Privacy Policy

1. About this Policy

This Privacy Policy explains how TawreedFlow, an independent software project built and operated by Shajjad Khan, handles information used to provide the TawreedFlow platform.

2. Information users provide

TawreedFlow may store information users provide while using the platform, including:

• name, username, email address and phone or WhatsApp number;
• company, supplier, hotel or property information;
• job title, account role and workspace permissions;
• procurement requests and item information;
• quotations, pricing and related business records;
• photos, documents and generated PDFs;
• delivery and receiving records;
• supplier and customer records;
• timestamps, activity records and audit information; and
• support information voluntarily submitted by users.

3. How information is used

Information stored in TawreedFlow is used to operate the platform and provide the workflow requested by users. This includes authentication, role-based access, business record keeping, quotations, procurement coordination, delivery records, notifications, support, security and service recovery.

TawreedFlow does not use customer business information for unrelated commercial purposes and does not sell customer data.

4. Business data belongs to users

TawreedFlow does not claim ownership of business data uploaded or created by users.

When one user intentionally shares information with another business or user through TawreedFlow, that information may also become part of the recipient's legitimate business or transaction records.

5. Access to business records

TawreedFlow is designed around role-based access. Business information is shown to users according to their account, company relationship, assigned role and permitted workflow access.

Customer business records are not intended to be routinely viewed or used by the TawreedFlow project operator for unrelated purposes. Administrative account functions are limited and user actions may be auditable through account and activity records.

6. Information collected automatically

Web servers and security systems may automatically process technical information such as IP address, browser or device information, login time, requested pages, security events and error logs.

This information may be used for security, troubleshooting, abuse prevention and reliable operation of the service, not for advertising.

7. Cookies and sessions

TawreedFlow uses essential cookies or similar session technologies required for login, authentication, security, preferences and normal platform operation.

TawreedFlow currently does not use advertising cookies, Google Analytics, Meta Pixel or similar advertising and analytics trackers.

8. Notifications

TawreedFlow may provide browser, email, SMS, WhatsApp or similar notifications where such functionality is available.

Optional notifications are intended to be user-controlled. Users may choose whether to enable or receive supported optional notifications.

9. Third-party infrastructure

TawreedFlow may rely on trusted third-party infrastructure or service providers for functions such as hosting, email delivery, backups, networking, notifications or future payment processing.

These providers are used only as reasonably necessary to operate the platform. TawreedFlow does not sell customer data to infrastructure providers.

10. Payments

TawreedFlow currently does not process payment-card transactions or store customers' payment-card credentials.

If payment features are introduced later, TawreedFlow intends to use appropriate payment providers and avoid directly storing sensitive card credentials wherever reasonably possible.

11. Backups

TawreedFlow may maintain backups for disaster recovery, security and restoration after technical failures.

Deleted information may remain temporarily in secure backups until those backups are automatically rotated or replaced. Backup data is intended for recovery and security purposes, not unrelated use.

12. Security

TawreedFlow continuously aims to improve its technical and operational security as the project develops. Reasonable measures are used to protect accounts and stored information.

No online system can guarantee absolute security. Users are also responsible for protecting their passwords, devices and account access.

13. Sensitive information

Users should not upload unnecessary highly sensitive information, including passwords, payment-card credentials, government identity documents, medical records or information not required for the intended business workflow.

14. Account deletion

Users may request account deletion by contacting support@tawreedflow.com .

Personal account information will be removed where reasonably possible, subject to applicable legal requirements and technical limitations.

Information already intentionally shared with another business may remain in that recipient's legitimate business or transaction records. TawreedFlow does not interfere with legitimate records belonging to the business with whom the information was shared.

15. Legal disclosure

TawreedFlow does not voluntarily disclose customer information for unrelated purposes. If a valid legal, court or governmental requirement applies, information that is technically available may be disclosed only to the extent legally required.

16. Policy acceptance records

When users create an account, TawreedFlow may record their acceptance of the Terms & Conditions and Privacy Policy, including the policy version, acceptance date and time, and limited technical information used to maintain an auditable acceptance record.

17. Changes to this Policy

Minor corrections or clarifications may be published when needed. If a future change materially affects privacy rights, use of data, payment obligations or other important terms, existing users may be required to review and accept the updated policy before continuing to use relevant TawreedFlow services.

18. Contact

Privacy questions, account deletion requests or other privacy concerns can be sent to: support@tawreedflow.com