Privacy policy
Version 2026-11-07 · draft.
⚠️ This page is a draft awaiting legal review. What it says is what the app actually does today. The legal drafting (starting with Egypt's Personal Data Protection Law no. 151 of 2020) has not been reviewed by a lawyer yet, so do not rely on it in a contract.
1 · Who is responsible for what
When your company uses TASHYIDNA, your company is the controller of its staff, workers and suppliers' data, and TASHYIDNA processes it on your company's instructions. A written data processing agreement (DPA) is not ready yet.
2 · What is stored
| Category | Example | Why |
|---|---|---|
| Account identity | Name, email or WhatsApp number, role | Sign-in and permissions |
| Sessions | A session token, device and expiry | Keeping you signed in safely — deleted on sign-out or expiry |
| Two-factor | The authenticator secret and recovery codes, stored hashed (platform admin accounts) | A second layer of protection — deleted on use or when a new set is generated |
| Workers and crews | Name, certifications, hours worked | Site productivity and attendance |
| Site photos | The photo and where it was taken | Evidence of what was built, and where |
| External contacts | Owner, consultant, supplier | Correspondence and document sharing |
| Audit log | Who did what, and when | Your evidence in a dispute over money |
| Consent register | Purpose, decision, text version, timestamp | Proving consent and its withdrawal — appended to, never edited |
3 · How long
Financial records (contracts, payment certificates, purchase orders, guarantees) are kept for at least seven years after the contract ends, because deleting them takes away the contractor's evidence in a dispute or a tax audit. Short-lived access data (sessions, password resets) is deleted on expiry or use.
These periods are intended, but no job deletes against them yet. Said here rather than letting you assume otherwise.
4 · Where the data is kept
Your company's data is kept on a server in Egypt run by TASHYIDNA. Every day an encrypted backup (nobody can read it without our key) is made and stored on Google Drive, and we test that it actually restores, not just that it was taken.
5 · Your rights — and where they stand
| Right | Status |
|---|---|
| Knowing what is stored about you | ✅ The table above |
| Consent and its withdrawal | ✅ In the app: purpose, text version, timestamp. Withdrawing is as easy as granting, and needs nobody's permission |
| Exporting your data | Reports export to Excel from the app. ⛔ A full export of all company data is not in the app yet — ask us and we prepare it |
| Deletion or anonymisation | ⛔ No way in the app yet — and the decision is legal: real deletion breaks the linked financial records, and the usual answer is anonymisation |
| Correcting your data | ✅ Through your company's account administrator |
| Data processing agreement (DPA) | ⛔ No document yet |
6 · Protection
- Traffic is encrypted, and passwords are stored hashed, not readable.
- Each company's data is kept apart in every request, and that is tested.
- Everyone sees only what their role needs: the foreman and the site engineer see no prices or money.
- You can sign your account out of any device from «Security». Two-factor authentication is on for platform admin accounts.
- Backups are encrypted, and we test that they restore.
- Uploaded files are scanned before they are stored.
7 · Contact
For any question about your data, contact your company's account administrator first — they are the controller. For security matters, or to reach us directly: TASHYIDNA on WhatsApp.