Privacy Policy

1. Who we are and what this covers

Smart ERP is a business management platform (HR, payroll, attendance, accounting, sales, POS and inventory) operated for the companies that subscribe to it. This notice describes what the platform and this website collect and store. A company that uses Smart ERP decides what it records about its own employees and customers; for that data we act on the company's behalf.

2. What we collect

• Account: company name, the administrator's name and email address, and the password (stored only as a one-way hash, never as plain text), plus subscription and billing details.
• Business data your company enters: employee records (which can include national ID, salary, bank details, phone, address and date of birth), attendance (device punches and, where your company enables it, location or photo at check-in), payroll, accounting, sales, POS, inventory, and documents you upload.
• Security and operations: sign-in events (time, outcome, IP address, browser, and a keyed hash of the name typed, never the password); rate-limiting records (IP address and request key); session records (IP address and browser); error reports with secrets removed; web server access logs (IP address and page); and an audit log of changes (who, what, when).
• WhatsApp (only if your company enables it): employees' phone numbers, the messages sent to them and their delivery status, and their replies. Messages go only to employees who opted in; replying STOP opts out.
• Electronic invoicing (only if your company enables it): the invoices and credit notes filed with the Egyptian Tax Authority, and the authority's responses.
• This website: what you send through a form (name, email, phone, message), together with your IP address for abuse prevention.

3. Analytics and usage statistics

Website visit statistics are collected only when they are switched on for this site and only after you consent. Browser "Do Not Track" and "Global Privacy Control" signals are honoured. When collected, they are daily counts (page, country, campaign) with no cookies, no identifier and no IP address stored.

Inside the app, anonymous usage statistics (how often each screen is opened per day, per company, with nothing about people) are off unless a company administrator switches them on. Switching them off deletes what was collected for that company.

4. How we use data

To provide and secure the service, support you, send account notifications, and meet legal obligations. We do not sell data and we do not use it for advertising.

5. Separation between companies

Each company's data is separated at the database level with PostgreSQL row-level security (forced, not optional): a query made for one company cannot read or write another company's rows.

6. Security and encryption: the current state

• Connections to the service use HTTPS.
• Passwords are stored only as one-way hashes.
• Integration credentials and webhook signing secrets are encrypted in the database.
• Other business data, including HR fields such as national ID, salary and bank details, is not encrypted field by field today. It is protected by access permissions, company separation and server security. Field-level encryption of the most sensitive fields is being prepared and is not yet in effect.
• Scheduled daily backups of the database and uploaded files are encrypted (AES-256) and copied off-site, encrypted, to cloud storage. The safety copy taken on the server before each software update is not encrypted; it stays on the server with restricted access.

7. Service providers

Our hosting provider (the server that runs the service), Cloudflare (domain name service and this website), Google Drive (encrypted off-site backup copies), and, only when your company enables them, Meta (WhatsApp) and the Egyptian Tax Authority (electronic invoicing).

8. How long data is kept

• Rate-limiting records: 2 days.
• Sign-in sessions and password-reset tokens: removed 7 days after they expire.
• Sign-in security events: 365 days.
• Usage and website statistics: 400 days.
• WhatsApp messages from unknown numbers that match no company: 90 days.
• Web server and application log files: rotated, about 14 days.
• Backups: daily database backups about 14 days on the server; off-site copies up to 90 days. Backups of uploaded files and the pre-update safety copies stay on the server until an operator removes them.
• Business data: for as long as your subscription is active. Records the law requires a business to keep (for example invoices, accounting entries and the audit trail) are kept for the legally required period even after a deletion request.

When a subscription ends the workspace is archived, not erased automatically. It is deleted on request, subject to the legal retention above. Copies inside backups disappear as those backups expire.

9. Your requests

To access, correct, export or delete personal data, write to us. If you are an employee or a customer of a company that uses Smart ERP, contact that company first: it controls your records, and we help it respond. We verify the request before acting and aim to answer within 30 days. Data we must keep by law, or to protect the service's security, may be retained and we will say so.

10. Contact

Privacy requests and questions: support@smart-erp.app