Privacy Policy

Maydan ميدان — Privacy Policy

Effective 4 September 2026 · Volta (TRAAC), Cairo, Egypt · app.maydan.field · العربية

1 · Who operates Maydan

Maydan is published and operated by Volta (TRAAC), Cairo, Egypt ("we", "us"). We are the data controller for the account and synchronisation data described below. Contact: [email protected].

This policy covers the Maydan mobile application (iOS and Android, bundle identifier app.maydan.field) and the Maydan service it talks to. It does not cover your employer's own systems, which are described in section 8.

2 · What Maydan is, and whose data it holds

Maydan is a work tool. It is bought by a company that already runs an ERP system, and it is used by that company's field staff — property agents, surveyors, inspectors — to record visits away from a desk and to see stock and customer information while standing in front of it.

Two different kinds of people appear in the data:

• Users — the field staff and managers who sign in. Your employer creates the account; you do not register yourself.
• Business contacts — the customers and prospects your employer already holds records about, whose details pass through the app on the way to your employer's own system.

For the second group your employer is the controller and we are its processor: we hold that information on your employer's instructions, and requests about it should go to your employer first.

3 · What the app collects

What	Why	Kept
Workspace name, its ERP address and database name, licence key and seat limit	To connect the app to the right employer system and to count paid seats	For the life of the subscription
Your display name, work e-mail (optional), role and the identifier of your account on your employer's system	To sign you in and to decide what you are allowed to see	While your account is active
Your credential for your employer's system, held encrypted (ciphertext, initialisation vector and key version only)	So the app can read and write on your behalf without asking you to re-type it each time	Until you sign out or the account is closed
Device platform (iOS or Android), app version, runtime version, the time the device was last seen, and a push notification token if you enable notifications	To deliver notifications and to support the app when a version misbehaves	While the device is registered
Each item you record while offline: a device-generated identifier, the kind of record, its contents, and whether it was accepted, rejected or duplicated	This is the core of the product — the queue that survives no signal, and the guarantee that a retried record is written once and not twice	90 days after the item reaches your employer's system
Conflicts: the version you recorded and the version already on the server, side by side	So a person can decide which one is right instead of the app silently discarding work	Until resolved, then 90 days
Seat usage: the first and last time you used the app in a billing period	To bill your employer for the seats actually used	Seven years, as commercial records
An audit trail: which account did what, when, and a short description	Security. It is how a wrong or malicious change is traced	Two years

4 · Location

Maydan asks for your device location only at the moment you save a site visit, and it stores latitude, longitude and an accuracy figure with that one record. There is no background location, no tracking between visits, no movement history and no geofence. The app does not know where you are when it is closed, and it does not ask the operating system to tell it.

The location fix is deliberately allowed to fail. If your device cannot get a position within eight seconds — a basement, a stairwell, a half-built floor — the visit is saved anyway, with a note recording why the position is missing. You are never blocked from doing your job because of a satellite.

You can refuse the location permission and keep using the app. Visits will be saved without coordinates. Your employer can see that the coordinates are missing, because a field record with no position is a different thing from one with a position, and hiding that would make the record untrustworthy.

5 · Photos and the camera

Maydan can attach a photograph to a site visit — the state of a unit, a meter reading, a signed page. The image is reduced on the device before it leaves it (long edge 1600 pixels) and is attached to the visit record in your employer's own system. We do not build a separate photo library, we do not run face recognition or any other analysis on the image, and we do not read your camera roll: the app sees the single picture you choose or take, and nothing else in your gallery.

Only take photographs you are entitled to take. If a picture shows a person who can be identified, your employer is responsible for having a lawful reason to hold it.

6 · What Maydan does not collect

• No advertising identifier, no advertising, and no data is sold, rented or shared with a data broker. There are no third-party advertising or analytics SDKs in the app.
• No contact list, no calendar, no SMS, no call log, no microphone.
• No background location and no movement history.
• No health data, no financial account details, no biometrics.
• No cross-app or cross-site tracking of any kind.

7 · Why we are allowed to hold this

Under Egyptian Law 151 of 2018 on the Protection of Personal Data, and under equivalent rules where you are:

• Account, credential and synchronisation data — necessary to perform the contract between us and your employer, and to give you the service you were given the account for.
• Audit and security data — our legitimate interest in a service that can be investigated when something goes wrong, balanced by keeping it short and narrow.
• Location and photographs — your consent, given per permission in the operating system, and withdrawable at any time in the system settings without losing the rest of the app.

8 · Who else sees it

• Your employer. Everything you record in Maydan is recorded for them. Managers see visits per agent per week, including agents who logged nothing. This is not hidden from you and should not be a surprise: the product exists to make field work visible.
• Your employer's own ERP system, which may be hosted by them, by us under a separate hosting agreement, or by a third party they chose. Once a record reaches it, their own retention and privacy rules apply.
• Our hosting provider, for the servers and the database.
• Apple and Google, only as the stores that distribute the app and, if you enable notifications, as the operators of the push services that carry them.
• Nobody else. We do not sell or rent personal data, we do not share it for advertising, and we do not disclose it to authorities except where a valid Egyptian legal order compels us — in which case we tell the affected customer unless the order forbids it.

9 · Where it is stored, and for how long

Data is held on servers we operate. Where a customer requires the data to stay in a particular country, that is agreed in writing with them before the workspace is created. The retention periods in the table in section 3 are the defaults; a customer contract may set a shorter one, and a shorter one wins.

10 · Deleting your account and your data

Your Maydan account belongs to your employer's workspace, so:

• To delete your own account and its data, ask your employer's Maydan administrator, or write to [email protected] from the address on the account with the word delete in the subject. We remove the account, the stored credential, the devices and the synchronisation queue within thirty days, and confirm in writing when it is done.
• Records already written into your employer's system are their business records, not ours to delete. We tell you that plainly rather than promising a deletion we cannot carry out; ask your employer for those.
• When a workspace closes, all of its data is deleted within sixty days, except billing records we are required to keep.

11 · How it is protected

• Credentials for your employer's system are encrypted before they are stored, with a versioned key; they are never held in readable form.
• Passwords are stored as one-way hashes and cannot be read back by anyone, including us.
• Signing out anywhere invalidates the tokens everywhere — a lost phone is cut off from the account rather than merely logged out on that screen.
• Traffic between the app and the service is encrypted in transit.
• Access to production data is limited to the people who operate the service and is recorded in the audit trail.

No system is perfect. If a breach affects your data we notify the affected customer and, where the law requires it, the Egyptian authority, without undue delay.

12 · Children

Maydan is a workplace tool for adults. It is not directed at children, and we do not knowingly create accounts for anyone under 18. If you believe a child's data has reached us, write to us and we will delete it.

13 · How to reach us

Questions about this policy, a request to see, correct, export or delete your data, or a complaint about how Maydan handles it — write to [email protected] and put the word Maydan in the subject line. We answer within thirty days.

Postal and in-person contact: Volta (TRAAC), Cairo, Egypt.

If you are not satisfied with our answer, you may complain to the Egyptian Personal Data Protection Centre established under Law 151 of 2018.

14 · Changes to this policy

If we change what we collect, why we collect it, or who we share it with, we publish the new version at this address and change the effective date at the top. A change that materially widens what we collect is announced inside the app before it takes effect, and — where the law requires consent — asked for rather than assumed. This page is the whole policy; there is no second document.