For clients

Privacy Policy

How we collect, use, share and protect personal data of website visitors, clients, partners and payees, and the rights you have.

Version 1 · effective 1 November 2026

In short
We collect only the personal data we need to run Tarleaks, bill our clients, pay our partners and keep the website working.
For our website, our clients' account and billing details, and our partners' details, Tarleaks is the controller of the data.
For the business data you put into your Tarleaks workspace, you are the controller and we are the processor. We use it only to provide the service. The Data Processing Agreement covers this.
We do not sell personal data. We share it only with the providers and authorities described below.
If you arrive through a partner link, we set a cookie called tl_ref for 60 days so that the partner can be credited.
You can ask to see, correct, export or delete your personal data, and you can object to some uses. Write to info@tarleaks.com.
We keep tax and billing records for 5 years because the law requires it. We delete or anonymise other data when we no longer need it.
If a breach affects business data in your workspace, we tell you without undue delay and in any case within 72 hours of becoming aware.

1. Who we are and what this policy covers

1.1 This policy is published by Tarleaks, trading as Tarleaks ("we", "us"), of United Arab Emirates.

1.2 It explains how we handle personal data of: (a) visitors to https://tarleaks.com and the partner portal at https://partner.tarleaks.com; (b) our clients' account holders, users and billing contacts; (c) our partners and the people who work for them, and the payees we pay; and (d) people who write to us.

1.3 Personal data means information about an identified or identifiable person. A controller decides why and how personal data is used. A processor uses it on behalf of a controller.

1.4 We follow UAE Federal Decree-Law 45/2021 on the Protection of Personal Data (the PDPL). Where they apply, we also follow the data protection rules of the DIFC and ADGM, and the Saudi PDPL for clients in Saudi Arabia.

2. Your business data in the workspace

2.1 A client's workspace may hold data about its employees, customers and suppliers. For that data the client is the controller and we are the processor. We use it only to provide the service and as the client instructs.

2.2 The Data Processing Agreement, which the client accepts together with the Terms of Service, sets out our duties as processor.

2.3 If you are an employee or a customer of a Tarleaks client and want to see or correct your data in that client's workspace, please contact that client first. We will help the client to answer you.

2.4 The client's data is kept on the platform's database. The Terms of Service explain where it is kept and the options available to the client.

3. What we collect, why, and on what basis

3.1 The table sets out what we collect as controller.

Who	What we collect	Why we use it
Website visitors	Pages visited, device and browser information, IP address, language, the referral cookie `tl_ref`	To run and secure the website, to understand how it is used, and to credit partners
Account holders and users	Name, work e-mail, phone, job role, company name, sign-in and security records	To create and manage the account, to provide support and to keep the service safe
Billing contacts	Company details, VAT registration number (TRN), billing address, invoices, receipts, credit notes, payment status and payment method details	To bill, collect payment, issue tax documents and meet tax law
Partners and payees	Name, contact details, trade licence and ownership details, TRN, bank details, tax documents, the introductions you make, statements and payouts, results of sanctions and anti-money-laundering checks	To run the partner program, pay commission, issue tax documents and comply with the law
People who write to us	The content of the message and your contact details	To answer you and keep a record

3.2 The law allows us to use personal data in the situations below. We rely on the one that fits each use.

You have given your consent. You can withdraw it at any time.
It is needed to perform a contract with you, or to take steps before one.
It is needed to meet a legal duty, such as tax, accounting and anti-money-laundering rules.
It is needed for our legitimate interests, for example to keep our service secure and to prevent fraud, as far as these do not override your rights.

3.3 We do not use personal data for automated decisions that have a legal or similarly significant effect on you.

4. Cookies and the referral cookie

4.1 We use cookies that are strictly necessary to keep you signed in, to protect your session and to remember basic settings. These do not need your consent.

4.2 The tl_ref cookie. If you arrive at https://tarleaks.com through a partner's link, we set a first-party cookie called tl_ref. It stores the partner reference from the link and the date. It stays for 60 days. If you arrive through another partner's link in that time, the cookie is updated and the last link wins, unless an approved deal registration applies for your company. If you then create a workspace, we use the cookie to credit the partner.

