Privacy Policy
HazriBook is an attendance and payroll app for construction contractors in the United Arab Emirates. It is operated by HazriBook, Dubai, UAE. This policy explains what the app records, why, who can see it, and how to have it removed.
There are two kinds of person in HazriBook and the difference matters throughout this policy. A contractor signs up, pays, and controls the account. A worker is added to that account by the contractor and punches in and out. Most of the data here is about workers and is entered by contractors — so a worker's rights under this policy are exercised partly through us and partly through his employer, and we say which is which each time.
1. What we record
About workers
- Identity — name, worker code, phone number, photograph, nationality.
- Documents — passport number, Emirates ID, labour card number, visa expiry date. Entered by the contractor for UAE labour-law compliance.
- Pay — basic salary, allowances, deductions, calculated wages, and the bank IBAN used for the Wage Protection System salary file.
- Attendance — the time of every punch in and out, the project it was made on, and the device it was made from.
- Location — the phone's position at the moment of a punch only. See section 2.
About contractors and their staff
- Name, email address, phone number, role, and company details including trade licence and MOHRE establishment number.
- An audit record of actions that decide pay: corrections, approvals, payroll locks.
Recorded automatically
- IP address, stored alongside each punch as supporting evidence. It is never used to decide anything — not location, not whether a punch is valid — because a phone's IP address can be forged and mobile networks share one between many people.
- Device identifier for the phone or tablet a punch was made from, so a lost device can be revoked.
- Notification token, if notifications are switched on.
2. Location
Location is read only at the moment a punch is made. HazriBook does not track anyone in the background, does not read location while the app is closed, and does not hold a permission that would allow it to. There is no background-location permission in the app at all.
Refusing location is allowed and does not affect anyone's pay. A punch made without location is still a valid punch. It is marked as having no location so the contractor can see that it is unconfirmed, and it counts in full towards the worker's hours and his wages. The app says this on screen, before it asks for the permission.
Where a contractor has set a geo-fence around a site, a punch made outside it is flagged for review, not rejected. A flag is a note for a person to look at. It never reduces pay by itself.
3. Why we hold it
- To run the service — recording attendance, calculating wages and overtime under UAE Federal Decree-Law No. 33 of 2021, and producing payslips.
- To meet legal obligations — the Wage Protection System salary file requires labour card numbers and IBANs in a MOHRE-prescribed format.
- To keep the record honest — an unchangeable history of punches and corrections, so a dispute about hours can be settled by evidence rather than by memory. This is as much a protection for the worker as for the employer.
- To notify — visa expiries, daily attendance summaries, unusual punches. Notifications never contain wages, bank details or document numbers.
4. Who can see it
Each contractor's data is isolated at the database level. One contractor cannot read another's records, and this is enforced by the database itself rather than by the app — there is no query that returns another company's rows.
Within a company: an owner sees everything; an administrator sees attendance, payroll and laborer records; a foreman sees only the crew on the sites he runs; a worker sees only his own attendance and hours.
We do not sell data, share it for advertising, or send it to data brokers. There is no advertising or analytics SDK in the app.
Service providers
- Supabase — database, authentication and file storage. All application data is held here.
- Google Firebase Cloud Messaging — delivery of push notifications only. It receives a device token and the notification text, which by design contains no wage, bank or document information.
Data may be processed on servers outside the UAE by these providers.
5. Security
Data is encrypted in transit (HTTPS/TLS on every connection) and at rest. Worker PINs are never stored in readable form and are never returned to any app or web page — not even to the contractor who set them. Access is restricted by role at the database level, and every change to anything that decides pay is written to an audit log that cannot be edited or deleted.
6. How long we keep it
- While the account is active — attendance and payroll records are kept, because they are the evidence of what was worked and what was owed.
- After a company closes — 30 days' grace in which the closure can be cancelled, then wage and attendance records are retained for 24 months before permanent deletion. This retention exists for the workers' benefit: a wage dispute can be raised after employment ends, and the record is the worker's proof.
- A deleted individual account — the sign-in and all personal details are removed immediately. An anonymous marker remains so that historical records still show that an action was taken, without saying by whom.
7. Your rights
You may ask for a copy of your data, ask for it to be corrected, or ask for it to be deleted. How to do each is on the account deletion page, including what we can delete and what we are obliged to keep.
Under UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection you may also object to processing and complain to the UAE Data Office.
8. Children
HazriBook is a workplace tool and is not directed at anyone under 18. The minimum working age in the UAE is 18 for the construction sector.
9. Changes
If this policy changes materially, account owners are notified by email before the change takes effect. The date at the top always reflects the current version.
10. Contact
Privacy questions and data requests: privacy@hazribook.com. We answer within 30 days.