Privacy policy

The organization and Smart HR

Each organization has its own workspace. The organization decides which employee records to keep and who inside the organization may see them. Smart HR runs that workspace.

People do not open a public account. The organization creates the login and assigns the role.

Records in the workspace

The workspace holds the records the organization enters for its people operations. Depending on what that organization uses, those records include:

• Name, work email, phone, and role.
• National ID, date of birth, address, emergency contacts, dependents, contracts, and uploaded documents, including a profile photo.
• Salary, bank account or IBAN, loans, payslips, and the statutory payroll files the product can produce, including Saudi WPS, Oman NOSI, Egypt social insurance, and end-of-service figures where those rules apply.
• Attendance, leave, missions, assets, tickets, recruitment, performance, and the other modules that organization has turned on.

What the phone app uses

The app asks for a permission only for the action in front of the person. It does not sell this information, and it does not use it for advertising.

• Location, only while checking in or out, to confirm the punch is at the workplace. The app does not track location in the background.
• Camera, to scan an attendance QR code and to take a photo for an upload.
• Photo library, so a person can attach an image to a document or a request.
• Face ID, fingerprint, or the device passcode, only on the phone, to confirm the person before a punch. The biometric template stays on the device and is not uploaded.
• Before a punch, the app checks whether the phone is rooted or jailbroken, an emulator, in developer mode, or reporting a fake location. If it is, the punch is refused on the phone.

Notifications and crash reports

• If notifications are allowed, the app stores a Firebase Cloud Messaging token so the workspace can send a push notification to that device.
• The app sends crash and error reports to Sentry so failures in the product can be fixed. Those reports are not used for advertising.

Who can see the records

People see only what their role in that organization allows. Another organization’s workspace is separate. Administrators of the organization can see and export the records their role permits, including payroll files meant for a government authority.

How long records stay

The organization keeps employment and payroll history for its statutory duties. After a person has left, the organization can anonymize the personal data described on the account deletion page. The product can also do that automatically after the number of days the organization sets, counted from the end of employment. The starting value is 365 days. Setting the period to 0 turns the automatic step off. A legal hold stops erasure until the organization clears it.

Asking for deletion

A person asks their organization’s HR administrator. The steps, what is removed, and what is kept are on the account deletion page.