Privacy Policy

Last updated: 12 July 2026

Pilot notice. Warqa is currently in early pilot operated by an individual developer. Data handling practices described here are current as of the date above and may be strengthened as Warqa matures.

1. Who we are

Warqa is a compliance and operations tracking tool for UAE small and medium businesses. It is operated by an individual developer based in the United Arab Emirates. Contact details are at the bottom of this document.

2. What data we collect

Data you provide directly

Account data: email address, name, WhatsApp number (optional), password (stored as a one-way hash — we cannot read your password)
Business data: business name, emirate, business type, VAT registration status, employee count, modules used
Renewal tracking: item labels, expiry dates, authorities, fine estimates, notes
Employee records: names, Emirates ID numbers, IBAN, MOL reference, salary, joining dates, visa and Emirates ID expiry dates
Payroll data: monthly runs, line items, totals, SIF file settings
Site labour data: laborer names, day rates, project details, daily attendance entries
Invoice data: uploaded invoice images or PDFs, extracted supplier names, TRNs, amounts, VAT categories, dates

Data collected automatically

Technical data: IP address, browser type, timestamps of requests (used for security and rate limiting)
Error reports: anonymized error stack traces sent to our error tracking service when the application crashes

3. How we use your data

To provide Warqa's core features (tracking, reminders, calculations, exports)
To send you compliance-related reminders (when you have opted in and configured them)
To respond to your support requests
To detect and prevent fraud, abuse, and technical failures
To notify you of important changes to the service or these terms

We do not sell your data to advertisers, data brokers, or any third party.

4. Third parties that process your data

Warqa depends on several third-party services to function. Each processes only the minimum data needed for its role:

Provider	Purpose	Data processed
Amazon Web Services (AWS)	File storage, invoice OCR (Textract)	Uploaded invoice images/PDFs, extracted text
Anthropic	AI-assisted invoice extraction (fallback)	Invoice image contents, when OCR confidence is low
Railway (or equivalent hosting)	Running the Warqa application and database	All stored data (encrypted at rest)
Sentry	Error tracking	Error stack traces, non-sensitive request context

We do not share your data with any other third parties without your consent, except as required by law.

5. Where your data is stored

Warqa aims to store data in AWS's Middle East region where possible. Some third-party services (notably Anthropic) may process data in other regions during the invoice extraction workflow. Data at rest is encrypted using industry-standard mechanisms provided by our infrastructure providers.

6. How long we keep your data

Active accounts: data is retained as long as your account is active
Deleted accounts: data is deleted within 30 days of your request
Invoice records: if you request deletion of your account, invoice files stored in S3 are deleted along with the account
Backup copies: may persist for up to 60 days after deletion in encrypted backups, after which they are overwritten
Legal retention: some records may be retained longer if required by UAE law

7. Your rights under UAE PDPL

Under UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), you have the following rights:

Right to access — request a copy of the personal data we hold about you
Right to rectification — request correction of inaccurate data
Right to erasure — request deletion of your data
Right to restrict processing — ask us to stop processing your data while a concern is being addressed
Right to data portability — request an export of your data in a machine-readable format (we can provide XLSX)
Right to object — object to specific uses of your data
Right to withdraw consent — where processing is based on consent

To exercise any of these rights, email us at the address below. We will respond within 30 days. During the pilot phase these requests are handled manually — please allow us reasonable time to fulfill them.

8. Cookies and local storage

Warqa uses browser local storage (not cookies) to keep you signed in between sessions. This stores your authentication token and basic identity information (name, email) on your device only. We do not use tracking cookies, advertising cookies, or third-party analytics that profile you across sites.

9. Security

We take reasonable technical and organizational measures to protect your data, including:

Passwords stored as bcrypt hashes (irreversible)
All connections over HTTPS in production
Access to production systems restricted to the operator
Rate limiting to prevent abuse and brute-force attacks
Encryption at rest for stored files and database backups
Error monitoring to detect and respond to failures

No system is perfectly secure. If we ever detect a data breach that affects you, we will notify you promptly and describe what happened and what we are doing about it.

10. Children's data

Warqa is a business tool intended for use by individuals aged 18 and above. We do not knowingly collect data from minors. If you believe a minor has provided us with data, please contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. Significant changes will be communicated to registered users by email. The "Last updated" date at the top of this page reflects when the policy was most recently changed.

12. Contact

For privacy questions, data requests, or complaints, contact:

Warqa Team
Email: [email protected]