Privacy

Last updated 12 October 2026.

ACTAS is the back office for Saudi companies of 10 to 50. A company sets it up at portal.actas.app, and its employees use the web portal and the ACTAS app for iPhone. This page says what ACTAS collects, why, who processes it, and how long it is kept. Questions go to hello@actas.app.

Two kinds of people

Companies are our customers. A company's administrator opens the account, enters the company's records, and decides which functions are on. For those records, the company is the controller and ACTAS processes them on the company's instructions.

To run the service, we look at a summary of each company's account: what it has switched on and how much it is used. The summary shows counts and states, never what is in the company's records.

Employees use ACTAS because their employer invited them. Their records are their employer's records. An employee who wants a record changed or removed asks their employer; ACTAS carries out what the employer decides, within what Saudi regulation requires the employer to keep.

What a company gives us

• The company account: company name, the administrator's name, work email, and password. Passwords are stored only as a one-way hash.
• Employee records the company enters: name, work email, job title, start date, who reports to whom, leave entitlements and requests, uploaded documents and their expiry dates, insurance details, attendance marks, and requests raised inside the company.
• Customer support conversations, when a company connects its X account to the support function. ACTAS then receives the public mentions and direct messages that customers send to that account, and nothing older than the moment the company switched it on.

What the iPhone app collects

• Sign-in. Your work email and password, sent once to open a session. The app keeps only a session token, in the phone's secure storage.
• Face ID or Touch ID. Used only to unlock that saved session, through the phone's own system. No biometric data reaches ACTAS.
• Check-in and check-out. The time you tapped, as seen by the phone and by our server.
• Location, sometimes. If your company's attendance policy requires it, the app asks for your location at the moment you tap Check in or Check out, once, in the foreground. It sends that one position and its accuracy to our server, which records whether you were inside the office boundary the company set. There is no background location, no continuous tracking, and no map. Coordinates are kept as evidence on the server and are not shown in the portal; the company sees the result, inside or outside.
• Product analytics. The app uses PostHog, the same service as the website and portal, to record which screens you open, what you tap, whether sign-in, unlock, check-in and check-out succeed or fail, and errors the app did not expect. Signed-in employees are identified by their employee id. PostHog also records the phone's model, operating system, app version, a random id for the installation, and a city and country worked out from the connection's IP address. The app does not record your screen, and nothing you type is sent to PostHog. PostHog stores this data in the United States.

The app contains no advertising software.

What the website and portal collect

• Session cookie. Keeps you signed in to the portal. It is not readable by scripts.
• Product analytics. On www.actas.app and portal.actas.app we use PostHog to record page views, clicks, and session replays so we can see where the product confuses people. Signed-in people are identified by account id, work email, and company. Passwords and other secret fields are masked; invitation, reset, and verification links are never recorded. PostHog stores this data in the United States. Deleting our PostHog key stops all capture at once.
• Analytics cookie. PostHog keeps a random visitor id in a cookie on actas.app and in your browser's local storage. The cookie is shared by www.actas.app and portal.actas.app, so a visit to the website and a later signup are counted as one person. It is not used to follow you on other sites.
• Where a visitor came from. If you reach www.actas.app from a Google or X ad, the click id the ad network adds to the link (gclid, gbraid, wbraid or twclid) is recorded with your analytics profile, together with the from tag on our own links. We use them to tell which ads and links lead to signups.
• The from tag, for one tab. The website keeps that tag in your browser's session storage until you close the tab, so the signup button still carries it after you move between pages.
• Fonts. Our pages load their fonts from Google Fonts, so your browser asks Google for them. Google sees your IP address and the page's address when it does.
• Server logs. Cloudflare records requests to our services, including IP addresses, for security and to keep the service running.

Who processes data for us

• Cloudflare runs our servers and stores our database and queues.
• Resend sends our email: invitations, sign-in help, verification, and notices.
• PostHog holds the product analytics described above.
• Expo delivers updates to the ACTAS app. When the app opens it asks Expo for a newer version, so Expo sees the phone's IP address and the app's version.
• Google serves the fonts on our pages.
• X, only for companies that connect an X account to customer support, and only through X's official interfaces with the company's authorization.

We do not sell data and we do not share it with advertisers.

How long we keep it

• A company's records stay for as long as the company's account is open. When a company leaves ACTAS, it asks us to delete its account, and we delete every record that belongs to it.
• Ending an employee's access ends their sessions at once. Their record stays with the employer's records, because it is part of the employer's obligations.
• A revoked session token is invalid immediately.

Your rights

Under the Saudi Personal Data Protection Law you may ask what we hold about you, ask for it to be corrected, and ask for it to be deleted. If you are an employee, send the request to your employer first, because they decide what their records say. Either way, you can write to hello@actas.app and we will answer within thirty days.

Children

ACTAS is for people at work. It is not directed at children and we do not knowingly collect anything from them.

Changes

When this page changes, the date at the top changes with it. A change that affects what we collect is told to company administrators by email before it takes effect.