Privacy policy
Introduction
This policy explains how the Usool platform collects, uses and protects personal data, in line with Saudi Arabia's Personal Data Protection Law.
Who we are and who does what
Usool is a product of Novanex Studio, and the service is operated from Egypt. We are the controller of your account data, such as your name, email, sign-in and subscription details. For the data your organization enters about its employees and the people who send reports, your organization is the controller and we process that data on its behalf and only on its instructions.
The data we collect
Account data: name, email, mobile number if you add it, and interface language. Organization data: name, commercial registration, VAT number and sector. Operational data: assets, locations, reports, work orders, spare parts, custody, counts, photos and attachments. Data on employees who hold custody: name, employee number, department, mobile and email. Data from the public QR report page: the reporter's name and mobile number if they enter them. Technical data: IP address, browser type, sign-in logs and the activity log inside the platform.
Why we use the data
We use data to provide and run the service: creating your account, routing reports to the people responsible, sending notifications and the weekly summary, issuing invoices, providing support and protecting the platform from misuse. Our legal bases are performing our contract with you, meeting our legal obligations, our legitimate interest in keeping the service secure and improving it, and your consent where we ask for it, such as for marketing emails. We do not sell personal data and we do not use your organization's data for advertising.
Minimization and retention
We collect only what the service needs. We delete or anonymize the reporter's name and mobile number on closed reports after 12 months. We keep your account and organization data for as long as you subscribe; if the subscription is cancelled, or the read-only period after the trial ends, we delete it within 90 days, except what the law requires us to keep, such as invoices. You can export your data before it is deleted.
Where data is stored, and transfers outside the Kingdom
The database and uploaded files are hosted by Supabase on Amazon Web Services servers outside Saudi Arabia, and the website and platform are served through Cloudflare. Our team in Egypt accesses the data only as needed to run and support the service. For these transfers we follow Article 29 of the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom: we limit transfers to what is necessary, apply suitable contractual and technical safeguards and sign a data processing agreement with every customer. The service does not need sensitive data, so we ask customers not to enter any.
Who we share data with
We share data only with providers that process it on our behalf under contracts that require them to protect it: Supabase for the database, sign-in and files, Cloudflare for serving the website and platform, our email delivery provider, and the payment provider that collects the subscription and VAT as merchant of record. We never see your full card number. We may disclose data when a competent authority requires it by law. We never share your organization's data with another customer.
How we protect data
We encrypt the connection between your device and the platform, and separate each organization's data with access rules in the database, so users only see their own organization's data. Our team's access is limited to what support requires, and we keep regular backups. If a breach affects personal data, we notify your organization and the competent authority within the time limits set by law.
Your rights
The Personal Data Protection Law gives you the right to be informed about how your data is processed, to access it and get a copy in a readable format, to correct and complete it, to ask for its destruction when it is no longer needed, and to withdraw your consent. To use any of these rights, write to privacy@novanex.app and we will reply within 30 days. If your data is held by an organization that uses Usool, such as custody records, send your request to that organization first and we will help it respond. You may also file a complaint with the Saudi Data and AI Authority (SDAIA).
Cookies and local storage
We do not use advertising cookies. We store on your device only what the service needs to work, such as your sign-in session and your language choice. We may use visitor analytics that do not identify you, to improve the website.
Children
The service is meant for organizations, and we do not knowingly collect data from anyone under 18. If we learn that we hold such data, we delete it.
Changes and contact
We may update this policy when the service or the law changes. We publish the new date on this page and email customers before any material change. For privacy questions, write to privacy@novanex.app. Last updated: 28 October 2026.