Privacy Policy
Privacy Policy
This policy explains what personal data Metaajer collects, why, who sees it, how long we keep it and what you can do about it. We have tried to write it in plain language. If something is unclear, write to us (section 16).
1. Who we are
Metaajer is a digital trust and reputation advisory service operated by Signauto Management Consultancy Co. W.L.L., a company registered in the Kingdom of Bahrain, commercial registration (CR#) 188307-1 ("Signauto", "we", "us"). Registered office: Manama, Kingdom of Bahrain.
Signauto is the controller of the personal data described in this policy. This is true whichever website address, partner brand or partner interface you used to reach the platform.
Privacy and support contact: [email protected].
2. Whose data this covers
- Visitors to our public pages.
- Applicants who ask for access, on metaajer.io or on a partner's page.
- Clients: people and organisations that have been given access, and the individuals who act for them.
- Partners (independent firms that introduce clients to the platform) and their staff.
- People we research: people who are named in a client's diagnostic, such as a founder or a director. Section 5 is written for you.
3. What we collect
| Who | What we collect | Where it comes from | Why |
|---|---|---|---|
| Visitors | Your IP address, browser type and the pages you request, in our server and network logs | Your browser | To deliver the site, keep it secure and prevent abuse |
| Applicants | Name, brand or company, website, email, country, industry, whether you apply as an individual or a company, and any note you choose to add. When you submit: your IP address, browser details and the result of our bot check | You | To review your application, reply to you, protect the form from abuse and keep a record of the decision |
| Clients | Name, email and sign-in details (your password is stored only as a one-way hash). The details you give us about yourself or your organisation: brand, website, country, industry, aliases, competitors, social handles, locations and the key people you confirm. Messages and files you send us. Booking times and your time zone. The agreements you accept (typed name, IP address, browser details and the text you accepted). Payment records: amount, status, reference, and for a saved card its brand and last four digits. Your last sign-in time | You, and our systems | To run your account and diagnostic, deliver the service, take payment, keep records and keep your account secure |
| Partners and their staff | Business and contact details, branding, agreement acceptances, commission records, and payout bank details (stored encrypted). Sign-in records | You | To run the partner programme, pay commission and keep the platform secure |
| People we research | Name, role and the public information found about them (section 5) | Public search results and AI assistants' answers | To prepare a client's diagnostic |
We do not buy personal data and we do not collect it from social media accounts that are not public.
4. How the diagnostic works
A diagnostic is surface-level research using public information. It is not private investigation, and it does not access anything that is not public.
- Search. We use a search provider (Serper) to run web searches about the brand, company or person being checked. What we send is the search query only, such as a name with words like "reviews" or "complaints".
- AI assistants. We put the same questions to four AI assistants (Claude, ChatGPT, Gemini and Perplexity), reached through an AI gateway (OpenRouter). What we send is the name of the brand or person, the website, country and industry, and for key people their name and role. We do not send an applicant's contact details to a search or AI provider.
- Automated checks. Software, including an AI model, reads the results and the assistants' answers to decide which are about the right subject, whether they are negative and how serious they seem.
- Scores and summary. Software calculates two scores (Reputation and Visibility, each out of 100) and a position (Maintain, Amplify, Repair or Rebuild). An AI model then writes a plain-language summary from the findings. Automated checks remove any figure, name or website in the summary that is not in the findings it cites.
- Delivery. The report is delivered to the client. It is produced automatically, and no person reviews it before it is delivered.
What you are reading is what a source said, not what is true. When the report quotes an AI assistant, that is what the assistant said, word for word. Assistants and search results can be out of date, incomplete or wrong, and the report says so. The scores are automated measures of what was found on the day, not a verdict on anyone.
We do not use the scores to make decisions with legal effect about anyone. The scores inform advice. Whether to approve an application is decided by a person.
You can ask for a person to look at any result. On your report, use "Ask a person to review this" and tell us which part looks wrong, or write to [email protected]. A person at Metaajer will review it and reply.
AI providers and your data. We tell our AI gateway not to route requests to any provider that collects prompts or uses them to train its models. For the steps that do not use web search, we also require zero data retention. The four assistants' own questions use their built-in web search, and for those no zero-retention route is available, so a provider may keep a request for a limited period under its own terms. Search queries are sent to Serper under its own terms.
5. People we research
If your name appears in a diagnostic, this section is for you.
