Privacy policy

1. What this policy covers

This text explains what Markaz Nerkh collects when you use the website, dashboard, API, widgets and price board, how we use it and how long we retain it. We do not sell your information.

2. Information we collect

• Account: mobile number, first and last names, and the plan chosen during signup.
• National ID: checked through Shahkar only when issuing your first API key, to confirm ownership of the mobile number. The result is saved so the check is not repeated.
• API keys: each key's prefix, plan and allowed origins. The full key is shown only once; we store only its hash.
• Usage and requests: daily request counts and outcomes per key, plus metadata such as timestamp, endpoint, sender IP, Origin and X-Request-ID. We do not see your website or app content.
• Domains and IPs: the domains and IP addresses you register, and their verification results.
• Widgets: settings of widgets you create and daily views by domain, counted from the embed page's Referer header.
• Payments: plan, amount, discount code, invoices and gateway transaction ID. Your card number and password are entered on the bank gateway and never reach us.
• Official invoices for businesses require the registered company name, national identifier, tax code, postal code and address.
• Acquisition source: first-visit utm_* parameters, referring website and landing page. These are submitted with signup and payment to understand how users found us.
• Sales enquiries: the name, organisation, phone number and requirements you submit through Contact Sales.

3. How we use it

• Service delivery: login, key issuance, quota and origin enforcement, and dashboard usage and view statistics.
• Service messages: login codes, 80% and 100% usage alerts, and renewal reminders 7 and 1 days before expiry, by SMS or email.
• Security and abuse prevention: detecting unusual traffic, exposed keys and attempts to bypass limits.
• Processing payments, issuing invoices and meeting legal obligations, such as Shahkar identity checks.
• Product improvement: aggregate signup-to-purchase statistics, without selling or sharing personal information.

4. Cookies and browser storage

The website uses one cookie: mn_account, created at login, HttpOnly and inaccessible to page scripts, sent only to /api and retained for 30 days. Signing out deletes it. We use no advertising cookies.

Some preferences stay in this browser's localStorage and are not sent to the server, except acquisition data sent at signup and payment. Clearing site data removes them all:

• Light or dark theme, display currency and assistant visibility.
• Announcement dismissal, documentation sample language, chart drawings and chart settings.
• Price-board settings configured in the dashboard.
• A “this browser was signed in” hint, used only to decide whether to check login status, and the source of the first visit.

5. Who we share it with

• Shahkar service: national ID and mobile number, only to verify ownership when issuing the first key.
• SMS provider: mobile number and the text of login codes, alerts or reminders.
• Payment gateways (Zarinpal and Saman): invoice amount and ID to process the payment.
• Legal authorities: only in response to a lawful request and within its scope.
• We do not sell or share your information beyond the purposes above.

6. Retention period

Account information is retained while your account is active. Invoices and payment records are retained as legally required. Usage statistics and request metadata support the dashboard, error investigation and abuse monitoring. Exact retention periods will be added after legal review.

7. Security

• All connections are encrypted with HTTPS.
• Login is passwordless using a one-time code. The session is stored in an HttpOnly cookie.
• API keys are stored as hashes and accepted only from their own allowed origins.

8. Your rights

• View your account, keys, domains, usage and invoices in your dashboard.
• Contact support to correct your information, close your account or request deletion. Legally required records, such as invoices, remain for the required retention period.
• Contact support to disable usage-alert SMS or emails. This setting is coming to the dashboard. Login codes and essential account messages cannot be disabled.

9. Changes to this policy

This policy may change. The version and last update date appear above. We announce significant changes before they take effect in the dashboard or by SMS. Contact support with privacy questions.