Privacy policy

About this policy

NAWA is an enterprise workspace platform provided by Fandaqah. This policy explains what personal data NAWA processes when you use the web portal, the admin console or the NAWA mobile app, why, and what choices you have.

It is written with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations in mind. For business data that an organization puts into its own workspace, that organization usually decides how the data is used (the controller), and Fandaqah processes it on the organization's behalf. For your sign-in account, Fandaqah is responsible. The final allocation of these roles is part of the pending legal review.

Your account

To sign you in we keep your email address, your name, and your password as a salted one-way hash. The password itself is never stored or logged.

If you turn on multi-factor authentication (MFA), we keep the secret for your authenticator app and your recovery codes, and use them only to check your sign-in.

For security we record sign-in events, such as successful and failed sign-ins, with the time and your IP address. We use them to protect accounts (for example, rate limits) and to investigate misuse.

We also keep which organizations you belong to and your roles there, so the server can decide what you may see.

Workspace data

Your organization's workspace holds the business records its people create, such as organization structure, members and roles, finance journals, leave requests, purchasing, customer records, support tickets and attached files. These can include personal data about employees, customers and suppliers.

Each organization's data is kept separate from every other organization's, in the database and in file storage. Access is decided on the server from your verified sign-in and membership, never from the browser.

Platform support staff cannot see workspace data by default. They can only see it if a workspace administrator approves a support request with a stated purpose, a chosen scope and a time limit of at most 8 hours. Every request made under such a grant is recorded in the workspace's audit log.

On your device

The mobile app keeps your sign-in tokens in the device's secure storage (the iOS Keychain or the Android Keystore). They are available only while the device is unlocked and are not copied to other devices or backups. The app also stores your language, appearance and app-lock settings on the device. Signing out removes the tokens.

If you turn on the app lock, Face ID, Touch ID or the fingerprint check is done by your device's operating system. NAWA never receives biometric data.

The web portal sets a session cookie that holds only a random identifier. Your session is kept on our server, encrypted, and ends after 60 minutes without activity or 12 hours at most. Other cookies remember your theme and language.

NAWA has no advertising, no third-party analytics and no cross-app tracking, in the app or on the web.

Logs and telemetry

Our services keep technical logs, traces and metrics so we can run the service, find faults and detect attacks. By default these exclude passwords, tokens, payment data and the text of AI prompts and answers, and traces record the page or API route pattern rather than the full address.

Each workspace has an append-only audit log of important actions: who did what, and when. It records identifiers, counts and status, not the text of AI conversations.

AI features

By default the AI assistant uses a local, simulated provider. Its answers are clearly labelled as simulated and nothing is sent outside NAWA.

On our test (staging) environment only, an OpenAI provider is switched on and used with test data. When it is used, NAWA sends the request to OpenAI's API in the United States: the assistant's instructions, your message, up to three notes from your own organization's AI memory, the descriptions of the tools it may use, and the results of those tools. Requests ask OpenAI not to store the response, but OpenAI may keep inputs and outputs for up to 30 days to monitor abuse.

This provider is not enabled for production. Before any real organization's data is sent to an external AI provider, a cross-border transfer assessment under the PDPL, a data processing agreement and the organization's agreement are required. NAWA does not use your data to train AI models.

Help centre answers are taken directly from published help articles and do not use an AI provider.

Payments

Subscription payments are planned through AlinmaPay's hosted payment page, where card details are entered on the payment provider's page and never reach NAWA. This integration is on hold and has only been tested in the provider's sandbox; NAWA takes no real payments today.

Service providers and transfers

We use service providers to run NAWA: hosting, a network edge that protects and encrypts traffic (Cloudflare), and an email service that sends account emails such as password resets. On the test environment the email service is Google's Gmail.

Some of these providers are outside the Kingdom of Saudi Arabia. The legal basis for each transfer under the PDPL transfer regulation is being assessed as part of the legal review.

Your rights and requests

Under the PDPL you can ask to be informed about how your data is processed, to access and get a copy of it, to correct it, and to have it destroyed when it is no longer needed. Where processing relies on your consent, you can withdraw it.

For data in an organization's workspace, contact that organization's administrator first. Administrators with the right permission can export the workspace's core data (the download link works for 5 minutes) and can file a deletion request for the workspace.

For your sign-in account, contact us using the details below. Response timelines will be confirmed after the legal review.

How long we keep data

Web sessions end after 60 minutes without activity or 12 hours at most. After a workspace deletion request, data is kept for 30 days and then permanently deleted by an operator from the database and file storage, unless a legal hold applies.

Retention periods for account data, logs and backups have not yet been set. They will be added here after the legal review.

Security

Traffic is encrypted in transit. Sign-in supports MFA, administrator access to the admin console requires it, and every request is checked on the server against your membership and permissions. We test that one organization can never read another's data.

Contact

Privacy questions and requests under the PDPL go to the privacy contact below. You can also ask your organization's administrator, or see the Support page.

If you are not satisfied with our answer, you can contact the Saudi Data and Artificial Intelligence Authority (SDAIA).

Privacy contact: [email protected]

Support

Changes to this policy

We will update this page when NAWA's processing changes, and change the date at the top.