Privacy policy
Version 2026-09-11 · draft.
⚠️ An engineering draft awaiting legal review, and not published. What is on this page is an honest inventory of what the code actually does — pure engineering, extracted from the schema. The legal drafting and its sufficiency under GDPR and PDPL need a lawyer, and have not been reviewed. Do not rely on this page in a contract.
1 · Who processes what
When your company uses TASHYIDNA, your company is the controller of its staff, workers, and suppliers' data, and TASHYIDNA is a processor acting on its instructions. That split is what a data processing agreement (DPA) is built on — and the DPA is not ready yet.
2 · What is stored — extracted from the schema, not from memory
The inventory of tables holding personal data is generated
automatically from the database schema, and a test guards it: a
new table holding personal data without a declared purpose and retention
fails the gate. The file is
docs/DATA_PROCESSING_REGISTER.md in the repository.
| Category | Example | Purpose |
|---|---|---|
| Account identity | Name, email, role | Sign-in and permissions |
| Sessions | A session token, device, and expiry | Keeping you signed in and protecting the request — deleted on sign-out or expiry |
| Two-factor | The authenticator secret and recovery codes, stored hashed | A second layer of protection — deleted on use or when a new set is generated |
| Workers and crews | Name, certifications, hours worked | Site productivity and attendance reconciliation |
| Site photos | The photo and its coordinates where captured | Evidence of what was built, and where |
| External contacts | Owner, consultant, supplier | Correspondence and document sharing |
| Audit log | Who did what, and when | Governance and evidence in a financial dispute |
| Consent register | Purpose, decision, text version, timestamp | Proving consent and its withdrawal — appended to, never edited |
3 · Retention
Financial records (contracts, payment certificates, purchase orders, guarantees) are kept for at least seven years after the contract ends, because deleting them takes away the contractor's evidence in a dispute or a tax audit. Short-lived access data (sessions, password resets) is deleted on expiry or on use.
And the retention policy is declared but not yet enforced in the scheduler. The periods above are intended; no periodic job deletes against them today. Said here rather than assumed otherwise.
4 · Where it is hosted
The production database is on Supabase in the
eu-west-1 region (Ireland). That suits
European requirements, and may not satisfy a Saudi data
residency requirement — an open question to settle before any
contract that requires localisation.
5 · Your rights — and where they stand
| Right | Status |
|---|---|
| Knowing what is stored about you | ✅ The inventory above, generated automatically |
| Consent and its withdrawal | ✅ A register in the app: purpose, text version, timestamp. Withdrawal is as easy as granting, and needs nobody's permission |
| Exporting your data (portability) | ⛔ No route yet |
| Deletion or anonymisation | ⛔ No route yet — and the decision is legal, not engineering: real deletion breaks the integrity of the linked financial records, and the usual answer is anonymisation |
| Correcting your data | ✅ Through your company's account administrator |
| Data processing agreement (DPA) | ⛔ No document yet |
6 · Protection
- Traffic is encrypted, and passwords are stored hashed, not readable.
- Two-factor authentication is available, and required for anyone who sees money figures where the company's policy says so.
- Each company's data is scoped in every query, and it is tested.
- Backups are encrypted, and it is tested that they restore — not merely that they are taken.
- Uploaded files are scanned before they are stored.
7 · Contact
For any question about your data, contact your company's account
administrator first — they are the controller. The security disclosure
address is in SECURITY.md in the repository.