Privacy policy — Ione Basmah

The subscribing business (the employer) is the controller of its employees’ data: it adds them, sets their schedules and uses their attendance records. We process that data on its behalf and on its instructions to provide the service.

We are the controller of the business owners’ and managers’ account data as far as needed for the subscription, billing, support and security.

We collect only what the service needs:

• Business data: name, commercial registration and VAT numbers if entered, branches with their location and geofence.
• Admin accounts: name, mobile number and email.
• Employee data entered by the business: name, mobile number, employee number, job title, hire date, branches and schedule, and optionally the national ID / iqama number, wage and allowances (encrypted with a key specific to the business). We never store an employee’s religion.
• Attendance records: the punch time by the server clock, the branch, the location and its accuracy at the moment of punching only, device information and its integrity result, and a selfie only if the business turned it on.
• Requests (punch corrections, permissions, leave) and their attachments; violations, the employee’s answers and the decisions.
• Notifications, device identifier and push token, security logs (IP address and device type) and the audit log.
• Subscription and invoice data. Card numbers never reach us: the payment gateway processes them and we keep only an encrypted token for renewals. In-app purchases are made through Apple or Google.

• Biometric data: your fingerprint or face is verified by your phone’s own system on the device; it never leaves the device and is never stored by us. We only receive a digital signature proving the verification succeeded.
• Background location tracking: employees are never tracked. The location is read at the moment of punching and sent with the punch; when an employee opens “My location”, it is read on the phone to be shown there only and is not sent to us. When an owner sets a branch location, the point they choose is saved as the branch centre.

• Recording attendance and computing lateness, absence and overtime against the business’s schedule.
• Applying the business’s approved penalty table, its procedure and deductions within the limits of the Labour Law.
• Preventing punch fraud (fake locations, modified devices, replayed punches).
• Service notifications, subscription and billing, support and legal obligations.
• Marketing notifications only for those who opted in; consent can be withdrawn at any time in the settings.

The platform’s authorised administration team can access and modify any business’s data, including entering as the business owner, for operation, support, security and compliance. This happens without asking for prior permission; every access is recorded in an internal audit log, and changes appear in the business’s audit log as “Platform administration”. The business owner agrees to this when registering.

We do not sell personal data. We use service providers that process data on our behalf and only as needed: hosting and file storage, email, notifications (Apple, Google and Expo), the payment gateway, Tabby and Tamara, the e-invoicing provider, RevenueCat for store subscriptions, and an error-monitoring tool. We may disclose data when a competent authority lawfully requires it.

Map images in the app (“My location”, the branch editor and the radius test) are loaded from the open map provider OpenFreeMap (tiles.openfreemap.org). To show a map, the phone asks the provider for the images of the area on screen, so the provider learns an approximate area and the phone’s IP address from the request; it never receives your name, number, exact location or attendance data. When no map is opened, nothing is sent to the provider.

Data is kept with a trusted cloud hosting provider that may be outside the Kingdom of Saudi Arabia (for example, data centres in the European Union), with the safeguards the Personal Data Protection Law requires for transfers outside the Kingdom: encryption in transit and at rest, a separate encryption key per business, and contractual obligations on the provider. Some providers (such as Apple’s and Google’s notification services and error monitoring) process limited data for the same purpose.

We keep data for as long as the subscription lasts. When a subscription is cancelled, the data is kept for 90 days (configurable), during which it can be exported; personal data is then permanently deleted after notifying the business owner. Records the law requires us to keep (such as tax invoices) and the unalterable punch records and audit log remain without being linked to an identifiable person.

• Encryption of all connections (TLS), and encryption of the database and backups at the provider.
• Encryption of sensitive fields (national ID and wage) with a key specific to each business.
• Isolation of every business’s data at the database level, so no business can reach another’s data.
• Two-step verification for platform administration accounts, and an audit log that cannot be changed or deleted.

You have the right to know how your data is processed, to obtain a copy of it, to ask for its correction or deletion within what the law allows, and to withdraw consent to marketing notifications. Every user can download a copy of their data and ask to delete it in the app (More → Delete account), or ask their employer or us directly. You may also file a complaint with the Saudi Data & AI Authority (SDAIA).

For questions or privacy requests: mohammed.almalki@ionepos.net. We may update this policy and will inform business owners of any material change before it takes effect.