Privacy Policy

Your account. Name, work email, phone number, job title, role and the organization you belong to. A profile photo if you upload one.

What your employer records about your work. Attendance punches, shifts, leave, payroll and any HR documents they upload, such as an identity document or bank details. Your employer chooses to collect these; we store them.

Business records you enter. Customers, suppliers, invoices, expenses, items and accounts.

Technical information. The IP address, browser or device a request came from, and the time. Used to keep the account secure and to investigate problems.

AT Track is the attendance app employees install on their own phone. It asks for these permissions, each for one purpose:

• Camera — to read the attendance QR code at your workplace. Nothing is photographed or stored; the frame is decoded and discarded.
• Location — recorded with a clock-in or clock-out so your employer can confirm the punch was made at the workplace. It is captured at the moment you punch, not tracked in the background, and never while the app is closed.
• Notifications — to confirm your punches and deliver notices from your organization.
• Biometric unlock — optional. Your fingerprint or face never leaves your phone; the phone tells the app only whether it recognised you.
• Device information — the model and OS version, stored with a punch as a record of where it came from.

Punches made on an office fingerprint or face terminal are read from the terminal by your employer's system. The terminal stores the biometric template itself; we receive only an employee number and a timestamp.

• To run the service — sign you in, show your workspace and keep your records.
• To keep accounts secure and detect misuse.
• To send messages about your own activity, such as a punch confirmation, and notices your organization sends.
• To meet tax and e-invoicing obligations, including submitting invoices to ZATCA where your employer has enabled it.
• To support you when you ask us for help.

We do not sell your information, and we do not use it to advertise to you.

Your employer. The organization whose workspace you belong to can see the records it keeps about you, within the permissions its administrators set.

Service providers who help us run the service: our hosting and storage provider, Google Firebase for push notifications, and our email provider. They may only process data on our instructions.

ZATCA, the Saudi tax authority, receives invoices when your employer has connected e-invoicing. This is a legal requirement, not a choice we make.

Authorities, where the law requires it and after we have satisfied ourselves that the request is valid.

• Everything travels over HTTPS.
• Passwords are stored hashed. Nobody at AL Tamam can read yours.
• Uploaded documents — identity papers, bank details, attachments — are held in private storage and served only through short-lived links to people with permission.
• Access inside a workspace is limited by role, and administrators decide who can see what.
• Sensitive actions are logged with who did them and when.

Business and accounting records are kept for as long as your employer needs them and for any period the law requires — in Saudi Arabia that is generally six years for tax records.

Deleted records go to your organization's Trash and are removed permanently after 30 days, or immediately if an administrator empties it.

When an employee leaves, their sign-in is revoked and they stop receiving any email from the system. The record of their work stays, because invoices and payroll have to say who did them. Their identity documents and bank details are deleted from storage.

• You can see and correct your own profile in the app at any time.
• You can turn notifications off in AT Track, and revoke the camera or location permission in your phone's settings — attendance by QR or location check will stop working if you do.
• You can ask for a copy of your data, or ask us to correct or delete it. Where the data belongs to your employer's records we will pass the request to them, because it is their decision to make.

Write to hello@altamambook.com. We normally reply within 24 hours, and will always answer within 30 days — the limit Saudi data protection law sets.

AT-BOOK and AT Track are workplace tools. They are not intended for anyone under 16, and we do not knowingly collect their information.

When this policy changes we update the date at the top of this page. If a change materially affects you, we will say so in the app before it takes effect.