Privacy Policy

Effective date: 5 June 2026 · Sentry diagnostics update effective: 25 September 2026 · Last Updated: 29 August 2026 · Applies to: The Majalis iOS & Android apps, majalis.ae, and majalis.k22hub.com

1. Who We Are

Majalis is operated by Kayan22 FZ LLC, incorporated in the Fujairah Free Zone / Creativity City, UAE. References to "we", "us", or "our" mean Kayan22 FZ LLC.

Contact: privacy@k22hub.com

2. Data We Collect

2.1 Account Data

• Email address, username, display name, profile photo, bio, cover photo
• Phone number (optional, for two-factor authentication)
• Date of birth — collected at signup for age verification and stored in your profile for the duration of your account
• Gender (optional: male, female, or prefer not to say)
• Language preference and notification settings
• OAuth tokens (Apple Sign-In, Google Sign-In) — we store only the provider ID, not your password
• Premium subscription status (set by your active subscription)

2.2 Content You Create

• Posts (text, images, video, reels, multi-image), comments, and voice notes
• Messages sent in private chats, group chats, and Majlis rooms
• Paid messages (content and metadata of paid message requests and responses)
• Live session content (video, audio, chat) — recordings are retained for up to 90 days unless explicitly saved by the broadcaster
• Live gifts sent and received during live sessions
• Majlis room content (posts and messages within private or subscriber-only Majlises)

2.3 Usage Data

• App interactions (screens viewed, features used, session duration)
• Device type, OS version, app version, language setting
• IP address (used for fraud detection and geo-compliance — not sold)
• Login history and session metadata (device, timestamp, approximate location derived from IP)
• Crash logs and performance diagnostics
• Spending limit settings you configure
• Ad consent status (personalised vs non-personalised ads preference, stored locally on device)

2.4 Payment and Transaction Data

• Coin pack purchase history (amounts, dates, pack sizes) — processed by Apple App Store or Google Play; we receive confirmation and credit coins to your account
• Majalis Premium subscription history — processed by Apple App Store or Google Play via a subscription management provider; we receive entitlement status
• Live ticket purchase history (session, price, timestamp)
• Coin transaction history (tips sent/received, DM access, profile access, Majlis access, creator support, live gifts, live credit purchases)
• Live credits balance and redemption history
• Creator wallet data: AED balance, pending earnings, total earned, total withdrawn
• Payout account ID (Payoneer account identifier provided by creators for payout processing)
• Payout request history (amount, status, timestamps) — payouts processed via Payoneer; Payoneer conducts its own identity verification
• We do not store card numbers, CVVs, bank account details, or Payoneer login credentials

2.5 Advertising Data

Majalis displays third-party advertisements to users who do not have an active Majalis Premium subscription. Premium subscribers see no advertising on any Majalis surface — this is enforced on both the mobile apps and the website.

In the mobile apps, ads are served via a third-party advertising provider:

• On iOS, we request App Tracking Transparency (ATT) permission before serving personalised ads
• On Android, we present a consent form in accordance with applicable privacy regulations
• If you grant consent, the advertising provider may collect your advertising identifier (IDFA on iOS, GAID on Android) to serve personalised ads
• If you decline consent, non-personalised ads are served and no advertising identifier is shared with the advertising provider
• You may change your ad preference at any time via Settings → Privacy → Ad Preferences

On the website (majalis.ae and majalis.k22hub.com), a non-Premium viewer may see two categories of advertising: advertising served directly by Majalis and, only with your consent, Google AdSense. Advertising served directly by Majalis includes both promoted Majalis posts and conversations (first-party content) and business or brand advertisements from third-party advertisers; the latter are clearly labelled as a business ad and may link to the advertiser's own website. All Majalis-served placements are delivered by us without Google advertising technologies, third-party advertising cookies, or your advertising identifier, and may appear regardless of your AdSense choice. Google AdSense is governed by the on-page advertising-consent banner:

