Privacy Policy

1.Who we are and how to reach us

Tavroo is a project and task management platform for teams, operated by Shaghaf Technology. Shaghaf Technology is the party responsible for the personal data described on this page.

The official channel for everything to do with privacy is info@tavroo.com: your questions, a request for a copy of your data, a request to delete your account, and any complaint. Write from the address registered on your account so that we can recognise you.

2.What this policy covers

This policy applies to the Tavroo website, the web application, and the email and notifications that go with them. It does not apply to other sites or services you may reach from inside Tavroo.

We distinguish two kinds: your account data, which is about you; and your organisation’s content, which is what you and your team write inside Tavroo — tasks, comments, files. Organisation content belongs to our customer, the organisation that created the account; we store and process it on its behalf.

3.What we collect and why

Your account

To create an account we ask for an email address and a password. The other fields are optional and you add them yourself from your settings:

• Email address — the account identifier, and where notifications, the address-confirmation link and password resets are sent.
• Password — we do not store it as text. We store only a bcrypt hash of it, from which the password cannot be recovered.
• Full name, job title and a short bio — so your team can recognise you inside the organisation.
• Mobile number — optional, used to activate WhatsApp notifications if you ask for them.
• Profile picture — a file you upload. User pictures are served over a public link inside the app, so they are not confidential.
• Timezone, language and theme — so dates, text and the interface appear as you expect.
• Your notification choices, the state of the product tour, and the dates the account was created and last updated.

What you create inside Tavroo

We store what you write and upload in order to run the service: organisations, workspaces, projects, tasks, comments, chat, uploaded files, time entries, goals, commitments, saved views, templates and the activity log. This content is visible to members of your organisation according to their permissions, and every request is permission-checked on the server.

Uploaded files are stored on disk in a directory the web server does not serve directly; downloading one goes through a request that checks you are signed in and allowed to see that task. Chat is a deliberate exception: there is no code path that lets an organisation admin or a platform admin read a conversation they are not a participant in.

Signing in with Google or Apple

If you choose to sign in with a Google or Apple account, we ask the provider for the minimum: identity, email and name. From its answer we keep: the provider’s name, your stable identifier there, the email it sent, whether the provider had verified that email, whether it is an Apple private relay address, the display name, how the link was made, and the dates of linking and last sign-in.

We do not keep an access token or a refresh token from the provider, and we do not read your contacts, your mail, your files or your picture there. The temporary sign-in flow records are deleted one day after they expire.

WhatsApp and Telegram

WhatsApp and Telegram notifications are off until you ask for them. We do not message you on either channel before you link it yourself, and you can stop it at any time from your settings or by sending a stop word to the number.

For WhatsApp we keep your number, the activation state, a hash of the verification code, the activation and last-inbound dates, and your choices of which notifications to receive. You have a switch that keeps row details out of the message, so the notification arrives without content. The text of an outgoing message is erased from our database once it has been sent.

For Telegram we keep your Telegram user id and chat id, the date of linking and the last time you were seen. Telegram messages carry the notification content as it is.

Subscription and invoices

If your organisation enters invoicing details, we keep at organisation level: the legal name, the VAT number, the commercial registration number, country, city, district, street, building number, postal code, and the billing email and phone. These are required for a tax invoice.

Tavroo has no payment gateway. If a card is recorded we keep only its type, the last four digits, the expiry month and year, and the holder’s name; the full card number is not stored in our database. Payments are collected outside the platform and recorded by hand.

Support tickets

When you open a support ticket we keep its subject and messages, together with the address of the page you were on and your browser identification string, so we can understand the problem. Support tickets survive account deletion as a record of the correspondence, but the browser string is erased from them.

Session and technical logs

Tavroo sets no cookies at all. Your session is kept in your browser’s local storage, which is not sent automatically with every request.

What we put in local storage: the session token, your language, the organisation you are currently working in, the theme, and technical keys that prevent page redirect loops. The session token is valid for seven days and is invalidated when you change your password, revoke sessions, or the account is disabled. A platform administrator’s impersonation token is valid for one hour.

IP address: we do not store it as-is in the user tables. Where we need to tell requests apart, we store a short derived fingerprint that cannot be turned back into the address. The one exception is the platform administrators’ audit log: it holds the address and the browser string as they are, because an administrator’s action must be traceable.

Server logs: the web server’s access log contains the IP address and is kept for fourteen days, then deleted. The application log contains only the request method, path, status and duration — no IP address and no browser string.

We use no external analytics tool, no advertising network and no cross-site tracker.

Messages we send you

We send service email: address confirmation, password resets, invitations, notifications about tasks, comments, mentions and reminders, and summaries. You can turn all notification email off from your settings; essential account email such as address confirmation and password reset stays, because it is part of running the account.

Our platform administrator has an announcements screen that can send a single email to every Tavroo user, or to one organisation, or to one user. For each announcement we keep the message text and the list of recipients with their email, name, language and delivery status. We use it for service matters, not to market somebody else’s product.

4.Why we are allowed to process this

• Performing the contract: your account data and your organisation’s content are needed to deliver the service you asked for.
• Your consent: WhatsApp and Telegram notifications, and the AI assistant, only work on an explicit request, and consent can be withdrawn at any time.
• Legitimate interest: securing the account, preventing abuse, technical audit logs, and improving the service.
• Legal obligation: invoices and accounting records are kept for the period the applicable regulations require.

