Privacy Policy
Publisher: Maydan (ميدان) Effective date: 26 October 2026 Version: 1.0.1
1. Who we are
Maydan (“Maydan”, “we”, “us”) provides a multi-tenant workforce attendance platform for organizations, including a mobile application and an administration dashboard. This Privacy Policy explains how personal data is handled when you use Maydan.
Contact for privacy questions: ma7moud.3bdelmo7sen@gmail.com
2. Scope
This policy applies to the Maydan mobile app, dashboard, and related backend services. Your employer (the company that provisioned your account) is typically the organization that decides why attendance and HR-request data are processed. Maydan provides the platform used to process that data.
3. Data we collect
Depending on your role and how your organization configures Maydan, we may process:
Account and employment data: name, email, mobile number, employee number, job title, department, manager relationship, company affiliation, and account role. Authentication and security data: login credentials (stored as a secure password hash), session tokens, device binding identifiers, and security or integrity signals reported by the client during attendance (for example mock-location or root/jailbreak heuristics). These client signals can be inaccurate or forged and are used as risk checks, not as definitive proof of device integrity. Attendance data: check-in and check-out events, timestamps, assigned work locations, geofence verification results, late/early indicators, and related attendance summaries. Location data: precise location collected only when you perform attendance verification (check-in or check-out), to confirm you are at an authorized work location. Maydan does not continuously track your location and does not request background location for continuous tracking. Biometric data: Face ID / fingerprint may be used locally on your device as a gate before attendance actions. Biometric templates remain on your device; Maydan does not receive raw biometric templates. Photos and attachments: images or files you attach to requests (for example a medical certificate for sick leave). These files are stored as private attachments and accessed through authenticated, time-limited links. Requests and approvals: permission, leave, overtime, attendance correction, and similar workflow data, including manager decisions and comments where provided. Notifications: push notification device tokens and in-app notification records. Device and technical data: device identifiers used for binding, app version, and basic diagnostic/operational logs needed to operate and secure the service. Support communications: messages you send to the contact email above. Public demo/contact form submissions: full name, work email, and company name are required; message is optional. Submissions are stored in the Super Admin contact inbox for follow-up. Messages remain in the contact inbox until a Super Admin manually deletes them; they do not automatically expire. Cloudflare Turnstile is used to verify submissions and help prevent abuse. Cloudflare states it processes only data strictly necessary for this security function and does not access, store, or transmit user communications, form entries, or other page inputs.
4. How we use data
We use personal data to:
provide attendance verification and workforce workflows requested by your organization;
authenticate users, bind devices, and protect accounts;
show managers and authorized administrators the attendance and request information they are permitted to see;
send notifications related to attendance, requests, and announcements;
operate, secure, troubleshoot, and improve the service;
comply with legal obligations and enforce our Terms.
5. Location specifically
Location is collected only at the moment of check-in or check-out (foreground / when-in-use), to verify presence at assigned work locations. Maydan does not run continuous background GPS tracking. If you deny location permission, attendance verification that requires location may fail.
6. Sharing
We do not sell personal data.
We share data with:
your employer and authorized users in your company (for example managers, HR, and company admins) according to role permissions;
service providers that host or support the platform (such as cloud hosting, databases, object storage, and push notification providers), under contractual confidentiality and security obligations;
authorities when required by applicable law.
Cross-company isolation is enforced so one customer organization cannot access another organization’s data through normal product use.
7. Retention
We retain personal data for as long as your organization needs it for employment and attendance records, and as required for security, dispute resolution, and legal obligations. When an organization ends its use of Maydan, retention and deletion follow the organization’s instructions and our operational retention practices, subject to legal holds.
8. Security
We apply administrative, technical, and organizational measures appropriate to the risk, including encrypted transport (HTTPS), access control, tenant isolation, hashed passwords, private attachment storage with short-lived signed URLs, and session controls. No method of transmission or storage is completely secure.
9. Your choices and rights
Depending on applicable law and your relationship with your employer, you may have rights to access, correct, or request deletion of personal data, or to object to certain processing. Because your employer often controls the employment record, many requests are best directed first to your company administrator. You may also contact ma7moud.3bdelmo7sen@gmail.com. You can control language, theme, notification, and biometric preferences in the app where available, and you can revoke device permissions in your operating system settings.
10. Children
Maydan is intended for workforce use by organizations and is not directed to children.
11. International processing
Maydan may process and store data on infrastructure that is not located in your country. Where we do so, we take steps appropriate to the service design and applicable requirements. Governing interpretation of this policy is under the laws of the Kingdom of Saudi Arabia, with a primary venue in Riyadh, unless mandatory local law provides otherwise.
12. Changes
We may update this Privacy Policy from time to time. The current version is published in the Maydan app and on the public privacy page. Material changes will be reflected by an updated effective date and version.
13. Contact
Maydan (ميدان)
Privacy contact: ma7moud.3bdelmo7sen@gmail.com
Public privacy page: https://maydan.up.railway.app/en/privacy