. Complaints and contact

For privacy enquiries, requests, or complaints:

Email: Makn.Care@gmail.com Operator: MAKN App National Address: Building No. 3116, Al Shaikh Abdullah Ibn Jibrin Street, Al Qairawan District, Riyadh 13531 – 7178, Kingdom of Saudi Arabia Short Address: RRQC3116 Data Protection Officer: Not appointed — not required for MAKN's current processing (see Section 2). Privacy matters are handled directly at the email above.

Please contact us first so we can try to resolve your concern. If you are dissatisfied with how we handle a complaint, you may lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA), the competent personal-data protection authority in the Kingdom of Saudi Arabia, through the channels it makes available.

Related documents: Terms of Use; Cookies and Local Storage Policy.