Documents
What an organisation needs to read before it signs.
Three documents on one page, deliberately: they overlap, and they share a single last-updated date. Split across three pages, one of them drifts from the others and nobody notices.
Last updated: 3 October 2026
This page is informational. What binds either party is what appears in the technical proposal and the signed contract.
Privacy policy
Two layers, kept apart because they are genuinely different: this marketing site is one thing, and the application that holds your organisation’s data is another. Blending them into one paragraph hides the part you actually need.
One: this site (idraksys.com)
It does not track your browsing or measure your visit. It sends data only when you submit one of the two request forms, or when the system-status page automatically checks the application server as described below.
- No cookies, no local storage, no device fingerprinting.
- No analytics and no visitor measurement — neither ours nor a third party’s.
- The demo-request and feature-request pages list every field they collect. Their values reach the application server only when you press submit. The “Get in touch” action instead launches your mail client.
- Fonts are served from our own domain, so your IP address never reaches Google Fonts or any font provider.
- The only external requests that can occur are the ones you start yourself by following a link: LinkedIn, or the verification service on the Freelance platform.
- The “System status” page makes the site’s only automatic request: when opened, it asks the application server one question whose only answers are “I respond” or nothing at all. Your address is recorded there solely to prevent abuse, and is tied neither to you nor to any account. The two request forms send nothing until you submit them, and other pages send no data.
Browsing data is neither collected nor sold. Request-form data is sent to the application to record and answer the request; no unapproved numeric retention period is published here. The site has no cookie-consent banner because it uses no cookies.
Two: the application (app.idraksys.com)
Real data is processed here. What follows is a complete inventory of every external party that receives anything — not a selection of the flattering ones.
What we collect at sign-up
The minimum needed to run the account — no field kept “in case it helps later.”
- Full name (Arabic and English) — for identification in the system and on incident tickets.
- Email — for sign-in and security alerts.
- Password — stored hashed, never as plain text, and checked against a breached-password list without ever leaving your browser (Have I Been Pwned, noted below).
- Phone, city, and district — entirely optional; not required to complete registration.
Once your account is approved, you can add further optional details from “My Account” if you choose (nationality, date of birth, gender, a secondary phone, a profile photo) — none are required anywhere in the system, and adding them is entirely your call.
Parties that receive something
- SupabaseThe database, authentication and uploaded files — that is, all system data.Always. Servers are in Frankfurt, Germany.
- VercelFront-end hosting and content delivery. Requests pass through it; no system data is stored there.Always.
- Firebase Cloud MessagingYour device token and the notification text, which is built in your language from system events.Only once you enable notifications.
- Have I Been PwnedThe first five characters of the password’s SHA-1 hash — not the password, and not the full hash. The password itself never leaves your browser.When you choose a new password.
- MyMemoryThe text you select for translation, capped at 2,000 characters and 20 requests per user per day.Only on a button press by you — nothing is sent as you type.
- Google Input ToolsThe name you ask to transliterate between Arabic and English.Only on a button press by you — nothing is sent as you type.
The last two are the only ones that receive text you wrote, and neither runs without an explicit action from you. If you never press the button, not one character leaves.
Where the data sits
Application data today is stored in Frankfurt, Germany, via Supabase. We say so plainly because concealing it would be worse than stating it — it is the first thing anyone discovers. And if your organisation requires the data to remain inside the Kingdom or inside your own infrastructure, that is precisely the case the second and third hosting options in the governance section exist for. It is settled before signing, not after.
What protects the data inside the system
- Tenant isolation inside the database itself, not in the interface — and tested automatically before every release.
- Mandatory two-factor authentication on super-admin accounts, which a user cannot switch off for themselves.
- An audit log that cannot be edited or deleted — enforced by a database constraint, not by an operational agreement.
- Permissions in three layers: scope, role, and a grant or revoke down to a single person.
- Breached-password screening at registration and on every change.
Your rights over your data
A data subject may access their data, correct it, request a copy, and request deletion within the limits that do not compromise the audit log or a statutory obligation on their organisation. Requests go to the address below; requests from employees of a contracted organisation are directed to that organisation first, as the data controller.
Reporting a vulnerability or a security incident
If you find a vulnerability or suspect an incident affecting system data, there is one dedicated address below — no generic form and no intermediary. Good-faith disclosure is welcomed and will not be met with legal action, as long as it goes no further than proving the issue: no data extraction, no destruction, and no access to anyone else’s account. Please allow time to close it before disclosing publicly. The same address is published at `/.well-known/security.txt` under RFC 9116.
