Nova: Self Service – Privacy Policy
Effective Date: November 17, 2025
Last Updated: August 3, 2026
Version: 2.2.1
App: Nova: Self Service (iOS & Android)
Publisher: Mannai Energy / ECM Digital
Contact: ecm.digital.mannai@gmail.com
__________________________________________________
1. Introduction
This Privacy Policy describes how Nova: Self Service ("the App," "we," "us," or "our") collects, uses, stores, and protects your information when you use our mobile application for employee self-service HR functions.
Nova: Self Service is an enterprise application for Mannai Energy employees to manage attendance, leave requests, expense claims, document requests, payroll information, and other HR services.
By using the App as part of your employment with Mannai Energy, your data is processed per this policy under contractual necessity and legitimate interest bases.
__________________________________________________
2. Information We Collect
2.1 Information You Provide Directly
| Data Category | Examples | Purpose |
| --------------- | ---------- | --------- |
| **Account Credentials** | Employee ID, email, password (hashed) | Authentication, session management |
| **Profile Information** | Name, employee code, department, designation, contact details, photo | Employee identification, HR records |
| **HR Request Data** | Leave dates, expense amounts, loan details, document types, travel info | Processing HR requests |
| **Supporting Documents** | Receipts, medical certificates, passport copies, tickets (images/PDFs) | Request verification & compliance |
| **Emergency Contacts** | Names, phone numbers, relationships | Safety & HR compliance |
2.2 Information Collected Automatically
| Data Category | Examples | Purpose |
| --------------- | ---------- | --------- |
| **Precise Location (GPS)** | Latitude/longitude during check-in/out only | Attendance verification at designated work sites, geofencing validation |
| **Device Information** | Device model, OS version, unique device identifiers (IDFV/AAID), IP address | Analytics, fraud prevention, session security |
| **App Usage Data** | Screens visited, feature interactions, session duration, crash logs | Analytics, performance improvement, debugging |
| **Network Information** | Connection type, carrier, request/response metadata | Connectivity management, offline sync |
| **Firebase Data** | FCM tokens, analytics events, crash reports (Crashlytics), Remote Config | Push notifications, analytics, app stability, feature flags |
2.3 Information from Third Parties
| Source | Data Received | Purpose |
| -------- | --------------- | --------- |
| **Odoo HR Backend (Mannai Energy)** | Employee master data, leave balances, payroll info, project assignments | Core HR data synchronization |
| **Firebase (Google LLC)** | Analytics aggregation, crash reporting, push notification delivery | App performance, messaging, analytics |
__________________________________________________
3. How We Use Your Information
| Purpose | Legal Basis | Data Categories Used |
| --------- | ------------- | --------------------- |
| **Authentication & Session Management** | Contractual necessity | Account credentials, device identifiers |
| **Attendance Tracking (Check-in/Out)** | Contractual necessity | Precise location (during check-in/out only), timestamps, project assignment |
| **HR Request Processing** | Contractual necessity | Profile info, request details, supporting documents |
| **Leave & Expense Management** | Contractual necessity | Request data, approvals, balances |
| **Payroll & Document Access** | Contractual necessity | Payroll records, generated documents |
| **Push Notifications** | Legitimate interest | FCM tokens, request status updates |
| **Analytics & App Improvement** | Legitimate interest | Usage data, crash logs, device info |
| **Security & Fraud Prevention** | Legitimate interest | Device identifiers, IP, session data |
| **Legal Compliance** | Legal obligation | All categories as required by law |
Important: We do NOT use your data for advertising, marketing, or profiling unrelated to employment services.
__________________________________________________
4. Camera & Photo Library Access
The App requests permission to access:
Camera (`NSCameraUsageDescription` / Android `CAMERA`)
- QR Code Scanning: Quick authentication and action shortcuts
- Document Capture: Photographing expense receipts, medical certificates, tickets, and other supporting documents
- Profile Picture: Capturing a new profile photo
Photo Library (`NSPhotoLibraryUsageDescription` / Android `READ_MEDIA_IMAGES`)
- Document Attachment: Selecting existing photos/PDFs as supporting documents for HR requests
- Profile Picture: Choosing an existing photo for your profile
- Expense Receipts: Attaching receipt images from your gallery
No continuous access – Camera and photo library are accessed only when you explicitly tap an attachment or capture button.
