Privacy Policy

[Your Company/Legal Name] ("Company") operates the Service and hosts the data on behalf of each compound. Each compound's administrator decides what resident, visitor, and staff information to enter and is responsible for having the right to collect it — in most data protection frameworks, the compound is the "controller" of that data and Company is the "processor" providing the software it's stored in. If you're a resident with a question about your data, your compound administrator is usually the right first point of contact; Company can also be reached directly at yassin.ismail2005@gmail.com.

Only what the Service's features need to function:

• Account: name, email, hashed password (never stored in plain text), role, and your language and theme choice.
• Resident profile: unit, phone number, owner/tenant status, move-in date, emergency contact name and phone, and names/relationship of any dependents you add.
• Technician profile: phone number, maintenance specialties, and an optional photo.
• Maintenance requests and complaints: description, category, status history, comments, and any photos, voice notes, or short videos you attach (a voice note or video can contain voices and images of people nearby).
• Facility bookings: which facility, and when.
• Visitor records: visitor name, phone, vehicle info, and expected arrival/departure, entered by the resident inviting them.
• Vehicle registry: plate number, make, model, color, and the unit/owner it's linked to.
• Staff directory and incident reports: on-site staff (guards, cleaners, management) are not Service accounts — administrators maintain their name, role, and contact info, and log security incidents against them.
• Dues/charges records: amount, type, and status of fees owed. The Service never collects payment card or bank account data. Where a compound enables online payment, you enter card details on the payment page of PayTabs, not in the Service.
• Documents: compound-wide files an administrator uploads (bylaws, notices, contracts).
• Notifications: in-app notifications, and, if you allow it, a browser push subscription. Technicians' phone numbers are used to send WhatsApp job alerts (see Section 4).
• Audit and technical logs: who did what and when, for security and troubleshooting; basic technical error reports (see Section 5).

Solely to operate the features above for your compound: routing and tracking maintenance/complaints, confirming facility bookings, checking in visitors, sending notifications and emails, maintaining the staff/incident log, and keeping a dues record. We do not use your data for advertising, and we do not sell it. What people type themselves (descriptions, comments) is shown as written and is not translated or analysed by us.

Data stays within your compound — residents, technicians, and administrators only see what their role and compound permit; every read and write is scoped to the compound it belongs to. Beyond that, the following providers process data on our behalf, strictly to run the Service:

• Supabase — database hosting and file storage for uploaded photos, voice notes, videos, and documents.
• Vercel — application hosting.
• Sentry — error monitoring, so we can detect and fix bugs; this captures technical error context (e.g. which request failed and why), not your maintenance/complaint content.
• Resend — sending account and notification emails (your name, email address, and the email's content).
• Meta (WhatsApp Business) — if your compound connects its own WhatsApp Business account, a technician's phone number and a short job alert (request number, problem type, and a link) are sent through that account. Meta's own terms and privacy policy apply to messages sent through WhatsApp.
• PayTabs — only if your compound enables online payment; PayTabs receives the payment details you enter on its page. We do not receive card details.
• Browser push services (provided by your browser or phone maker) — deliver push notifications if you turn them on.

We do not share data with any other third party, and never for marketing purposes.

Passwords are hashed, never stored or logged in plain text. Every database query is scoped to the requesting user's compound, so one compound's data isn't reachable from another, and database-level access rules block direct outside access to the tables. Payment and WhatsApp credentials that a compound provides are stored encrypted. Uploaded files are private by default and only served back through an authenticated route that checks you're allowed to see that specific file. All traffic is encrypted in transit (HTTPS).

We keep data for as long as your compound's account is active. Finished requests, complaints, and charges move to an archive view and are kept; we do not currently delete them automatically, and attached photos, voice notes, and videos are kept until the record is deleted. When an administrator removes a resident or technician who has no activity history, their account is deleted outright; if they have history tied to real work (past requests, bookings, jobs), we deactivate the account and detach them from anything pending, while keeping the historical record intact for the compound's own records. On full account termination, see the data-export and deletion terms in our Terms of Service.

Dependents (which may include children) are entered by a parent or guardian resident on their own behalf, not collected directly from a child. We don't knowingly collect data directly from children.

We may update this policy as the Service changes. Material changes will be communicated to administrators by a reasonable method (e.g. in-app notice or email).

Questions or requests about your data can be sent to yassin.ismail2005@gmail.com.