• The advertising-consent banner controls Google AdSense only. If you decline before AdSense has loaded, the AdSense script is not loaded and no AdSense ad is requested. If you accept, AdSense is loaded to serve ads. If you later change your choice to decline (on the Cookies or Privacy Choices page) after AdSense has loaded, we immediately stop serving and hide ads and make no further ad requests; the AdSense script itself is removed from the page on your next navigation.
• When AdSense is loaded, Google may set and read cookies or similar identifiers in your browser and may process your IP address and ad-interaction data to serve, cap, and measure ads, in line with your consent choice.
• Authenticated Premium subscribers are never served website advertising: the AdSense script is not loaded for them, and any advertising loaded before sign-in is stopped and hidden.
• You can review or change your website advertising choice at any time on the Cookies and Privacy Choices pages, or by clearing your browser storage for the site.
• Google's data practices are governed by Google's Privacy Policy; how Google uses data from sites that use its advertising services is described at policies.google.com/technologies/partner-sites.

2.6 Website Data & Browser Storage

When you use the Majalis website (majalis.ae or majalis.k22hub.com), we — and, only with your consent, Google AdSense — store a small amount of data in your browser (via localStorage / sessionStorage, IndexedDB for short-lived coordination, and, for advertising, cookies) to make the site work. We do not set our own advertising or cross-site tracking cookies.

• Authentication — your signed-in session token and a reference to your last signed-in account, so you stay logged in and can switch accounts safely. Cleared when you sign out.
• Advertising consent — your accept/decline choice on the advertising-consent banner, so we do not ask again on every visit and so we can honour it.
• Preferences — lightweight interface preferences such as language, text direction, and light/dark theme.
• Onboarding draft — if you begin creating an account, your in-progress onboarding entries (which may include username, display name, date of birth, gender, and language and interest selections) are saved in your browser so you can resume where you left off. This draft is cleared when onboarding completes.
• Creator referral attribution — when you open a creator referral link, we temporarily store the opaque referral code, an anonymous handoff identifier, a short-lived IndexedDB browser coordination lock, a one-time session reload marker used only to recover the attribution worker after a failed download, and (after sign-in) an initiating-account reference so the first referral can be attributed through signup and onboarding without mixing accounts. Client-supplied campaign query values are discarded. After completion, a minimal consumed-code marker may remain to prevent duplicate attribution from browser history; referral state is cleared when you sign out or switch accounts, or when you clear browser storage.
• Advertising (only if you accept Google AdSense) — Google AdSense may store its own cookies or identifiers to serve and measure ads, as described in 2.5. We do not request AdSense for a Premium subscriber or before you accept. If you accepted AdSense before signing in or upgrading to Premium, Google may already have stored cookies or identifiers; when you become Premium we immediately stop serving and hide ads and make no further ad requests, and the AdSense script itself is removed from the page on your next navigation, but any data Google already stored persists until you clear it via your browser or Google's Ad Settings.

We do not use browser storage to track you across other websites. You can clear this data at any time through your browser settings; doing so signs you out and resets your advertising-consent choice.

3. How We Use Your Data

• Service delivery: to provide, personalise, and improve the Majalis apps and website
• Safety & moderation: to detect abuse, spam, and policy violations
• Payments: to process subscriptions, coin purchases, live tickets, and creator payouts
• Advertising: to serve advertising to non-premium users; the advertising that depends on your consent is in-app advertising-identifier processing (IDFA/GAID) and website Google AdSense, whereas advertising Majalis serves directly — both first-party promoted placements and business or brand campaigns — does not depend on that consent and uses no advertising identifiers or Google advertising technologies
• Communications: to send transactional emails (receipts, security alerts) — no marketing without consent
• Legal compliance: to meet obligations under UAE Federal PDPL and applicable international laws

4. Legal Basis for Processing

Under the UAE Federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL") and, where applicable, the EU General Data Protection Regulation (GDPR) for users in the European Economic Area, we process your data on the following bases:

