Skip to main content
Tawfeerتوفير

Last updated: 7 November 2026

Privacy Policy

This Privacy Policy explains how Tawfeer collects, uses, shares, transfers and protects your personal data, and the rights you have under the Kingdom of Bahrain's Personal Data Protection Law (Law No. 30 of 2018).

Tawfeer is a free personal finance app at tawfeer.app. The data manager (controller) responsible for your personal data is the operator of Tawfeer (contact: support@tawfeer.app).

Tawfeer uses the information you give it, and what it works out from that information:

  • Sign-in details. You sign in with Google or Microsoft, and Tawfeer receives your name, your email address and an identifier for your account with that provider. Tawfeer does not receive or store your Google or Microsoft password.
  • Financial statements you upload: bank statements, credit card statements and other financial statements, as PDF, CSV or image files.
  • Financial records you enter or upload: accounts, balances, transactions, budgets, goals, notes, tags and attachments, and, if you give it, the country where you are a tax resident, for the tax on your dividends.
  • Your name, email address and provider identifier are needed to create and run your account. Which financial information you add is up to you.
  • What Tawfeer works out from your statements: categories, recurring payments, salaries, transfers between your own accounts, net worth, and your answers to its questions.

Tawfeer does not connect to your bank today. If we later offer an optional bank connection through a licensed open-banking provider, it will be used only with your explicit consent, and it will be described in this policy before it is offered.

We use your personal data only to:

  • create your account and sign you in;
  • store your financial information and show it back to you, including reading the text of the statements you upload;
  • send account emails, such as verification codes and confirmations;
  • give circle members or advisors access to your data, when you grant it;
  • keep Tawfeer secure and working, and answer your requests;
  • meet our legal obligations.

We do not sell your personal data. We do not show advertising, use your personal data for direct marketing or profile you for marketing.

Under the Personal Data Protection Law, we process your personal data on these grounds:

  • Performing our agreement with you: providing the Tawfeer service you sign up for under the Terms of Service.
  • Your consent, which you give when you create your account and when you turn on optional features such as sharing. You can withdraw it at any time. If you withdraw consent that Tawfeer needs to run your account, we may no longer be able to provide the service to you.
  • Complying with a legal obligation or a court order.
  • Our legitimate interests in keeping Tawfeer secure and preventing misuse, where those interests do not conflict with your fundamental rights and freedoms.

We share your personal data only with the service providers below, which process it on our behalf and only to run Tawfeer, with people you choose, or when the law requires it:

  • Hetzner Online GmbH, which operates the servers in Nuremberg, Germany, where your data is kept.
  • Microsoft Azure Document Intelligence (UAE North region), which reads every PDF or image statement, receipt and business report you upload so that Tawfeer can find the transactions in it. CSV files are read on Tawfeer's own server. Tawfeer deletes the result of each reading from Microsoft's service within 36 hours.
  • DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China), an AI service. It receives the text of every statement you upload (and, where page-image reading is on, its page images), including the names, account numbers, transactions, holdings and dividends printed on it; your question and the figures of the check in “Can I afford it?”; the text of a business report you choose to send for reading; the column headings of an investment file Tawfeer cannot read; and filtered shop names for category suggestions.
  • Google and Microsoft, for sign-in.
  • Resend, for sending account emails such as verification codes and confirmations.
  • Circle members and advisors, only when you grant them access. You can revoke that access.
  • Courts or public authorities, when the law or a court order requires it.

Tawfeer's servers and service providers are outside the Kingdom of Bahrain, so your personal data is transferred:

  • to Germany, where Hetzner stores Tawfeer's data;
  • to the United Arab Emirates, where Microsoft Azure Document Intelligence reads the PDF and image files you upload;
  • to the People's Republic of China, where DeepSeek processes what Tawfeer sends to it;
  • to the United States and other countries where Google, Microsoft and Resend process data for sign-in and account emails.

We make these transfers because they are needed for the features you use, and with the consent you give when you create your account and when you upload statements or choose an AI feature. Germany, the United Arab Emirates, the United States and the People's Republic of China are on the list of countries that Bahrain's Personal Data Protection Authority recognises as providing an adequate level of protection for personal data.

Some Tawfeer features use AI. Each sends only what it needs:

  • Every statement you upload, whether bank, card, loan or investment, is read with Microsoft Azure. Its text (and, where page-image reading is on, its page images) also goes to DeepSeek, including the names, account numbers, transactions, holdings and dividends printed on it. Choosing statements to upload is your agreement to this, as the upload screen says.
  • In “Can I afford it?”, if you allow it by ticking the box, DeepSeek reads your question, estimates a price and writes the reply; you can turn it off in Settings. It receives your question and the figures of the check. Tawfeer doesn't add your name, email or transactions. Tawfeer calculates every figure itself.
  • What AI reads from a statement is checked against the statement's own balances before it is added. DeepSeek's own privacy policy says it stores data in the People's Republic of China.
  • Your tax residence stays in Tawfeer and is never sent to Azure or DeepSeek.
  • Uploaded statement and receipt files are stored encrypted.
  • Connections to Tawfeer use HTTPS.
  • We use technical and organisational measures to protect your data against loss, misuse and unauthorised access or disclosure. No system can be guaranteed to be completely secure.
  • We keep your personal data while your account is open, and only as long as it is needed for the purposes in this policy.
  • Finance data you delete in the app is removed from your account.
  • The original file of a statement is deleted once the statement is imported, or kept 1 or 7 days from upload if you choose that in Settings > Your data. A file that is never imported is deleted after 7 days.
  • The result of each Microsoft Azure reading is deleted from Microsoft's service within 36 hours.
  • Each night we make one backup copy of the database and stored files, on the same server in Germany. We keep the 14 newest copies and delete older ones, so anything you delete is gone from backups within about two weeks.
  • When you delete your account, we delete your financial records, uploaded files and sign-in details, and clear your profile. What remains: a deletion receipt, monthly usage totals for Azure and DeepSeek with none of your content, and a one-way code of each Google or Microsoft account you've used to sign in, kept with no end date.
  • After deletion you can't create a new Tawfeer account with any Google or Microsoft account you've used to sign in to Tawfeer. To come back, use a different one.

You have the right to:

  • know whether we process your personal data, and receive a copy of it and information about how it is processed;
  • ask us to correct, block or erase personal data that is inaccurate or incomplete, or that is processed in breach of the law;
  • object to processing that causes, or is likely to cause, material or moral harm to you or to others, and to processing for direct marketing;
  • withdraw your consent at any time;
  • lodge a complaint with the Personal Data Protection Authority in the Kingdom of Bahrain.

To exercise any of these rights, write to support@tawfeer.app. We may ask you to confirm your identity, and we will reply within the period the law sets.

  • You can export your Finance data from the app.
  • You can delete your Finance data from the app.
  • You can close your account in Settings > Delete my account, or write to support@tawfeer.app.
  • Circle members and advisors see your data only when you grant them access, and you can revoke that access.

Tawfeer uses a cookie that keeps you signed in securely, and your browser's local storage to remember preferences such as language and theme. We do not use advertising or tracking cookies.

Tawfeer is not intended for children, and we do not knowingly collect their personal data. If you believe a child has given us personal data, write to support@tawfeer.app and we will delete it.

We may update this policy. Changes will be posted on this page with a new date. Where a change significantly affects how we use your personal data, we will also tell you in the app or by email where practical.

For any question about this policy or your personal data, write to support@tawfeer.app.