Privacy Policy

Goroosh Inc (Malaleem) is the data controller for personal data processed through Malaleem — the website, the web portals, the mobile and tablet apps and the payment terminals. Malaleem is a payments and communications platform: it moves money, and it carries the chat, calls and documents that go with it.

• Identity and contact — name, email address, phone number, and the portal you sign up for (customer, merchant, agency).
• Identity verification (KYC) — where the law requires it: identity document images and a selfie, checked before you can move money above the limits set for unverified accounts.
• Financial — wallet balances, transactions, payment links, invoices, card details (stored encrypted; we display only the last four digits), and the bank accounts you choose to link through Open Banking.
• Communications — messages you send through Malaleem chat and the metadata of calls (who, when, how long). Call audio and video are peer-to-peer and are not recorded or stored by us.
• AI features — when you use voice commands, the AI assistant or the note-taker, the text of your request (and, for the note-taker, the transcript you ask for) is processed to carry it out.
• Security and device — sign-in times and IP addresses, device identifiers for sign-in alerts, and whether a device is trusted.
• Location — only when you turn on a location-based feature such as safety alerts or nearby services.

• To perform our contract with you (Art. 6(1)(b)) — operating your wallet, payments, cards, invoices, chat and calls.
• To meet legal obligations (Art. 6(1)(c)) — identity verification, anti-money-laundering and counter-terrorist-financing checks, fraud prevention, tax and accounting records.
• For our legitimate interests (Art. 6(1)(f)) — keeping the platform secure, preventing abuse, and improving the service, balanced against your rights.
• With your consent (Art. 6(1)(a)) — optional cookies and marketing. You can withdraw consent at any time.

We share personal data only with processors bound by data-processing agreements and only as needed to run the service: cloud hosting, card networks and acquirers, Open Banking providers, identity-verification providers, email delivery, and AI service providers acting on our instructions. We share data with authorities where the law requires it. We never sell your data.

Malaleem serves people across regions. Where personal data leaves the European Economic Area it is protected by an adequacy decision or by the European Commission's Standard Contractual Clauses with appropriate supplementary measures.

Financial and identity-verification records are kept for the periods required by anti-money-laundering and tax law. Everything else is kept only as long as needed for the purpose it was collected for, then deleted or anonymised. Session data expires when you sign out.

You have the right to access your data, to have it rectified or erased, to restrict or object to processing, to data portability, and to withdraw consent — subject to the retention duties that apply to financial records. To exercise any of these, email privacy@malaleem.com; we respond within one month. You can also complain to your supervisory authority.

TLS for everything in transit. Sensitive fields — card numbers, bank account numbers, identity documents — are encrypted at rest with AES-256-GCM, separately from the database keys. Passwords and PINs are stored only as salted hashes. Sign-in is rate-limited, new devices trigger alerts, and two-factor authentication is available. Access is role-based: each portal sees only its own data, and every privileged action is audit-logged.

Malaleem is a payments service and is not directed at anyone under 18. We do not knowingly collect data from children.

We may update this policy. Material changes are announced in the app and by email before they take effect.