4.3 tl_ref does not follow you to other websites and is not used for advertising. It never changes the price you pay.

4.4 Where the law requires your consent for a cookie, we ask for it on the website, and we do not set the cookie if you decline. You can delete cookies at any time in your browser settings. If you delete tl_ref, the partner may not be credited.

4.5 We will list any other cookies or similar tools that we use, and what each is for, on https://tarleaks.com.

5. Who we share personal data with

5.1 We do not sell personal data.

5.2 Service providers. We use providers who help us run Tarleaks, such as hosting, e-mail, payment processing, support and security. They may act as our processors and only for our purposes. Our list of sub-processors is at https://tarleaks.com/security/.

5.3 Partners. If a partner introduced a client, we share with that partner only: the company name, plan or seat-count band, whether the account is active or suspended, and the invoice totals needed to explain the partner's commission. The partner has no access to the client's workspace unless the client invites the partner as a normal user.

5.4 Authorities and advisers. We share personal data with regulators, tax authorities, courts and law enforcement when the law requires it, and with professional advisers, such as auditors and lawyers, who are bound by confidentiality.

5.5 Business changes. If we merge with, or sell part of our business to another company, personal data may pass to that company. We will tell you, and the same protections will continue.

6. Transfers outside your country

6.1 Our team and providers may be in countries other than yours. When personal data is transferred outside the UAE, the DIFC, the ADGM or Saudi Arabia, we do so only as the law allows, for example to a country recognised as giving adequate protection, or under contract terms that protect the data, or with your consent where required.

6.2 If you would like to know more about the safeguards for a transfer, write to info@tarleaks.com.

7. Security

7.1 We protect personal data with technical and organisational measures that suit the risk, such as access controls, encryption and monitoring. Details are on https://tarleaks.com/security/.

7.2 If a personal data breach happens, we will act quickly. For business data in a client's workspace, we tell the client without undue delay and in any case within 72 hours of becoming aware. For data we control, we notify the authority and the people affected where the law requires.

8. How long we keep personal data

8.1 We keep personal data only as long as we need it for the purpose it was collected, or as long as the law requires.

Data	How long
Account and user details	While the account is active, then for a short period needed for closing the account and any dispute
Invoices, receipts, credit notes and tax records	5 years, as UAE VAT rules require
Partner agreements, statements, payouts and tax documents	5 years
Sanctions and anti-money-laundering screening records	As the law requires
Messages to us	As long as needed to answer you and handle any follow-up
`tl_ref` cookie	60 days
Business data in a client's workspace	As the Terms of Service, the Payment and Grace Period Policy and the Data Processing Agreement say. We never delete it automatically.

8.2 When we no longer need personal data, we delete it or make it anonymous.

9. Your rights

9.1 Under the PDPL and similar laws you may have the right to:

know whether we hold personal data about you and get a copy of it;
ask us to correct data that is wrong or incomplete;
ask us to delete data, or to restrict how we use it;
receive your data in a structured, machine-readable format, or ask us to send it to another provider;
object to certain uses, including direct marketing; and
withdraw your consent, if we rely on it.

9.2 To use a right, write to info@tarleaks.com. We may ask you to prove who you are. We will reply without undue delay.

9.3 Some rights have limits. We may keep data that we must keep by law, such as tax records, and we will explain if we cannot do what you ask.

9.4 If you are not satisfied with our reply, you can complain to the competent data protection authority, such as the UAE Data Office, or the authority in your country.

10. Children

10.1 Tarleaks is for businesses. It is not meant for people under 18, and we do not knowingly collect their personal data. If you think we have, please tell us at info@tarleaks.com.

11. Changes to this policy

11.1 We may update this policy. For a significant change we will give notice on https://tarleaks.com and by e-mail to account owners and partners before it applies. The latest version is always on https://tarleaks.com.

