Privacy Policy

Who we are and who the platform is for

IAD Advisor Hub (hub.iad-sa.com) and its iPhone app “IAD Hub” are operated by IAD Business Services Group in Saudi Arabia. The platform is a private work tool for the Group's network advisors and team: accounts are issued by the Group, and there is no public sign-up in the app.

What we keep

• Account: name, email, phone and role. Your password is stored hashed, never as text.
• Professional profile: experience, specialisation and fees, your profile photo if you upload one, and documents you upload such as your CV, ID and certificates.
• Financial details: IBAN, bank name and VAT number to pay you, plus the invoices, payments and fees linked to your work.
• Work data: assignments, hours, deliverables and the files you upload, meetings and notes.
• Messages: your comments and assignment conversations with the team, your chats with IAD Intelligence, and your messages to the Group's WhatsApp number.
• Activity log: each page you open, file you download and action you take, with the time, IP address and a short device and browser description. Platform administrators can see it, and entries older than 180 days are deleted.
• Security: sign-in records (time, IP address, failed attempts), session cookies, sign-in codes (hashed) and an audit trail of changes.

In the iPhone app

• Face ID: verified by iOS on your device; the app never receives biometric data.
• Camera: opens only when you choose to scan a document. The scan becomes a PDF on your device and is uploaded only when you tap Upload.
• Files: a file you share to the app from another app, or pick from Files, is uploaded only after you confirm.
• Notifications: if you allow them, we store your device's notification token linked to your session to deliver Hub notifications through Apple's service; it is deleted when you sign out.
• Advisor card: its QR code carries your name, title, mobile and email, so anyone you show the card to can save them. Its verification link opens a public page showing only your name, photo, specialisation and whether the card is valid — no phone or email.
• Reminders: weekly-hours and deliverable reminders are scheduled on your device itself.
• No ads, no cross-app tracking, no third-party analytics, and we never sell your data. The activity log above stays inside the platform.

Why we use it

To run assignments and hours, review deliverables, issue invoices and pay advisors, send notifications, protect accounts from unauthorised access, and meet contractual, accounting and legal obligations.

Who processes it for us

• Cloudflare — all platform and app traffic passes through it before reaching our servers, including your IP address and request contents, for protection and delivery.
• Hetzner Online — server and database hosting in Helsinki, Finland.
• Microsoft 365 — email delivery (notifications and sign-in codes) and meeting invitations.
• Meta (WhatsApp Business) — WhatsApp notifications, which you can turn off in your profile.
• OpenAI — the optional “IAD Intelligence” feature. Nothing is sent for you until you agree on the IAD Intelligence consent page inside the platform, and you can withdraw there at any time. That page lists what is sent for your role: for advisors, the text you ask it to rewrite and, in the chat, your name, role and a summary of your assignments, deliverables and invoices; for management, wider data about clients, engagements and advisors. WhatsApp messages from an account holder who has not agreed are not sent to it. If you message the Group's number without a platform account, your messages may be sent to it so an automated assistant can reply or prepare a reply for our team.
• Apple — delivering app notifications.
• Google Fonts — some pages and documents load fonts from Google's servers, so Google receives your device's IP address when they load.
• We work with these parties as service providers and expect them to protect data at a level no lower than this policy describes.

How long we keep it

We keep work and billing data for the duration of the working relationship, and afterwards as accounting, tax and contractual rules require. The activity log is kept for 180 days and read notifications for 365 days. Sign-in sessions expire automatically: 7 days in the browser, 30 days in the app.

Your rights

You may access and correct your data (mostly from your profile), and ask us to delete your account or data, under Saudi Arabia's Personal Data Protection Law. Request account deletion after confirming your password: in the app under More, then Request account deletion; on the web from your account page. We process account deletion requests within 30 days and contact you with the outcome. Our team reviews the request, erases the account and its personal data, and keeps accounting, contract and work records attributed to “Deleted account” as the rules require; earlier copies may remain in backups until they are replaced. The page explains what is erased and what stays. For anything else, email us from your registered address at hello@iad-sa.com.

Security

Connections are encrypted (HTTPS), passwords are hashed, sign-in uses a second step by email code, access is role-based, and every significant change is recorded in an audit trail.

Changes and contact

We update this page whenever anything changes and show the date at the top. Questions: hello@iad-sa.com.