5.Third parties that receive data

We do not sell your data and we do not trade in it. The parties below are everyone who receives any of it today, and each has its own policy and may retain what reaches it:

6.How long we keep things

Your organisation’s content and your account data stay for as long as the account exists. The following have a fixed lifetime that the server enforces automatically every night:

• The text of an outgoing WhatsApp message: erased the moment it is sent. The send record itself stays ninety days.
• Technical WhatsApp events: one hundred and eighty days.
• Periodic summaries: sixty days.
• The task history the server writes: four hundred days.
• Temporary sign-in records, invitation tokens and link tokens: deleted after they expire, and they expire in hours or days.
• The web server’s access log: fourteen days.

To be plain about it: the activity log inside an organisation and the platform administrators’ audit log are not deleted automatically after a period. They stay as long as the organisation does, and the activity log goes when the organisation is fully purged.

And about backups, plainly: we have no scheduled backup system for the Tavroo database. What is taken are manual copies before large maintenance operations, kept on the same server. Two things follow: deleting your data from the live service does not erase it from an older manual copy while that copy exists, and you should keep a copy of what matters to you outside Tavroo.

7.Your rights and how to use them

You may ask to: access your data, correct it, delete your account, withdraw your consent to a channel or a feature, and object to a particular kind of processing. Most of these you do yourself from your settings: name, phone, picture, language, notifications, and the WhatsApp and Telegram channels.

For what you cannot do yourself — a copy of your data, or deleting the account — write to info@tavroo.com from the address registered on the account. To be plain about it: Tavroo has no button today that exports your data and no button that deletes your account; we carry the request out by hand.

We answer any request about your data within thirty days of receiving it. If a request genuinely needs longer, we will tell you that and why before the thirty days are up.

8.Deleting an account, and what survives it

Deleting an account here does not erase rows; it removes the identity. This is what actually happens:

Removed or replaced

• Your email is replaced with an address that can never receive mail, your name with a "Deleted user" marker; the job title, bio, phone and picture are cleared, and the password is replaced with a value nobody knows.
• All your memberships are deleted: organisation, workspaces, projects, teams and the file bank. Your sessions end immediately.
• Your personal state is deleted: notifications, read marks, saved views, summaries and commitments.
• The WhatsApp link and its number, the Telegram link, any Google or Apple account link, the proof of your address and its confirmation links are deleted, and pending invitations to your address are revoked.
• We scrub old copies of your name and email out of other people’s notifications, the activity log and the announcement lists, and your picture file is deleted from disk if nobody else uses it.

Stays as it is

• Your work stays where it is, attributed to "Deleted user": the tasks you created, your comments, the files you uploaded, your time entries, and the projects, workspaces, teams, goals and automations you created. That is the organisation’s content, and we do not remove it from under its members.
• Support tickets stay as a record of the correspondence, attributed to "Deleted user".
• The account row itself stays, disabled, with an address that can never receive mail, so that references to your work do not break.
• Invoices, the subscription and the invoicing details stay, because they are accounting records.
• The platform administrators’ audit log stays. On deletion we write into it a fingerprint of your email that cannot be turned back into it, not the address itself. But an older administrative action on your account may have recorded your address as it was, and that stays.

One condition blocks deletion: if you are the only owner of a live organisation, its ownership must be transferred or the organisation deleted first, otherwise an organisation would be left with no owner.

Deleting a whole organisation is two steps: disabling it, then purging it. The purge deletes workspaces, projects, tasks, teams, goals, automations, the file bank, invitations and the files on disk. The organisation row, the invoices, the subscription, the invoicing details and the support tickets stay.

9.Cookies

Tavroo sets no cookies — not for signing in, not for analytics, not for advertising. That is why you see no cookie consent banner in Tavroo. What we use is your browser’s local storage, described in the session section above; clearing the site’s data in your browser removes it.

10.The service is not for children

Tavroo is a work tool for teams, is not directed at anyone under sixteen, and we do not allow them to create an account. If we learn that an account belongs to someone under that age, we remove it. If you are a guardian and believe your child created an account, write to info@tavroo.com.

11.What we do to protect your data

These are the measures that are actually in place, not a wish list:

• Every connection to Tavroo is encrypted with HTTPS.
• Passwords are stored as a bcrypt hash, and invitation tokens, confirmation links and link tokens are stored as a SHA-256 hash rather than as text.
• Permissions are checked on the server inside the query itself, not by hiding elements in the interface.
• Uploaded files sit in a directory the web server does not serve directly, and downloading one goes through a permission check.
• The staging and production environments each have their own database user that cannot reach the other, and the repository’s internal files are blocked at the web server.
• Every action a platform administrator takes is written to an audit log with its reason, and the action is never applied without being recorded.

And what we do not claim: we hold no security certification, Tavroo has had no independent security audit, we do not claim the database is encrypted at rest, and we make no promise that your data stays in a particular country. No system is immune; so protect your password and do not share it.

To be plain about this too: our platform administrator can enter your account with your permissions for support purposes. That access is limited to one hour, recorded in the audit log with its reason, and shown inside the app while it lasts. It does not let them read your chats.

12.Changes to this policy

We may update this page when the service changes. The date of the last update is written at the top of the page. If a change is material to how we handle your data, we will tell you by email or inside the app before it takes effect.

13.Contact and complaints

For any question, request or complaint about your privacy, write to info@tavroo.com and we will reply. If our answer does not satisfy you, you may raise the matter with the competent data protection authority in Saudi Arabia.