Privacy, terms and security
Last updated: October 15, 2026
Please note: This page is a plain-language summary of how maham+ handles privacy, terms and security. For an enterprise agreement or data-processing terms, contact hello@mahamplus.com.
This page is also published in Arabic. If the two versions differ, the English text prevails.
Who we are
maham+ is provided by Maham Plus Limited, registered under number MC 15155, with its registered address at Masdar City, Abu Dhabi, UAE.
On this page, “we”, “us” and “our” mean Maham Plus Limited.
Privacy
This section explains what information we collect on this website and in the maham+ service, why we collect it, and what we do not do with it.
On this website
- No tracking. This website uses no analytics, no advertising and no tracking cookies.
- One cookie. If you use the language link, we set a cookie named
maham_langthat remembers whether you prefer Arabic or English. It holds nothing else and expires after one year. - No third parties. Everything on this website, including its fonts, is served from our own server. Your browser does not contact any other service while you read it.
- The contact form. When you send it, we receive by email your name, work email, organization and message, plus the reason you chose, the plan you asked about (if any), the page you came from, your browser's user-agent and your IP address. We also keep a copy in a private file on our server, with the page language and your IP address, so that no message is lost. To stop abuse, we count messages per IP address for one hour, and if a message is discarded as spam we log only the reason and the IP address. We use this only to reply to you and deal with your request, and you can ask us to delete it.
In the maham+ service
- Account information: name, email address, organization and role, and a phone number and profile picture if you add them.
- Workspace content: the projects, tasks, charters, documents, comments and other records your organization creates.
- Security and operational records: sign-in attempts, the audit log of recorded actions with the IP address they came from, and error logs.
- Support tickets: the tickets you raise from Help & Support, the browser details attached to them, and our replies.
We use this information only to provide, secure and support the service for your organization.
The maham+ service currently uses Google Analytics to measure how its pages are used, and loads some interface libraries and fonts from public content-delivery networks. When you use the service, your browser therefore contacts those providers, which receive your IP address and browser details and, for Google Analytics, the pages you visit.
AI features
AI features stay off until your organization connects its own AI provider. When they are on, the text you ask about is sent to that provider under your organization's agreement with it. maham+ has no AI provider of its own.
What we do not do
- We do not sell your information.
- We do not use your information for advertising.
- We do not train AI models on your content.
Where your data is stored
The cloud service runs on servers operated by in the process of migrating to UAE Data Centers. Self-hosted maham+ runs on your own infrastructure, and we have no access to your data on it unless you give it to us. If your users' browsers can reach the internet, its pages also load the Google Analytics tag and the interface libraries described above.
Your rights
You can ask us for a copy of your information, ask us to correct it, or ask us to delete it, by emailing hello@mahamplus.com. We confirm who you are before we act on a request.
On plans that include backup, your organization's administrators can also export its data themselves.
Terms of service
These terms apply when you use maham+. By creating an account or using the service, you accept them for yourself and for the organization you use it for. If your organization has signed a separate agreement with us, that agreement takes precedence.
The service
We provide maham+ as described on this website, within the limits of your plan, and we give you reasonable notice of significant changes.
Acceptable use
Do not misuse the service, try to get around its security controls, share sign-in details, or use maham+ for anything unlawful. Your organization is responsible for the content it puts into maham+ and for the people it gives access to.
Plans and billing
Cloud plans are billed monthly or yearly at the prices on our Pricing page; paying yearly saves up to 17%. Changes of plan and cancellations are requested in Settings → Billing and take effect once our team confirms them. Refunds of prepaid periods: of prepaid periods, prorated for the unused portion, within 30 days of cancellation. Self-hosted maham+ is priced per organization, on terms agreed in writing.
Cancellation and your data
You can ask to cancel in Settings → Billing. Your data after cancellation: deleted within 30 days of cancellation, with a 30-day export window. We may suspend or end the service for a serious breach of these terms, with reasonable notice.
Liability
To the extent the law allows, our total liability under these terms is limited to Limited to the amount paid in the 12 months before the claim, or $10,000, whichever is lower.
Governing law
These terms are governed by UAE. Any dispute is settled by Courts of Abu Dhabi, UAE.
Changes to this page
When we change this page, we update the date at the top.
Security
How the maham+ service protects your organization's information.
Encryption
Connections to maham+ use TLS. Passwords are stored as bcrypt hashes. API secrets, email-server passwords and AI keys are encrypted in the database, and backup exports are encrypted with AES‑256.
Sign-in
Every sign-in with a maham+ password also needs a one-time code sent by email. Organizations can instead sign in through Active Directory / LDAP, or through single sign-on with Microsoft Entra ID or an OpenID Connect provider such as ADFS. Repeated failed sign-ins lock the account, and idle sessions time out.
APIs
The integration API requires an API key and an HMAC‑SHA256 signature on every request, with scopes, an IP allow-list and a rate limit for each key. The mobile app and SCIM provisioning use tokens that can be revoked at any time.
Separation between organizations
Queries are scoped to your organization through a shared data-access layer, and a check in our build flags any new unscoped query on core tables.
Audit log
The audit log records who did what, when, and from which IP address. Task history and lifecycle corrections keep the old and the new values.
Reporting a security issue
If you believe you have found a security issue, email hello@mahamplus.com with the details. Please give us a chance to fix it before you share it with anyone else.