Privacy Policy

01

Who we are and what this policy covers

Ma Hawa is operated by Baynunah Watergeneration Technologies SP LLC, United Arab Emirates. In this policy, “Ma Hawa”, “we”, “us” and “our” refer to this company, which is responsible for the personal information described here.

This policy covers the Ma Hawa corporate, water and machines websites and online store, Ma Hawa Connect customer services, and the Ma Hawa Android and iOS apps (app identifier ae.mahawa.mobile). It applies to visitors, customers and people who contact us. Information required depends on the service you use; simply browsing does not require an account.

Independent services you open, including a payment provider, social network or sign-in provider, also have their own privacy notices. This policy explains our handling of information, rather than replacing those notices.

02

Information you provide

• Account and contact information: your name, email address, phone number and country code, language, delivery addresses, account identifiers and the information needed to verify your sign-in.
• Shopping and service information: products selected, cart and order information, delivery instructions, invoices, order status, machine enquiries, ownership or installation information, warranty details and support requests.
• Messages and files: information you enter in contact, quotation or support forms and messages. When a feature offers an upload, we receive the file you choose, which may contain personal information. Only submit information necessary for your request, and obtain permission before sharing someone else’s information.
• Preferences: language and notification choices, saved selections, and optional water-planning details such as household or workplace size and reminder preferences. These are planning preferences, not medical records.
• Assistant messages: the question you send and recent conversation context needed to answer it. See the assistant section for the specific processing involved.

Fields marked as required are needed to provide that particular service. Optional information can be left blank. Without necessary account, contact or delivery details, we may be unable to authenticate you, fulfil an order or respond to a request.

03

Information collected during use

Our hosting and service systems process technical connection information such as IP address, request time, requested service, response status and security events. Depending on the feature or service provider, this may also include browser or device type, operating system, app version and service or installation identifiers. We use this information to deliver content, diagnose problems, limit abuse and protect accounts.

Account sessions use authentication tokens or essential cookies. The app stores preferences and session information on your device, using protected device storage for sensitive session credentials. If you enable notifications, an installation identifier and push notification token are registered so notifications can reach your device.

A delivery address or location you type is different from GPS tracking. The current app does not request continuous or background location access, read your contacts, collect HealthKit or Health Connect data, or integrate advertising-ID tracking SDKs. A website or its service providers may infer a general region from your IP address.

04

How and why we use information

• Create and secure your account, verify sign-in, manage account preferences and enable the services you request.
• Process purchases, delivery, invoices, returns and order-related enquiries.
• Respond to support, machine quotations, installation, servicing and warranty requests.
• Provide product information, search, assistant responses and optional planning or reminder features.
• Send service updates and notifications, and marketing communications where the applicable consent or other lawful permission exists.
• Maintain reliability, investigate misuse, prevent fraud, resolve disputes and meet legal obligations.

Depending on the activity and applicable law, processing is based on steps you request before a contract, performance of a contract, your consent, a legal obligation, or an appropriate legitimate business interest such as security and service reliability. Where consent is required, it must be obtained for the relevant activity; reading this policy or continuing to browse is not a substitute for that consent.

05

Email, Google and Apple sign-in

When you use email sign-in, we process your email address and verification challenge to confirm that you control that address. Verification emails are delivered through Resend. When you choose Google or Apple sign-in, we receive the identity identifier and permitted profile details, such as name and email address, provided by that service. Apple may provide a private relay email instead of your usual address.

We do not receive your Google or Apple password. We handle provider tokens and account links to authenticate you and, where applicable, revoke access when you delete your account. Google and Apple separately process information under their own policies. Linking a shopping identity, when needed for purchase-related services, lets us retrieve the order or shopping information associated with that identity.

06

Orders and payment information

Our online commerce services use Shopify and the payment services offered at checkout. Those services process the payment and associated billing information. Full payment-card details are not entered into or stored by the Ma Hawa native app or Connect account service.

