Legal
Data Processing Addendum
This describes how Mahad OCR processes personal data on your behalf. It is provided for transparency and is not a substitute for legal advice.
Roles
You are the controller of the documents you submit. Mahad Information Technology acts as processor, processing them only to provide the service and following your instructions given through the product.
Subject matter and duration
Processing lasts for as long as your account holds the data. Deleting a document or closing your account ends processing for that data.
Categories of data
Identity document data (names, document numbers, dates of birth, nationality, expiry dates), CV data, and financial document data — whatever is contained in the documents you choose to upload.
Sub-processors
Google (Gemini AI) and OpenAI for reading documents; DeepSeek for structuring text CVs and improving CV wording; Cloudflare for network protection in front of the service; the hosting provider of the servers running the service (located in India). On-server engines (MRZ, Tesseract) involve no sub-processor.
Model training
Your documents are not used to train or improve models unless you agree to it in writing. Deleting a document also deletes any training copy of it.
Security measures
Tenant isolation, hashed API keys, hashed passwords, a database backup before every deployment, restricted platform-staff access, and a hash-chained audit log. See the Security page.
Your rights as controller
You can export your data, request deletion, and ask for details of processing. Requests are handled through the contacts on the Data Deletion page.
Not yet certified
We do not hold ISO 27001, SOC 2 or any equivalent third-party certification, and we do not claim certified GDPR compliance. We describe what we actually do so you can make your own assessment.
Operated by Mahad Information Technology. Last updated 2026-10-01.