12. Contact

12.1 For privacy questions and requests write to info@tarleaks.com, or to Tarleaks, United Arab Emirates.

The Tarleaks ERP mobile app

Tarleaks ERP is the mobile app of Tarleaks for iPhone, iPad and Android. A company that uses Tarleaks creates the accounts of its staff (and, where it uses them, of its customers); a person cannot sign up in the app. This section says what the app collects, why, where it goes, who else receives part of it, how long it is kept, and how to have your account and data deleted. The rest of this Privacy Policy also applies.

Who is responsible for your data

Everything you enter or send in the app goes to your company's own Tarleaks workspace (its address looks like yourcompany.tarleaks.com, or it is a server the company runs itself). For that data your company is the controller: it decides why your data is used and how long it is kept. Tarleaks is its processor: we run the service on the company's instructions, under the Data Processing Agreement, and use the data for nothing else (section 2 above). Questions about your work records go to your company first; we help it answer you.

What the app collects and why

What	Why	Is it optional?	Where it goes
Your account: name, work e-mail, user id, sign-in and security records	To sign you in to your company and keep your account safe	No	Your company's workspace
Precise location, only at the moment you clock in or out, or record a customer visit, a delivery or an incident (with its accuracy, and a sign of a faked location). If you share only your approximate location, that is what is sent. Never in the background	Your company's attendance and field-work rules	Your company decides whether a position is needed. You can refuse the phone's permission and say why	Your company's workspace
A selfie at clock-in, when your company asks for one, with the result of a check on the phone that a real person is in front of the camera	To show that it is you who clocked in	Your company decides	Your company's workspace
Face matching (biometric data), only when your company turns it on: the reference photos of your face your company asks for (2 with the face check built into Tarleaks, straight on and turned to the side; 6 or 8 for a setup made before November 2026; 2 or 3 with an outside matching service), and your agreement (which notice, in which language, when). The app keeps no face template. On an iPhone with Face ID, a depth check is made on the phone and only its verdict and two measurements are sent; the depth map never leaves the phone	To compare the clock-in selfie with your reference photos	Yes. You choose whether to register, and withdrawing your agreement in the app deletes the photos	Your company's storage. The comparison is made by Amazon Web Services (Amazon Rekognition) in your company's own AWS account, or by a service your company runs
Camera photos, scans and files you attach: receipts, bills, documents, a business card, a medical certificate for sick leave (health information), photos of work	To file what you send with your request, claim or record	Yes	Your company's workspace
Microphone and voice: calls and meetings (relayed live; your company may record meetings on its own server), voice messages and their text, and speech to text when you tap a microphone (done by the phone's own speech service from Apple or Google; the app receives text only)	Calls, voice messages and typing by speaking	Yes. The phone asks for the microphone the first time you use it	Your company's workspace and call server; speech to text: Apple or Google
Push token and device details: the token Apple or Google gives the app, the phone's model name, a random id made for this installation, the app version and your language	To deliver notifications, list your signed-in devices and protect your sessions	Notifications: yes, you can refuse them. The rest: no	Your company's workspace; the notification itself travels through Apple or Google
Calendar, write only: a meeting, visit or activity you choose to add. The app never reads your events (on Android it reads only the list of calendars, on the phone, to find one it may write to)	To add it to your calendar when you ask	Yes	Stays on your phone
NFC tag codes: a badge or an asset tag, only when you tap "Tap a badge or tag"	To identify the badge or asset you scanned	Yes	Your company's workspace
Requests to the AI assistant and AI features, when your company turns them on: what you ask the assistant, questions about your documents, chat translations and summaries, the text of a voice note, a scanned business card, a document to read, the words of a diagram to draw	To give you the answer you asked for	Your company turns each feature on; you choose whether to use it	Your company's workspace, which sends the request to the AI provider your company chose (Groq by default). The phone never sends it to the provider itself
Everything else you enter: your HR profile, leave and other requests, expense claims, chat messages, tasks, customer and stock records, and so on	The purpose of the app	Yes	Your company's workspace
Crash reports: today's store builds send none. When we turn them on, a crash or a slow screen sends the error, the app version, the phone model and the system version, with names, e-mail addresses, tokens, request contents and screenshots removed first	To find and fix faults	No	Our own GlitchTip server, run by Tarleaks
Widgets and reminders you turn on: whether you are on the clock, your leave balance, requests waiting, your next meeting, your shift times	To show them on your home screen, lock screen or as reminders	Yes	Stays on your phone; removed when you sign out

