Privacy policy

What we collect

• Your account: your name, email, your picture if it comes from Google, Facebook or Telegram when you sign in with them, and your password if you choose one (stored as a one-way hash we can’t read).
• The numbers you save for recharging (up to five), some of which may belong to your family or others, and when they were added or removed.
• Your balance and every movement on it: deposits at merchants, recharges (number, package, amount, status, time), refunds and rewards.
• Sign-in and security data: the device you signed in from and its identifier, IP address, browser or app type, and sign-in attempts.
• If you allow notifications: your device’s notification token and your notification choices.
• For merchants: the shop’s name and account, and every transfer made and its commission.

Why we collect it

• To run the service: keep your balance, recharge the numbers you ask for, and show your statement.
• To protect your account and money: spot suspicious sign-ins, stop password guessing, and prevent reward abuse.
• To send you recharge and security notifications, and verification codes by email.
• To keep accurate financial records, as any service holding people’s money must.

Who we share it with

We don’t sell your data, show ads, or use tracking or analytics tools. We share only what the service needs:

• Reloadly, our recharge provider: the number to recharge, the package and the amount, so the credit reaches the operator.
• The merchant you deposit with: they see your name and the last digits of your phone to confirm it’s you, never your balance.
• Google, Facebook or Telegram: only if you choose to sign in with one of them.
• Firebase Cloud Messaging by Google: to deliver notifications to your device.
• The email provider we send verification codes through, and Cloudflare and the servers we rent to run Marsa.
• Authorities, where the law requires it.

How long we keep it

• Email verification codes expire after 10 minutes.
• Ended sign-in sessions are deleted after 90 days.
• If you delete your account you can restore it by signing in within 30 days. After that your numbers are released for others to save.
• Financial records are kept for as long as the law requires, even after an account is deleted.

Your rights

You can see and correct your data in the app: your name, numbers, sign-in methods, devices and notifications. You can also ask for a copy of your data, ask us to delete your account, or object to a use of it. Write to the address below and we’ll answer within 30 days. You also have the right to complain to the data protection authority in your country.

This website

marsa.company sets no cookies and doesn’t track you. It only stores your dark-mode choice in your browser. Your visit passes through Cloudflare, which sees your IP address to protect the site.

Security

Connections to Marsa are always encrypted. Passwords and verification codes are stored hashed, and sign-in locks for a while after five wrong attempts. A merchant can never take money from your balance.

Who we are and how to reach us

Marsa is responsible for your data. For any question or request: [email protected]. If we change this policy in a meaningful way, we’ll tell you in the app before it takes effect.