What is not yet set
Retention after the contract ends, the handover or destruction procedure, and the notification deadline for a security incident are set in the contract. They are not published here as numbers that have not been agreed. Naming the gap is more honest than filling it with an estimate.
Terms of use
Two layers, for the same reason privacy has two: a visitor to this site and an account holder in the application are genuinely different positions.
One: site terms of use
01This page is informational, not binding
Everything here about capabilities, service and hosting is descriptive. What binds either party is the technical proposal and the signed contract alone, and where they differ the contract prevails.
02Every figure you see is fabricated
The dashboard numbers, incidents, department names and materials on this site are entirely invented for demonstration. Not one line comes from a production database, no name belongs to a real person, and nothing points to any facility, vendor or existing system.
03Publication policy — no client names
This site never publishes the name of any organisation using the system, nor its logo, nor a screenshot of its data — even with permission. Any description of the developer’s professional experience describes that experience alone: it is not a customer claim and not an endorsement by an employer. What is offered during evaluation is a written reference with its owner’s permission. This is a commitment to you before it is a reservation: what is not published about others is not published about you.
04Ownership
The name Idrak, its visual identity, this site’s copy and its source code belong to the developer. They may not be republished, nor may parts be quoted in a way that implies a contractual relationship or an endorsement that does not exist.
05No implied warranty
The site is provided as is. Its content is not intended as technical or legal advice, and reading it creates no obligation on either party toward the other.
06External links
Links to other sites are provided for convenience. We control neither their content nor their privacy practices.
07Governing law
These terms are governed by the laws of the Kingdom of Saudi Arabia, and the forum for any dispute is set in the signed contract.
Two: terms of service (for account holders on app.idraksys.com)
01Scope of the service
The system is provided to your organisation as SaaS. Your organisation controls its employees’ and reporters’ data; Idrak’s developer processes it on that organisation’s behalf under the signed agreement, and does not own it.
02Account and eligibility
Your account starts “pending approval” until your organisation’s super_admin activates it, or you are invited directly. You are responsible for the accuracy of your details, the secrecy of your password, and any activity from your account until you report unauthorised use.
03Acceptable use
The account is for your organisation’s work only. No uploading content unrelated to that work, no attempting to access another organisation’s data, and no acting beyond the role and permissions granted to you.
04Roles and permissions
What you can see and do is set by your organisation’s role system, not by us. Disputes over a given account’s access are resolved internally between your organisation and its users.
05Service availability
We make a reasonable effort to keep the service available but do not guarantee uninterrupted operation. Service-level details are set in the signed agreement with your organisation, not here.
06Suspension or termination
Your account may be suspended or terminated when your organisation’s contract ends, on use that breaches these terms, or at the request of your organisation’s super_admin. Account deletion is administrative, initiated by your organisation only — there is no self-service deletion path — to protect the audit trail and the incidents linked to it.
07Intellectual property
The system, its code, and its design belong to Idrak’s developer. Operational data your organisation enters (incidents, materials, photos) remains its own.
08Governing law
These terms are governed by the laws of Saudi Arabia; dispute resolution is set in the signed agreement with your organisation.
Accessibility statement
What follows describes what is actually built. No WCAG conformance level is claimed here, because none has been verified with an independent audit tool — and claiming an untested level is worse than saying nothing.
What is built
- A “skip to content” link is the first thing the Tab key reaches.
- The page works fully by keyboard, and the focus position is visible rather than hidden.
- Arabic RTL and English LTR are two complete versions, not a partial translation, and the page language is declared in the markup.
- The “reduce motion” preference softens the scenes rather than removing them: translation and scaling drop away while fades and sequencing remain, so nobody who chooses it loses information.
- Scroll-driven scenes fall back automatically to ordinary flow when the viewport cannot fit them — so no text is ever clipped or lost.
- Contrast is built on a deliberate grey scale with a single primary colour, and light and dark are both designed rather than derived automatically.
- Colour is never the only carrier of state: every state carries its own label.
What is not done yet
No independent automated audit has been run, and no testing has been done with screen reader users. When it is, this statement is updated with the result, whatever it turns out to be.
If you hit a barrier
Email me at the address in the footer and mention the page, the browser, and any assistive tool you use. Accessibility barriers are treated as defects: at no charge and with priority.