سياسة الخصوصيةPrivacy Policy

Who we are

Awraqi ("we") is a service operated by [Company / licence-holder name], address [العنوان / Address]. For anything about your data: [بريد الدعم / support e-mail].

What data we collect

• Account data: name, email, password (stored only as an irreversible hash), language.
• Family data: names of family members and relation, the type of each document, its expiry date and your notes.
• Scanned files: the images and PDFs you upload. They can contain sensitive data (ID, passport, residence, children's data). We do not ask for or store document numbers as fields, but if they appear inside an image they are part of that file.
• Payment data: handled by Paddle. We never see or store your card details; we only receive the subscription status.
• Limited technical data: a hashed form of your IP address to protect accounts from guessing, and a security log of important actions (log-ins, deletions, invitations).
• Waiting list: your email or number and answers to 3 questions, with your consent.

Why we use it (legal basis)

We use your data to run the service you asked for (reminders, storage, sharing inside the family), to perform our contract with you (the subscription), to keep accounts secure, to comply with law, and, for the waiting list, with your consent. We process data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and other applicable law. We do not sell your data, use it for advertising, or use it to train AI models.

Who can see your data

• You and your family members, according to the role you give them (can edit / view only). Every family is fully separated from the others.
• Our staff: they do not open your files. They may access account data for support at your request, to protect the service, or when the law requires.
• Service providers (processors): server hosting (Hetzner, Germany/Finland), email delivery (Resend or Brevo), payments (Paddle, the merchant of record). We choose providers committed to data protection with suitable contracts.
• Authorities: only under a binding legal order.

The family calendar link (ICS) is secret: anyone holding the link can see document titles and dates (no files or numbers). You can change the link any time in Settings.

Share links: when you make a link to a file, anyone holding the link (and the password, if you set one) can open that one file until the link closes (at the time you chose, after the number of opens you chose, or when you close it). The receiver needs no account; we record only how many times it was opened and when it was last opened (no IP address). Copies made for a link (for example with a watermark) are deleted when the link closes.

Text of files: reading text from pictures happens on your phone. If you choose to save the text with a file, it is stored encrypted like the file itself so you can search it.

Where data is stored and transfers

Account data and encrypted files are stored on servers in the European Union (Germany or Finland), i.e. outside the UAE. By using the service and accepting this policy you agree to this transfer. You may keep files on your phone only without uploading them (cloud copy is optional). Copies on your phone are stored inside the browser/app on your device and protecting them (screen lock) is your responsibility.

Security

Every file is encrypted on the server with AES-256-GCM using a key specific to each family. All traffic uses HTTPS. Passwords are stored with a strong hash function (scrypt). Families are strictly separated and tests check that one family cannot read another family's data. Encryption keys are kept apart from the database. No system is 100% secure; if a breach affects your data we will notify you and the competent authorities within the legal time limits.

How long we keep data

• As long as your account is active.
• If the subscription ends: the account becomes view-and-export only and everything is deleted after 180 days, with warnings 30 and 7 days before.
• When you delete your account or family yourself: immediate deletion from the system. Backups are erased automatically within 35 days at most.
• Security log: up to 12 months. Waiting list: until you ask for deletion or 24 months.

Your rights

You may request a copy of your data (the "Export all data" button in Settings gives you a full ZIP), correct it, delete it (delete account/family in Settings), object to its processing, and withdraw consent at any time. For any other request write to [بريد الدعم / support e-mail] and we will answer within 30 days. If you believe your rights were not respected you may complain to the UAE Data Office or the competent authority.

Children and family members

The account is for adults (18+). If you add data or scans of papers of your children or anyone else, you confirm that you have the right and authority (as a guardian or with the person's consent) to do so. The service is not directed at children and we do not contact them directly.

Cookies and tracking

We use one essential cookie to keep you signed in (session). There are no advertising cookies or third-party trackers. The website visit counter records only the day, page and link source, with no cookie, IP or identity. The Paddle checkout loads when you subscribe and is governed by its own policy.

Changes

If we change this policy in a material way we will tell you by email or in the app before the change takes effect.