- Public information only. We look at public search results, public web pages and the answers AI assistants give about a named person. We do not access private accounts or non-public records.
- A client chooses who is researched. Candidates are suggested from the client's own website and from public search, and an automated check vets each one. Only people the client confirms are researched. The limit is five people per diagnostic.
- What we do with it. The findings (what was found, quotes and links, and any different people who share your name) are stored in the client's report. The report is seen by that client, by the partner who serves that client (section 8) and by our team. It is not published.
- What the findings can include. Public sources can include allegations, complaints or legal proceedings about a person. If a source says it, the report reports that the source said it. It is not our finding that it is true.
- We do not contact you. We do not currently notify researched people.
- What you can ask. You can ask us to show you what we hold about you, to correct it, to stop using it or to delete it. Write to [email protected] with your name, the company you think is involved and what you want. We may need to confirm who you are. We will review your request, answer it within the time the law gives us, and where the law requires, or where we agree it is right, correct, stop using or delete the data. Some records cannot be removed (section 11).
- Why we may do this. We rely on our legitimate interests, and our client's, in understanding public reputation, balanced against your rights. You can object to this (section 13).
6. Our legal bases
We use your personal data only where the law allows. The table uses the language of the data protection laws that may apply to us and to you: Bahrain Personal Data Protection Law (Law No. 30 of 2018), Mauritius Data Protection Act 2017, South Africa's Protection of Personal Information Act (POPIA), the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies, the EU and UK GDPR.
| Basis | When we rely on it | Examples |
|---|---|---|
| Contract, or steps you ask for before a contract | Where we need the data to do what you asked or agreed | Reviewing your application, setting up your account, running a diagnostic, taking payment, paying a partner's commission |
| Legitimate interests | Where we have a good reason that does not override your rights | Keeping the platform secure, stopping abuse, keeping records, researching public information about people named in a diagnostic (section 5), improving the service |
| Legal obligation | Where the law requires it | Financial and tax records, replying to lawful requests from authorities |
| Consent | Only where we ask you for it, and you may withdraw it at any time | Anything optional we ask you to agree to |
Under the GDPR these are Article 6(1)(b), (f), (c) and (a). Under POPIA and the other laws above, the equivalent grounds apply.
7. Who we share data with
We do not sell personal data and we do not use it for advertising.
- Partners. See section 8.
- Service providers (processors) who help us run the platform. They may use your data only to provide their service to us.
| Provider | What it does for us | Personal data involved |
|---|---|---|
| DigitalOcean | Hosts our server, managed PostgreSQL database and managed Redis cache, in Frankfurt, Germany | All platform data |
| Cloudflare | Network protection and delivery; the bot check (Turnstile); file storage (R2); basic cookie-free traffic statistics | Visitor IP address and browser details; stored report PDFs and files |
| Postmark | Sends our email | Recipient name and email address; the content of the email |
| Telegram | Delivers internal alerts to our team | Applicant and client names, emails, brand names and short excerpts of messages |
| Tap Payments | Takes card payments and saved-card renewals | Name, email, amount and card details, which you enter on Tap's own page |
| Serper | Web search | Search queries |
| OpenRouter, and the AI providers it connects to (Anthropic, OpenAI, Google, Perplexity) | AI answers and analysis | Brand or person name, website, country, industry, search findings and assistants' answers |
- Authorities and advisers. We may disclose data where the law requires, to respond to lawful requests, or to protect our rights, to our professional advisers and insurers.
- A successor. If our business is sold or reorganised, the data may pass to the new owner, who must continue to protect it under this policy.
8. Partners
A partner is an independent business that introduces clients to the platform, sometimes under its own brand. A partner is not our agent. Clients contract with Signauto, not with the partner.
- If you apply on a partner's page, the partner sees your application. An application made on metaajer.io is seen by our team only.
- The partner that serves a client can see that client's record, plan and the commission earned on it, and the client's full report, including the key-people section.
- Partners cannot see the messages and files a client sends us.
- A partner holds this information for the purpose of serving its client and under its agreement with us, and is responsible for how it handles it.
