Privacy Policy

Employee Data (HR Module)

• Full name, national ID number
• Contact information (email, phone number)
• Employment details (position, salary, hire date)
• Emergency contact information
• Attendance and leave records

Purpose: Employment management, payroll processing, legal compliance

Driver Data

• Full name, national ID
• Phone number
• Driver's license number and expiry date
• GPS location data (during active deliveries only)

Purpose: Fleet management, delivery tracking, safety compliance

Customer & Supplier Data

• Company name, commercial registration (CR) number
• Contact person name, phone, email
• Business address and delivery location coordinates

Purpose: Order fulfillment, delivery services, business operations

User Account Data

• Email address, full name, phone number
• Role and system permissions
• Login timestamps and activity logs

Purpose: System access, authentication, security audit trails

Right to Access

You can view your personal data through your profile page or by contacting your system administrator.

Right to Rectification

You can update incorrect data through your profile settings. For historical data corrections, contact your administrator. All changes are logged with timestamps.

Right to Deletion

You can request account deletion through your administrator. Personal data is anonymized within 30 days of deletion request. Transactional data is retained for 7 years as required by Saudi law.

Right to Object

Drivers can stop location tracking at any time by clicking "Stop Tracking" in the driver portal. You can opt out of marketing communications in your settings.

Right to Data Portability

You can export your data in JSON format. Contact your administrator with a formal request, and the export will be provided within 30 days.

Access Control

LogiFlow implements Role-Based Access Control (RBAC) with five levels: Admin (full access), Manager (module-level), Operator (limited operations), Viewer (read-only), and Driver (assigned shipments only).

All database tables use Supabase Row Level Security (RLS) to enforce multi-tenant isolation. Users can only access their company's data.

Authentication

• Secure password requirements with bcrypt hashing
• Supabase Auth with HTTP-only cookies
• Session timeout after 30 minutes of inactivity
• Login attempt monitoring and brute-force protection

Data Encryption

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Encrypted database backups stored in geographically distributed locations

Monitoring & Auditing

All system access and data modifications are logged with timestamps and user information. Audit logs are retained for 12 months and reviewed regularly by security teams.