GovFlow

Privacy Policy

Last updated: 21 October 2026

This policy explains how the GovFlow website and project (the “Service”) handles personal data. GovFlow is currently a project operated by the GovFlow team; it is intended to be operated by a company to be established, which will then be responsible for processing personal data. It is drafted with reference to the Saudi Personal Data Protection Law (PDPL) and its implementing regulations.

1. Data we collect

  • Account data: name, email address, role, assigned companies and account status.
  • Sign-in data: password (stored only as a secure hash by our authentication provider) or Google sign-in identifiers.
  • Employee records entered by authorised users: names, nationality, Iqama/passport/visa numbers and dates, salary components and GOSI details.
  • Company records: commercial registration, licences, renewals, payments, tax obligations, portal access notes and actions.
  • Security logs: sign-in events, approvals, role and company-assignment changes, and important data changes.

2. How we use it

  • To provide the Service: tracking renewals, payments, compliance deadlines and tasks.
  • To control access so each user only sees the companies they are assigned to.
  • To keep an audit trail and protect the Service against misuse.

We do not sell personal data and do not use it for advertising.

3. Legal basis

All data categories listed above are processed to deliver the Service to client organisations: to present each client with an accurate view of its company’s obligations, forecasts and projections, and to surface the actions required to stay compliant. Processing also supports applicable legal obligations such as labour, GOSI and immigration record-keeping.

4. Storage, sharing and transfers

Data is stored with the Service’s cloud hosting and database provider and protected by encryption in transit, role-based access and database-level company isolation. Google is used only if you choose “Continue with Google”. Data is managed only by the GovFlow team and is not shared with third parties for their own purposes.[To confirm: hosting and backup location]

5. Retention

Personal data is kept only for as long as needed for the purposes above and to meet applicable legal obligations. Data is kept for as long as the client organisation remains an active client of GovFlow, and is then deleted or anonymised.

6. Cookies and local storage

We use essential browser storage to keep you signed in and remember preferences. No analytics or advertising cookies are currently used; if that changes, they will only run after you allow them in “Cookie preferences”.

7. Your rights

Under the PDPL you may request to be informed about, access, correct, or delete your personal data, and withdraw consent where processing relies on it. You may also lodge a complaint with the Saudi Data & AI Authority (SDAIA).

8. Contact

Privacy requests can be raised through your organisation’s GovFlow administrator. A dedicated contact email will be published here.