Last updated: 29 October 2026

This policy explains what data the Corbit server that connects AI assistants to your Corbit account (mcp.corbit.sa) handles, how it is stored, who receives it and when it is deleted. The service is operated by Corbit (Almadar Technology), Saudi Arabia.

Data we store

• API token: when you connect through the consent page, your Corbit API token is stored encrypted (AES-256-GCM), is never shown to anyone and is used only to send your requests to the Corbit gateway (api.corbit.sa).
• Access and refresh tokens: stored as SHA-256 hashes that cannot be reversed. An access token is valid for 24 hours and a refresh token for 90 days.
• Connection details: the name of the connected app (for example Claude or ChatGPT), the permissions granted, and when it was connected and last used, so you can see them on the My connections page.
• One-time codes (OTP): only a hash of the code is kept, for its validity (5 minutes by default), then deleted. The code itself is never stored or returned in any response.
• Technical logs: phone numbers are partly masked (9665****1234); logs contain no tokens and no message text.

Data we do not store

• Message text is not stored on this server. The Corbit gateway keeps an archive of send metadata (time, sender name, numbers, status) for 90 days without the message text.
• We do not sell data or share it for marketing.

Who receives your data

• The AI app you connected: receives the results of the tools it calls (such as balance, sender names, numbers and delivery reports) and processes them under its own privacy policy.
• The Corbit SMS gateway and the SMS delivery provider (third party): to deliver a message, the recipient numbers, sender name and message text are passed to Corbit's SMS platform and from there to the SMS delivery provider and the mobile network operators that carry the message. They act on your request exactly as if you had sent it with your own key, and the key's permissions set in the portal apply.
• Hosting provider: the server and its data store run on Alibaba Cloud.

Where data is stored

Data is stored on Alibaba Cloud servers in the Riyadh region, Kingdom of Saudi Arabia.

Retention

• Connection data and tokens: until you disconnect, or until the refresh token expires (90 days without use).
• One-time code hashes: until the code expires.
• Send metadata in the gateway archive: 90 days.

Your rights

Under the Saudi Personal Data Protection Law (PDPL) you may ask to be informed about the data we hold about you, to get a copy of it, to correct it, to have it deleted, and to withdraw your consent by disconnecting.

How to ask for deletion

• Immediately, yourself: disconnect an app on My connections; access stops at once and its tokens and connection data are deleted. Revoking the API token in the portal (sms.corbit.sa) stops every connection that uses it.
• By request: email info@corbit.sa from the email address registered on your Corbit account, with the subject "Data deletion request" and your account name. We confirm the request and complete it within 30 days. Data we must keep by law, such as billing records, is kept only for the period the law requires.

Changes

When this policy changes we update this page and the date above.

Contact

info@corbit.sa · 920006900 · Support