Privacy Policy
Product: SanadiqCloud
Effective date: 14 August 2026
Status: Pre-production draft based on the implemented application. This is not a claim of GDPR, PDPL, or other regulatory certification.
This Policy explains how SanadiqCloud (operated by Thamar Labs) processes personal data when you use the app and APIs. For organization-owned business records (your customers, suppliers, stock), we act as a processor / service provider. For accounts, billing, and platform operations, we act as a controller. See the DPA.
Contact: support@sanadiqcloud.com.
1. Who this Policy covers
- People who create a SanadiqCloud account (email/password or Google).
- People invited into an organization.
- Payers who complete Stripe Checkout.
- People whose data an organization stores in the workspace (sales customers, suppliers, staff names in audit logs). That data is entered by the organization, not collected by us from those individuals directly.
2. Data we collect (platform)
| Category | What | Why | Where |
|---|---|---|---|
| Account | Email, first name, last name, password hash (local accounts), Google provider flag, optional phone, profile image URL | Create and authenticate the account | auth-service PostgreSQL |
| Google Sign-In | Google ID token claims (email, name, picture URL on first Google signup) | Sign-in | Auth service; token verified against configured Google client IDs |
| Sessions | Refresh-token hash, expiry, IP address, user agent | Keep you signed in; security | sessions table; access JWT blacklist in Redis until token expiry |
| Verification | Hashed email/phone/password-reset codes, destination email or phone | Verify email, reset password, optional SMS OTP | verification_codes; short TTL (email/reset ~15 min, phone ~10 min) |
| Organization | Name, slug, description, website, logo URL, owner, membership, invitation email + hashed token | Provide the workspace | tenant-service |
| Billing | Subscription quantities, amounts, Stripe customer/subscription/payment ids, invoices, checkout intents, welcome-trial claims | Charge for the Service | billing-service; card numbers are not stored by SanadiqCloud |
| Devices | FCM token, device id, type, name, app version | Push notifications | notification-service |
| Notifications | In-app notification title/body, optional expiry | Product messages | PostgreSQL; email via SES; SMS via SNS |
| Support | Case subject, description, messages, attachment media ids | Support | support-service |
| Audit | Actor user id/email/role, IP, user agent, entity/action, optional old/new JSON | Security and accountability | audit-service (uncached) |
| Media | File name, path, size, MIME type, URLs, tenant id | Store uploads | PostgreSQL metadata + AWS S3 objects |
| Technical | Application logs in the hosting environment | Operate and debug | Hosting environment |
| Device prefs | Theme, locale, a stable FCM device id | UX | Flutter local storage / secure storage for tokens |
Not implemented (we do not claim these): first-party marketing cookies, cookie consent banner, Google Analytics, Mixpanel, Sentry, Crashlytics, Firebase Analytics, or similar product-analytics SDKs. Auth uses JWT headers, not browser cookies. CloudFront for the web app is configured not to forward cookies.
3. Organization workspace data
Organizations may store product catalogs, inventory, warehouses, suppliers (including contact email/phone/address), sales customers (name, email, phone, tax id, billing address, notes), sales and invoices, and media. That is customer content. We process it to provide the Service under the organization’s instructions.
4. Sources
- You (registration, profile, checkout).
- Google, if you use Google Sign-In.
- Stripe, for payment status webhooks.
- Your organization administrators (invites, roles).
- Automated logs (IP, user agent) when you call the API.
5. Purposes
Provide the Service; authenticate; bill; send transactional email/SMS/push; support; security; audit; enforce Terms; store media.
We do not operate a documented advertising profile.
6. Sharing / subprocessors
We share data with operators needed to run SanadiqCloud:
| Party | Role | Personal data involved |
|---|---|---|
| Stripe | Payments, Checkout, subscriptions | Customer/subscription/payment identifiers, amounts, payer details you enter on Checkout |
| Amazon Web Services | Hosting (e.g. RDS Postgres, ElastiCache Redis, S3, SES email, SNS SMS, EKS/CloudFront in AWS deployments) | Account, workspace, media, mail, SMS, logs as applicable |
| Sign-In (Identity Platform / OAuth) | ID token / profile claims you authorize | |
Firebase / FCM (Google Cloud project sanadiq-cloud) |
Push notifications | Device tokens and notification payloads |
| In-cluster Redis and RabbitMQ | Cache, rate limits, JWT blacklist, domain events | Operational data, not a second CRM |
We do not sell personal data.
7. International processing
Production AWS for this product is documented in us-east-1. Stripe and Google are global providers. If you are outside the United States, your data may be processed in the United States and other locations those providers use. A specific transfer mechanism (e.g. SCCs) is not implemented as a product feature and must be confirmed for the DPA.
8. Retention
| Data | Coded retention |
|---|---|
| Access JWT | Minutes (ACCESS_TOKEN_EXPIRE_MINUTES, default 15) |
| Refresh session | Days (REFRESH_TOKEN_EXPIRE_DAYS, default 7); cleared on logout/password change/self-delete |
| Email/reset OTP | ~15 minutes |
| Phone OTP | ~10 minutes |
| Invitations | Expiry days (INVITATION_EXPIRY_DAYS, default 7) |
| RDS backups (AWS) | Terraform backup_retention_period 7 days |
| Audit logs | 30 days (RETENTION_AUDIT_DAYS=30); auto-purged after 30 days |
| In-app notifications | 30 days (NOTIFICATION_TTL_DAYS=30); auto-expired after 30 days |
| Soft-deleted rows (Category B: warehouse, inventory, inventory_item, product, product_item) | ~30 days (PURGE_SOFT_DELETED_DAYS=30); hard-purged after 30 days (planned automation) |
| Account, tenant, sales, media, support, billing rows | No automated purge. Soft-delete leaves rows in place unless operator purges manually |
| Welcome-trial claims | Kept after organization delete (so welcome cannot be reused) |
There is no “download my data” / DSAR export API. Audit CSV export in the app exports currently loaded audit rows, not a full personal-data package.
9. Security
Passwords are stored as salted hashes with an application pepper — not plaintext. Tenant APIs are scoped by tenant id. Media delete removes the S3 object when the media-service delete path runs. This Policy does not assert that the system is “fully secure.”
10. Your choices
- Access/correct profile fields in the app.
- Deactivate or delete (soft-deactivate) the account in Profile (step-up password or Google re-auth).
- Unregister push tokens on logout (client). Notification rows and FCM tokens are not fully wiped by
UserDeletedEventtoday. - Organization owners can remove members and deactivate the organization (soft).
- Email
support@sanadiqcloud.comfor access, correction, or deletion requests that the UI cannot complete. Fulfillment may be manual until a hard-erase process exists.
11. Children
The Service is B2B and not directed at children.
12. Changes
We will update this Policy when collection or subprocessors change. The effective date will change.
13. Contact
support@sanadiqcloud.com. Operator: Thamar Labs, https://www.thamarlabs.com.
Still required before live payments: named controller legal entity and address; retention/purge schedule; DSAR process owner; transfer safeguards; counsel review.