Privacy Policy

Last updated: — · A product of Storax

⚠️ Draft pending legal review. This template exists so app-store submission isn't blocked. It is not legal advice and must be reviewed and approved by qualified Saudi counsel for PDPL (and any health-data considerations given the operating context) before this page is treated as final. Bracketed placeholders need confirmation.

Who we are

AssetCommand provides property-operations software used by owners, operators, residents, and service vendors. It is a product of Storax [confirm full registered legal name + address, KSA]. This policy explains what we collect in the AssetCommand apps and how we use it. Contact / DPO: privacy@assetscommand.com.

What we collect

Account & identity: name, email, phone, role, and organization (via your sign-in provider).
Operational data you enter: maintenance requests, messages, work-order details, lease/document references, vendor bids.
Device/usage: app version, device type, diagnostic/crash logs, and (if enabled) push-notification tokens.

We do not sell personal data. We do not use it for third-party advertising.

Why we use it

To operate the service: route and resolve requests, show your lease and updates, enable vendor dispatch, secure your account, and improve reliability. Lawful bases under PDPL [confirm with counsel: contract performance, legitimate interest, consent where required].

Sharing

With your organization/operator and assigned vendors as needed to deliver the service; with infrastructure processors (hosting, authentication, crash reporting) under data-processing agreements [list processors]. Cross-border transfers handled per PDPL safeguards [confirm SCCs/BCRs + transfer risk assessment].

Data residency & retention

[Confirm KSA data residency.] We retain data while your account is active and as required by law, then delete or anonymize it [confirm retention periods].

Your rights (PDPL)

Access, correction, deletion, and objection where applicable. Contact privacy@assetscommand.com [confirm response SLAs; breach notification to SDAIA within 72 hours].

Security

Encryption in transit, role-based access control, audit logging, and multi-factor authentication on sign-in for staff roles. No method is 100% secure.

Children

AssetCommand is not directed to children under [16/18 — confirm].

Changes

We will post updates here and change the "Last updated" date above.