We receive the order, delivery, invoice, payment-status and other transaction information needed to fulfil purchases and provide support. Delivery and service partners receive the contact and address details necessary to perform the requested delivery or visit. A purchase record and a Ma Hawa app account are distinct records; deleting the app account does not automatically erase every shopping, invoice or warranty record.

07

Ma Hawa AI Assistant

The assistant is optional. When you send a question, our Connect service processes the message and a limited recent conversation context. For supported knowledge questions, that text and relevant published Ma Hawa information are sent to Google’s Gemini API to generate a response. Price questions can be answered from the current product catalogue instead. We do not send your account profile or private order records to Gemini as part of this assistant request.

The current assistant service does not save conversation text in a Ma Hawa chat database; the app keeps the displayed conversation in its active screen/session. Technical abuse-prevention and request-status information is separate from the conversation text. Google may process or retain prompts and responses under its Gemini API terms, including safety review and service improvement where those terms permit it. Provider retention is separate from the app’s local conversation.

Do not send passwords, payment-card details, identification documents, confidential business information or other sensitive personal information to the assistant. It is not a channel for private account transactions, medical advice or decisions with legal effects. The assistant is not intended for people under 18, consistent with its AI provider’s age restrictions.

08

Camera, AR, files and device permissions

• Camera: used when you choose supported scanning or augmented-reality features. Camera images and AR scene processing are handled on the device; these features do not upload a live camera feed to Ma Hawa.
• Photos or documents: where an upload feature is offered, only the files you select are submitted to provide that feature. An explicit upload is separate from scanning or AR camera processing.
• Notifications: optional device permission lets us deliver notifications. You can turn it off in Android or iOS settings.
• Sound: assistant feedback sounds are playback, not microphone recording. The current assistant does not record your voice.

You can change device permissions in system settings. Refusing an optional permission affects the related feature, while other available app functions remain usable.

09

Notifications and communications

Push delivery uses Expo’s push service and the relevant platform service: Apple Push Notification service for iOS or Firebase Cloud Messaging for Android. They process the device push token, notification payload and delivery-related information needed to send the notification. Email delivery providers process the recipient and email content for messages they deliver.

You can change available notification preferences in your account, disable push permission in system settings, and use an unsubscribe option where offered for marketing messages. Necessary transactional, security or legal communications may still be sent through other appropriate channels. Notification previews can be visible on a locked device; use your device’s preview controls if you prefer to hide them.

10

Cookies, local storage and external links

Web services use essential cookies or similar storage to maintain sign-in, security, cart state and preferences. The app uses local storage for its preferences and session state. These technologies support the requested service rather than being a reason to collect unrelated personal information.

Shopify checkout, sign-in providers and external sites may use their own cookies or other technologies under their own notices. If optional analytics or marketing cookie controls are presented on a service, use those controls to manage consent. You can also manage browser cookies or clear local storage; blocking essential cookies may prevent sign-in or checkout from working.

This privacy page loads its styling, fonts and images from Ma Hawa’s own domain and adds no analytics, advertising scripts, forms or cookies. Opening a social-network, map, payment or other external link takes you to that provider, which may receive connection information and apply its own privacy practices.

11

Who information is shared with

Access is limited to the purpose of the relevant service. Recipients can include:

• Authorised Ma Hawa personnel handling customer support, orders, servicing, administration or security.
• Oracle Cloud Infrastructure for hosting and private storage supporting Connect and its media services.
• Shopify and checkout payment providers for commerce, purchases and associated customer services.
• Google and Apple for the sign-in method you choose; Google Gemini for assistant messages as described above.
• Resend, Expo, Apple and Google for email or push delivery, as applicable.
• Delivery, installation and service partners for information necessary to perform the service you request.
• Professional advisers or competent authorities where necessary for a legal duty, claim, security investigation or protection of rights. In a business transfer, relevant records may pass to a successor subject to applicable privacy obligations.