What the app never collects

Your phone's contacts. The app does not read your address book and does not ask for permission to. "Contacts" in the app are your company's own customer and supplier records.
Your location in the background, your photo library beyond the pictures you pick, the events in your calendar, health data stored on the phone, the contents of your clipboard, Bluetooth or Wi-Fi scans of what is near you.
Your fingerprint or the face behind Face ID: the phone only answers "yes, it is you".
Advertising identifiers. The app shows no advertising, contains no advertising or third-party analytics code, does not follow you across other companies' apps or websites, and does not sell your data.

Other companies that receive part of the data

Besides your company and Tarleaks, these companies receive the data below, each under its own privacy terms. None of them receives the content of your work records from the app.

Company	What it receives	Why
Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging)	The notification for your phone: ids, a type and a neutral title, never personal details. On Android, Firebase also makes an installation id and receives the app version	Delivering notifications
Google ML Kit (Android only)	Face detection runs on the phone and no picture leaves it. ML Kit sends Google its own usage data: phone model and system version, app version, an installation id, timings and error codes	Google's checks of its face detector
Apple and Google speech and map services	Your speech when you tap a microphone; the area of a map you open, and an address to look up	Speech to text, maps and addresses
Expo (app updates, run by 650 Industries)	The app's id, version and update channel, the phone's system and its network address. No account data	Delivering fixes to the app
The AI provider your company chose (Groq by default)	What you send to an AI feature, through your company's workspace, when your company turns AI on	AI answers
Amazon Web Services, in your company's own AWS account	Your reference photos and clock-in selfie, when your company turns face matching on	Face comparison
Tarleaks's own GlitchTip server	Crash reports with personal data removed, once they are turned on	Fixing faults

How long it is kept

On your phone: until you sign out, remove the company from the phone, or your company signs the phone out. Each company's data on the phone is kept apart and encrypted, and all of it is deleted then. Removing the app also removes it.
In your company's workspace: for as long as your company decides, within the law (labour, payroll and tax records have legal minimum periods) and its agreement with us. Copies in backups age out, normally within 30 days.
Face reference photos: until you withdraw your agreement in the app (they are deleted at once) or your company deletes them.
Push tokens and device details: until you sign out or the device is removed from your signed-in devices.
Crash reports: as long as needed to fix the fault, and no longer than 90 days.

Your rights

Under the UAE and Saudi data protection laws (and, where it applies to you, the EU General Data Protection Regulation) you may ask to see your data and get a copy, correct it, delete it, restrict or object to a use, receive it in a file to take elsewhere, and withdraw an agreement you gave (for example, to face matching). Ask your company first: in the app, Me > Privacy and your data sends it your request, and you see the answer there. You can also write to us at info@tarleaks.com and we will help your company answer. If you are not satisfied, you can complain to the data protection authority, such as the UAE Data Office, the Saudi Data and AI Authority (SDAIA), or the authority where you live.

Deleting your account and data

Your account belongs to your company, so your company decides what is deleted and carries it out; we act on its instruction. You can ask in three ways: in the app (Me > Privacy and your data), through your company's administrator, or without the app on the page Delete your Tarleaks ERP account and data, which also says what is deleted, what the law makes your company keep, and how long it takes. In the app you can also remove all of a company's data from your phone at once.

