Privacy Policy

1. Who We Are

Aynexon (“Aynexon”, “we”, “us”) operates the website www.aynexon.com and the Aynexon StratIQ business-management application (“the Service”) available at stratiq.aynexon.com. This policy explains what personal data we process, how, and your rights.

2. Our Role (Controller vs. Processor)

Aynexon StratIQ is a multi-tenant platform used by businesses (“Customers”) to run their operations.

• For data a Customer enters about its own employees, clients, suppliers and operations, the Customer is the data controller and Aynexon acts as a processor, processing it only on the Customer’s instructions to deliver the Service.
• For account registration, billing, website usage and support, Aynexon is the controller.

3. Information We Process

a. Account & contact data: name, username, email, mobile number, company name, role/permissions.

b. Business & operational data entered by Customers: inventory, sales, purchases, quotations, customers, suppliers, delivery notes, projects, financial figures and documents.

c. HR / employee data (on behalf of the Customer): employee names (Arabic/English), national ID / Iqama number, passport details, nationality, contracts, salaries, allowances, GOSI status, bank account / IBAN, end-of-service data, and uploaded documents.

d. Attendance data: when you tap “Check in / Check out” we capture a selfie photo, GPS location, timestamp, and an inside/outside-geofence indicator.

e. Vehicle tracking & proof of delivery: when a driver starts an active delivery trip we process the device location (GPS) during the trip, and at delivery we capture a signature, photo and location as proof of delivery.

f. Payment data: subscription payments are processed via our payment provider (Moyasar). We receive only the transaction status and reference data; we do not store full card numbers.

g. Technical & usage data: IP address, browser/device information, event and security logs, and the local storage / cookies required to keep you signed in and remember your preferences.

h. AI feature data: when you use the optional AI features (e.g. “Ask Aynexon”), data relevant to your specific request is sent to a third-party AI provider to generate the response.

4. How We Use Your Data

• To provide, operate and secure the Service and verify user identities.
• To process payroll, attendance, deliveries, reports and the features you use.
• To process subscriptions and billing.
• To send operational emails and notifications (e.g. document-expiry alerts).
• To provide support and respond to requests.
• To detect, prevent and investigate security incidents and abuse.
• To comply with legal obligations.

5. Camera & Location Permissions

Camera and location are accessed only when you actively use a feature that needs them — capturing an attendance photo, sharing location during an active delivery trip, or capturing proof of delivery. We do not track your location in the background or when the app is closed. You can refuse or withdraw these permissions in your browser at any time (some features will then stop working).

6. Legal Basis for Processing

We process personal data on the basis of: performance of a contract (delivering the Service), your consent (e.g. camera/location), our legitimate interests (security and improving the Service), and compliance with legal obligations, in accordance with Saudi Arabia’s Personal Data Protection Law (PDPL) and other applicable regulations.

7. Service Providers (Sub-processors)

We share data only with providers that help us operate the Service, under appropriate confidentiality and data-processing terms:

• Supabase — database, authentication, file storage and backend functions (data hosting).
• Hostinger — web application hosting.
• Moyasar — payment processing.
• Resend — sending operational email.
• Geoapify — place / lead search (only when you use those features).
• OpenStreetMap — attendance/tracking maps (your IP is visible to the map provider when maps load).
• OpenAI — processing AI features, under a data-processing agreement that prevents using your data to train its models.

We do not sell your personal data and do not use it for third-party advertising.

8. Tenant Data Isolation

Each Customer’s data is logically isolated and protected by database-level access rules so that one Customer cannot access another’s data. Aynexon staff access Customer business data only when necessary to provide support, maintain the Service, or comply with the law.

9. International Transfer / Where Data Is Held

Your data is stored and processed in Tokyo, Japan (ap-northeast-1). Where data is transferred outside Saudi Arabia, we apply appropriate safeguards in accordance with PDPL requirements.

10. Security

We use encryption in transit (HTTPS/TLS), database-level access controls and row-level security, scoped permissions, and access logging. No system is perfectly secure, but we work to protect your data and to notify affected parties of any breach as required by law.

11. Data Retention

We retain personal data while your account is active and as needed to provide the Service, then for the period required by applicable Saudi law to meet legal and accounting obligations and resolve disputes, after which it is deleted or de-identified. Customers can delete records within the Service. When an account is closed, data is deleted or returned per applicable Saudi law.

12. Your Rights

Under the PDPL you may request to: access your data, correct it, delete it, restrict or object to processing, withdraw consent, and obtain a copy of your data. To exercise these rights, contact sales@aynexon.com. If your data was entered by a Customer (e.g. your employer), please contact that Customer, and we will assist them as a processor. You also have the right to lodge a complaint with the competent authority (the Saudi Data & AI Authority — SDAIA).

13. Children

The Service is intended for business use and is not directed to children under 18; we do not knowingly collect children’s data.

14. Cookies & Local Storage

We use essential cookies / local storage to keep you signed in and remember your preferences. We do not use advertising or cross-site tracking cookies.

15. Changes

We may update this policy; material changes will be posted here with a new “Last updated” date.

16. Contact