Service providers receive information relevant to their role and are subject to the contractual and data-protection terms applicable to that service. Some providers also act independently for their own account, payment, security or legal purposes. See the Shopify, Google and Apple privacy notices and the Gemini terms linked above for those independent activities.

12

International processing

Ma Hawa operates in the United Arab Emirates. Hosting, identity, email, notification, commerce and AI providers may process information in countries other than your country of residence. This policy does not mean that all information stays in the UAE.

International processing must follow applicable data-protection requirements, using an appropriate transfer basis and safeguards, such as relevant contractual protections, where required. You may contact us to ask about the processing or safeguards relevant to your information.

13

Retention and what remains after deletion

Retention depends on the purpose and category of the record, account status, applicable legal requirements and any active dispute or security issue. There is no single retention period for every category.

• Account profile and delivery addresses: maintained to provide your account services and removed by the Ma Hawa account-deletion process described below.
• Authentication: active access is revoked when the account is deleted. Limited deletion, revocation and security records can remain to complete provider revocation, prevent misuse and demonstrate what happened.
• Orders, invoices, support, installation and warranty records: may remain where needed to fulfil an obligation, manage an unresolved request or warranty, comply with financial or other legal duties, or establish or defend a claim.
• Assistant conversations: no current Ma Hawa server-side chat database is maintained; provider-side processing and retention are governed separately by the Gemini terms.
• Technical records and backups: may remain for security, recovery and applicable obligations. Removing a live record does not mean every backup copy disappears at the same moment.

We assess deletion or anonymisation against these purposes and requirements. Contact us for information about a particular record or to request erasure beyond the in-app account process. Where retention is necessary, we will explain the relevant category and reason rather than describing the account as merely suspended.

14

Delete your account or request data deletion

We may ask for proportionate verification before releasing or deleting information. Do not send your password, verification code or payment-card details. We respond within the periods required by applicable law and explain any verification needed, lawful retention or other limit on the request.

The shopping account, existing orders and service records can require a separate deletion assessment. Ask us explicitly to include those records in your request; we will explain anything that must be retained and why. The in-app deletion does not cancel an order, resolve an outstanding contract or delete your Google or Apple account.

15

Your choices and privacy rights

Depending on the law applicable to your information, you may request access or a copy, correction, erasure, restriction, objection to certain processing, or transfer of eligible information. You can withdraw consent for consent-based processing without affecting its lawfulness before withdrawal. Some rights have exceptions, including legal record-keeping and the rights of other people.

Use account settings for available profile and communication choices, device settings for permissions, or the contact below for a privacy request. We may verify your identity and explain any lawful limits. If you remain concerned, you may raise a complaint with the competent data-protection authority in the relevant jurisdiction.

16

Security

We use measures appropriate to the information and service, including encrypted network connections, controlled staff access, protected session credentials, encryption of sensitive account fields and restrictions on what is included in application logs. No internet service or storage method can guarantee absolute security.

Keep your device secure and sign-in details private. If you suspect account misuse or an exposure of your information, contact us. Security incidents are assessed and notifications are made where required by applicable law.

17

Children and information about others

Our services are not designed to solicit children’s personal information. A minor should use account or purchasing services only with appropriate parental or guardian involvement and subject to applicable age restrictions. The AI assistant has the separate age restriction stated above.

If you believe a child has provided personal information without appropriate permission, contact us so we can investigate and take the necessary action. If you provide information about another person for delivery or support, ensure you are entitled to do so and tell them about this policy.

18

Changes to this policy

We may update this policy when services, providers or legal requirements change. The version and date at the top identify the current notice. Material changes will be communicated through an appropriate service channel where required, and fresh consent will be requested where the law requires it. The Arabic and English versions describe the same practices.

19

Contact Ma Hawa about privacy

For a privacy question, access request, correction or deletion request, contact:

Please identify the relevant service and account email, describe your request, and share only the details needed to help us respond.