YouTube and Google API data

YouTube API Services. The Social module of Tarleaks ERP uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms), and the Google Privacy Policy (https://policies.google.com/privacy) applies to what Google handles.
What we access and why. We read your channel's name, picture and counts, its playlists, its comments and its analytics, so your team can see and answer them in one place. We upload videos, set thumbnails and moderate comments only when someone on your team asks us to, and only on channels your company has connected.
How it is stored and who sees it. Your access tokens are stored encrypted and separately for your company. The YouTube data we keep is visible only to the people in your company whom your administrator has allowed to use Social. We do not sell it, we do not use it for advertising, and we do not share it with anyone else.
Stop at any time. Disconnect the channel in Social > Accounts: we delete the stored access tokens at once and the YouTube data we hold within 7 days. Or remove Tarleaks ERP's access in your Google account at https://myaccount.google.com/permissions: Google then stops accepting our access, and we delete the YouTube data within 30 days of the first time we find that out (our next sync with your channel).
Limited Use. Tarleaks ERP's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Added on 7 November 2026. This section was added to the notice for YouTube channels. It does not change the Privacy Policy above.

How this website counts visits

Counting visits. This site counts visits with its own small script, served from this site. The visit counter sets no cookies and runs no script from another company: no advertising pixels and no third-party analytics, and the fonts are served from this site too. Global Privacy Control is honoured and Do Not Track signals are not read. Every item the site keeps in your browser, including the two cookies a partner link can set, is listed on Cookies and storage.
What is recorded about a visit: the pages you open and when; how long you actively read and how far you scroll; the links and buttons you click (a link's address without anything after the “?”, a button's words); the forms you start, send or leave, never what you type in them; the words you search for on this site (a search that contains an email address, a web address or a phone number is recorded without its words); how much text you copy (its length only, never the text); page speed and script errors; your browser, system, type of device, screen and window size, language and time zone; and the website or campaign that sent you: the site's name only, never the full address, the campaign tags in the link (such as utm_source), and whether an ad click id was present, never its value.
Approximate location: the country, region and city, worked out from your network address with the DB-IP database (IP geolocation by DB-IP). Your network address itself is not stored with your visits, and this website's web server keeps no log of page requests. To spot automated traffic and floods, a one-way scrambled fingerprint of the address is kept, made with a secret key and the day's date, so the same address gives a different fingerprint each day; it is deleted after two days.
Your visitor code: a random code made in your browser and kept up to 13 months from your first visit, which connects your visits. It is not a cookie. Some browsers, such as Safari and every browser on iPhone, delete it sooner (after about seven days without a visit), and you are then counted as a new visitor.
Requests you send: what you type into a form (name, email, company, country, phone, message, the optional details you add such as company size, what you want to see, preferred language, time and time zone) and the page you sent it from. It becomes a ticket in our support desk and is used only to answer you. A demo, contact or partner request also records your visitor code and how you found us (campaign, source and the first page you opened), so the request can be linked to the pages you read before. The “how you found us” details stay with the request for as long as the request is kept; the link to your visits (the visitor code) is removed from the request 13 months after it was sent, or earlier if you ask.
Why: to understand which pages and campaigns help people, to improve the site and to measure our marketing. The basis is our legitimate interest in running and improving this website.
Who sees it: Tarleaks platform administrators only, signed in with two-factor authentication. It is not sold, not shared and not used for advertising.
Where it is kept: on servers Tarleaks rents in a professional data centre outside the United Arab Emirates and Saudi Arabia. Your visit records are therefore stored outside the UAE and Saudi Arabia.
How long: visit records are deleted automatically 13 months after the visit, and your visitor code expires at most 13 months after your first visit.
Your choices: turn off “Count my visits” on Cookies and storage, and this browser records and sends nothing more. Global Privacy Control is honoured: nothing is sent, and our server discards any request that carries it. Clearing this site's data in your browser removes your visitor code. To delete what is already stored, copy the visitor code shown on Cookies and storage and send it through the contact form (topic: privacy). We delete it within 30 days, the code is then refused for good (anything it sends later is discarded), and the link from any request you sent to your visits is removed. It is best to also turn counting off or clear the site's data afterwards.
Never recorded: no screen recording, no keystrokes, and nothing you type into a field.