Who we are and scope
Dhurwa is a project management platform for contracting companies, including the website and the Dhurwa mobile app. The platform is operated by Dhurwa Tech (ذروة التقنية), an independent business run by its owner. We will update this page once a company is registered.
This policy applies to platform users: employees and administrators of subscribing companies, and project owners and company clients who access the platform through links sent by the company.
For any privacy matter, contact support@dhurwa.com.
Dhurwa's role and your company's role
Companies use Dhurwa to manage their employees, projects and clients. For this data the company is responsible: it decides why the data is used and who can access it, and Dhurwa processes it on the company's behalf and according to its instructions.
Dhurwa itself processes the data needed to operate and protect the platform, such as login records and abuse prevention.
Data we process
Account data: email address, name, phone number, job title, role, permissions, your projects and last login time. We never store your password itself, only a secure hash. We keep session data and two-factor authentication data when enabled.
Project data: names and contact details of owners, clients and suppliers, project details and locations, staff assignments, messages, meetings, requests, approvals, ratings, payments, receipts and financial records.
Location: when you check in or out, we record your location, its accuracy, your distance from the project and the time. We request location permission for this feature only and do not track your location in the background.
Photos and files: work evidence photos, logos, contracts, plans, warranties and attachments uploaded by you or your company. Site cameras linked by the company stream directly from the camera provider; we do not record the stream.
Technical data: cookies and session tokens, some preferences in your browser or the app, IP addresses used to protect the service from repeated attempts, activity and audit logs, and tracking-link visit details such as browser type.
Why we use data and who sees it
We use data to run accounts, manage projects, attendance, messaging, files and financial operations, to verify who signs in and to protect the service. We do not sell data or use it for advertising.
Company data is visible to the people the company authorizes, each within their projects and role. Owners and clients see what the company makes available through their link. Anything a company publishes on its public website is visible to everyone.
Service providers
Hosting: the platform's servers and database run on Oracle Cloud in the Riyadh region, Saudi Arabia, with website traffic passing through Cloudflare for protection and performance.
Messaging: invitations, notifications and password resets are sent through an email provider, and some notifications through WhatsApp. The provider receives the recipient's address or number and the message text.
Maps: when location features are used, the project location may be sent to Google Maps or OpenStreetMap.
Optional analysis: if a company uploads a payment schedule or an Excel file for automatic analysis, the file content is sent to OpenAI to extract the data. This only runs when a company user requests it.
Some of these providers may process data outside Saudi Arabia. We use them only as needed to provide the service.
Security and retention
We protect data with encrypted connections, hashed passwords and session tokens, encrypted two-factor secrets, separation of each company's data, and role-based permissions. No system is completely secure, however.
We keep account and company data while the company account is active. When a company's subscription ends or its account is closed, we delete its data or remove what identifies individuals within 90 days, except what must be kept by law.
Deleted data is removed from backups automatically as they rotate, within 90 days at most.
Your rights and contact
You may request access to, correction of, or deletion of your data. Start with your company administrator, who can change most of your data directly, or email support@dhurwa.com from your registered address.
Deletion steps are on the "Account and data deletion" page.
The platform is intended for companies and their adult users, not for anyone under 18.
If we change this policy, we will publish the new version here with its update date and notify company administrators of significant changes.