9. Cookies and similar technologies
We do not use advertising, tracking or third-party analytics cookies. We set the following:
| Name | Purpose | Lifetime |
|---|---|---|
| `session` | Essential. Keeps you signed in, protects forms against forgery. Set when you sign in or open a form such as the application form. HttpOnly, and Secure on the live site | Up to 30 days |
| `mj_tz` | Remembers your time zone so booking times are right. Client portal only | 1 year |
| Browser session storage | Remembers your scroll position and a payment-waiting timer. It is cleared when the tab closes | Until the tab closes |
The public landing page sets no cookies. Cloudflare's bot check (Turnstile) may store information of its own in your browser to tell people from bots, under Cloudflare's terms. Cloudflare may also measure traffic to our public pages without cookies.
10. International transfers
We are based in Bahrain. Where your data is kept: our server, our PostgreSQL database and our Redis cache are with DigitalOcean in Frankfurt, Germany. Files are stored with Cloudflare R2: partner logos in a public bucket, and saved report PDFs and files exchanged with clients in a private bucket. We have left R2 on its default setting, which is not restricted to one jurisdiction (for example, not limited to the EU). Our other providers (section 7) operate in other countries, so personal data may be processed outside Bahrain, outside Germany and outside your country, for example when an AI assistant answers a question. Where the law requires safeguards for such transfers, we use providers that offer data protection terms, and we do not send more data than the service needs.
11. How long we keep data
An automatic job runs every day and applies these periods. It anonymises or deletes; it never touches the records listed as permanent below.
| Data | How long | What happens |
|---|---|---|
| Client accounts and what they hold | 24 months after last activity (sign-in, scan, message, payment or booking). Not while a subscription or proposal is running | Contact details, scans, key-person records, files, bookings and notifications are removed and the sign-in is closed |
| Diagnostic and scan data (findings, scores, reports, key-person records) | 24 months after the scan | The content is deleted. A short record that a scan took place stays, because it counts towards the scan allowance |
| Declined applications | 12 months after the decision | Deleted |
| Partner staff accounts | 24 months after last activity, once the partner is deactivated | Anonymised and closed |
| Financial records (payments, invoices, subscriptions) | 7 years | Anonymised (the name is removed; the amounts stay for accounting) |
| Security logs (sign-in and server access logs) | 12 months | Deleted |
| Copies of emails and alerts that could not be delivered, held on our server | 12 months | Deleted |
| Notifications shown in the client portal | 90 days | Deleted |
| The audit log, the commission ledger, signed agreement records, and messages you send us through the platform | Permanent | They are built so entries cannot be changed or deleted. They hold names, email addresses and IP addresses |
Where the law requires us to keep something longer, we keep it for as long as the law requires. Backups held by our hosting provider age out on its cycle.
12. Security
- Traffic is encrypted in transit (TLS).
- Passwords are stored only as Argon2id hashes. Set-password and reset links are stored only as SHA-256 hashes, last 72 hours and work once.
- Partner payout details, our bank details, the company signature and the references we hold for saved cards are encrypted in the database. We never receive or store your full card number, expiry date or security code: card details are entered on Tap's page.
- The database separates each partner's data from every other partner's at the database level.
- Access is limited to the people who need it. Sign-in has rate limits and bot protection, and actions are written to an audit log.
No system is perfectly secure. If a breach affects your data we will tell you and the authorities as the law requires.
13. Your rights
Depending on where you are, you may have the right to: be told what we hold about you and get a copy; have it corrected; have it deleted; restrict how we use it; object to our use of it; receive it in a portable form; withdraw consent; and ask for a person to review an automated result.
To use a right, write to [email protected]. We may need to confirm who you are before we act. We answer within the time the law gives us, and we do not normally charge. Some rights have limits: for example we cannot delete records the law requires us to keep, or the permanent records listed in section 11 (the audit log, the commission ledger, signed agreements and messages).
You can also complain to the data protection authority where you live or work. We would like the chance to put things right first.
14. Children
Metaajer is not for anyone under 18. We do not knowingly collect personal data from children. If you think we have, write to us and we will delete it.
15. Changes to this policy
When we change this policy we publish the new version with a new version number and effective date. If a change is material, we will tell account holders by email or when they next sign in.
16. Governing law and contact
This policy is governed by the laws of the Kingdom of Bahrain, without limiting any mandatory rights you have under the law where you live.
Contact for privacy, support and requests under this policy: [email protected].
Signauto Management Consultancy Co. W.L.L., CR# 188307-1, Kingdom of Bahrain. Registered office: Manama, Kingdom of Bahrain.