Privacy Policy

This policy explains how we handle data in AqarBooks, including the mobile app. The details differ depending on what you use:

• Your account: for the mobile app, your organisation issues your account and there is no public sign-up. We use your email address, phone number, user ID, and name to sign you in and link you to your organisation and units. Web account data is described below.
• Organisation and ledger data: data you or your organisation enter about units, journal entries, and operational records. We process it to provide the service, while your organisation controls who is authorised to access it.

• Account and sign-in data: name, email, phone number, user ID, organisation name, country, currency, sign-in timestamp, IP address, and browser type, for sign-in, security, and audit purposes.
• Unit financial data: dues, payments, and receipts for your units, so you can view and track them.
• Content you create: maintenance requests with titles, descriptions, and updates, plus optional JPG, JPEG, PNG, WEBP, or PDF attachments; visitor names, phone numbers, notes, and the passes issued to them, including their QR codes; and vehicle details including plate number, country, region, make, model, colour, year, and notes.
• Operational records: collections, work-order updates, gate access decisions (allow or deny) and their times, plus gate device, installation, and client scan identifiers, including action logs needed for security and audit.
• Camera: used only to scan visitor pass codes and, when you choose, to capture maintenance evidence photos; it is not used for background capture.
• Payment data: when you initiate a requested payment, we send your email, phone number, amount, and transaction and reference data to Fawry to process it. AqarBooks does not collect card numbers or bank-account credentials.
• Secure on-device storage: saved visitor passes, gate credentials, and the biometric-unlock preference are kept in secure storage on the device. Biometric verification is performed by the device operating system; AqarBooks does not receive or store biometric templates.
• AqarBooks team access: our team does not inspect your ledgers or the content you or your organisation enter unless your organisation requests technical support that requires it. Inside your organisation, authorised staff keep role-governed access to that data.

• To run the platform and app and give you access to your account and units.
• To secure your account and trusted devices and detect unauthorised access attempts.
• To allow your organisation and authorised teams to carry out collections, maintenance, and gate operations.
• To maintain a sound accounting and operational audit trail, which is a requirement rather than an optional feature.
• To send operational email (email confirmation, password reset, billing notices).
• We do not use the mobile app for analytics, behavioural tracking, or advertising; data is used only to operate and secure requested functions.

We do not collect location or contacts, show ads, use analytics or tracking, or sell your data. The camera is not used for background capture. We share data only with the service providers listed below when needed to operate functions you request.

Each entity's data is isolated inside the database itself using Row-Level Security policies at the PostgreSQL level, not merely by filtering in application code.

That means even if an application bug occurs, the database itself refuses to hand one entity's data to another.

We use a small set of technical providers, each with a defined role:

• Supabase: data hosting and authentication; data is transmitted over HTTPS/TLS, with access governed by role permissions and Row-Level Security within your organisation.
• Cloudflare: application hosting, content delivery, and attack protection.
• Resend: sending operational email (confirmation, password reset).
• Fawry: when you initiate a requested payment, Fawry receives your email, phone number, amount, and transaction and reference data to process it. We do not send card or bank-account credentials, and this information is not used for marketing.

Your data is visible to your organisation's authorised staff as needed to provide the service. Technical providers access data only as needed to perform their role, are contractually bound to protect it, and we do not share data with third parties for marketing.

Data is hosted by Supabase on cloud infrastructure that may be located outside your country and is transmitted using HTTPS/TLS. Where data crosses borders we rely on appropriate contractual safeguards with our providers. Trusted gate-device credentials are kept in the device's secure storage and cannot be restored onto another device.

We keep your data while your account is active and then handle it according to the service lifecycle and applicable obligations. It may be removed from operational systems after it is no longer needed, subject to orderly export or closure requirements.

This includes an important exception: financial and audit records and posted journal entries may need to be retained for the period and to the extent required by the organisation's legal, accounting, or tax obligations.

You have the right to:

• Request a copy of your personal data.
• Correct anything inaccurate.
• Request deletion, within what the law allows.
• Object to or restrict certain processing.
• Export your data in a readable format.

To exercise any of these, contact your organisation or email support@aqarbooks.com.

• Encryption in transit (TLS) and at rest.
• Passwords are stored hashed, never in plain text.
• Database-level RLS isolation between all entities.
• An immutable audit trail for every sensitive financial action.
• Two-factor authentication support (TOTP) for web services where available.
• Trusted gate-device credentials are kept in the device's secure storage.

We use strictly necessary cookies only: the session cookie that keeps you signed in, and your language preference. No advertising cookies and no third-party tracking.

The platform is intended for professional and business use and is not designed for anyone under 18. If we find an account was opened by a minor, we will close it.

Any privacy question, or to exercise your rights: contact your organisation or email support@aqarbooks.com.