• Contract performance: to deliver the service you signed up for
• Legitimate interests: fraud prevention, security, service improvement
• Legal obligation: compliance with UAE and applicable international law
• Consent: advertising identifiers (ATT/consent form), contacts access, marketing emails

5. Data Sharing and Processors

We do not sell your personal data. We share data only with the following categories of processors under data processing agreements:

• Cloud database and backend services provider — database, authentication, storage, and serverless functions
• Cloud infrastructure provider — live streaming, content delivery, and file storage
• Push-notification delivery provider — delivery of in-app and push notifications
• Subscription management provider — entitlement management for Majalis Premium; receives purchase receipts from Apple/Google to verify and grant entitlements
• Sentry (United States) — pseudonymous crash and performance diagnostics, effective 25 September 2026. Majalis disables default personal-data collection, removes request credentials, request/navigation/signed-media URL paths, and all request headers, and configures Sentry not to retain IP addresses. Generated JavaScript asset filenames are retained only for private source-map symbolication.
• Apple App Store / Google Play (geographically distributed) — in-app purchase processing for coin packs and Premium subscriptions
• Third-party advertising provider — in-app ad serving to non-premium users, subject to your consent choice
• Google (Google AdSense) — website advertising on majalis.ae and majalis.k22hub.com; loaded only after you accept the on-page advertising-consent banner and only for non-Premium viewers
• Payoneer — creator payout processing; receives creator payout account ID and payout amounts; Payoneer conducts its own KYC/identity verification
• Legal authorities — when required by valid legal process under UAE or applicable law

6. Data Retention

• Active account data: retained while your account is active
• Deleted account data: purged within 30 days of deletion request (except where legally required to retain)
• Financial records (purchases, payouts, coin transactions): retained for up to 7 years as required by UAE commercial law
• Moderation logs: retained for up to 2 years to support appeals
• Live recordings: retained for up to 90 days unless explicitly saved by the broadcaster

7. Your Rights

Under the UAE Federal PDPL and, where applicable, GDPR, you have the right to:

• Access a copy of your personal data — email privacy@k22hub.com
• Rectify inaccurate data — update in-app under Settings → Profile
• Delete your account and data — see Delete Account or Delete My Data
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests
• Portability — request a machine-readable export of your data by emailing privacy@k22hub.com
• Withdraw consent for advertising identifiers at any time via Settings → Privacy → Ad Preferences (in-app)
• Manage website advertising and browser storage — accept or decline on the advertising-consent banner, review the Cookies and Privacy Choices pages, or clear your browser storage for the site

Response time: within 30 days of receiving your request.

8. Children's Privacy

Majalis is rated 17+ on the Apple App Store and Google Play. You must be at least 17 years old to use Majalis and at least 18 years old to become a creator and receive payouts. We collect date of birth at signup and enforce this age gate. If you believe a minor has provided us data, contact privacy@k22hub.com and we will delete it promptly.

9. Security

• All data in transit is encrypted via TLS 1.2+
• Data at rest is encrypted
• Voice notes and messages are transmitted over TLS and stored encrypted at rest. They may be accessed by our moderation team in response to user reports or valid legal requests.
• Access to production systems is restricted to authorised personnel with multi-factor authentication

10. Cross-Border Transfers

Data is processed on cloud infrastructure located outside the UAE. Some processors are located outside the UAE, including in other jurisdictions. International transfers rely on appropriate safeguards under the UAE Federal PDPL.

11. Changes to This Policy

We will notify you of material changes at least 30 days before the effective date — via in-app notification and/or by posting the updated policy on majalis.ae and majalis.k22hub.com with a revised "Last Updated" date, so website-only users are notified as well. Continued use after the effective date constitutes acceptance.

The Sentry diagnostics update was posted on 26 August 2026 and remains disabled until its 25 September 2026 effective date.

12. Contact

Kayan22 FZ LLC · Fujairah Free Zone / Creativity City, UAE
privacy@k22hub.com · legal@k22hub.com