__________________________________________________
5. Precise Location Data
The App collects precise GPS location (`NSLocationWhenInUseUsageDescription` / Android `ACCESS_FINE_LOCATION`) ONLY during:
1. Attendance Check-In: Verifying you are at an approved work location
2. Attendance Check-Out: Confirming departure from work location
3. Geofence Validation: Comparing your location against approved project/site boundaries
We do NOT:
- Track location continuously or in the background
- Collect location when the app is closed
- Use location for advertising or profiling
- Share precise location with third parties (except backend for attendance validation)
Location data is transmitted to the Mannai Energy Odoo backend solely for attendance record validation.
__________________________________________________
6. Third-Party Service Providers (Named Processors)
| Provider | Purpose | Data Shared | Privacy Policy |
| ---------- | --------- | ------------- | ---------------- |
| **Firebase / Google LLC** | Analytics, Crashlytics (crash reports), Cloud Messaging (FCM), Remote Config, Installations | Device IDs, usage events, crash logs, FCM tokens, app version, OS version | [Google Privacy Policy](https://policies.google.com/privacy) |
| **Google Play Services (Android)** | Location services, Maps API (if used) | Precise location (during check-in/out), device identifiers | [Google Privacy Policy](https://policies.google.com/privacy) |
| **Apple Push Notification Service (iOS)** | Push notification delivery | Device token (APNs) | [Apple Privacy Policy](https://www.apple.com/legal/privacy/) |
| **Mannai Energy Odoo Backend** | Core HR data, attendance validation, request processing | All HR data, employee records, location (check-in/out), documents | Internal corporate policy |
Note: Google Play Services and Apple Push Notification Service are OS-level services used solely for location and push delivery respectively.
Data Processing Agreements: All processors operate under contractual obligations consistent with this policy and applicable data protection laws.
__________________________________________________
7. Data Retention
| Data Category | Retention Period | Basis |
| --------------- | ------------------ | ------- |
| **Attendance Records (including location)** | 7 years | Corporate compliance, labor law |
| **HR Requests & Supporting Documents** | 7 years | Corporate compliance, audit requirements |
| **Payroll Records** | 7 years | Tax & labor law compliance |
| **Employee Profile Data** | Duration of employment + 3 years | HR record-keeping |
| **Analytics & Crash Data (Firebase)** | 14 months | Firebase default retention |
| **Push Notification Tokens (FCM/APNs)** | Active until app uninstalled or token refreshed | Messaging delivery |
| **Authentication Tokens / Sessions** | Active session + 30 days inactivity | Security, session management |
| **App Usage Logs** | 14 months | Analytics, product improvement |
Deletion Requests: You may request deletion of your personal data by contacting `ecm.digital.mannai@gmail.com`. Requests are processed within 30 days. Note: Certain data must be retained per legal/regulatory obligations (e.g., payroll, attendance).
__________________________________________________
8. Data Security
We implement appropriate technical and organizational measures:
- Encryption in Transit: TLS 1.2+ for all API communications
- Encryption at Rest: SQLite database encryption (SQLCipher), iOS Keychain / Android Keystore for sensitive tokens
- Authentication: Two-factor authentication (TOTP), secure session management with automatic expiry
- Access Control: Role-based access, principle of least privilege
- Offline Data: Local SQLite cache encrypted; synced securely when online
- Incident Response: Breach notification procedures per applicable laws
No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
__________________________________________________
9. Your Rights
Depending on your jurisdiction, you may have the following rights:
| Right | How to Exercise |
| ------- | ----------------- |
| **Access** | Request a copy of your personal data via `ecm.digital.mannai@gmail.com` |
| **Rectification** | Update profile information in the App → Profile section, or contact `ecm.digital.mannai@gmail.com` |
| **Erasure (Deletion)** | Request account and data deletion processed within 30 days (subject to legal retention) |
| **Restriction** | Contact `ecm.digital.mannai@gmail.com` |
| **Portability** | Contact `ecm.digital.mannai@gmail.com` |
| **Objection** | Contact `ecm.digital.mannai@gmail.com` |
| **Withdraw Consent** | Uninstall the App (stops automatic collection); contact HR for account closure. |
Corporate Context: As an enterprise app, certain rights may be limited by employment contract and legal obligations (e.g., payroll retention).
__________________________________________________
10. Children's Privacy
The App is not directed to children under 16. We do not knowingly collect personal information from children under 16. The App is for authorized Mannai Energy employees only. If you believe a child has provided data, contact `ecm.digital.mannai@gmail.com` immediately.
__________________________________________________
11. International Data Transfers
Your data may be processed in:
- Qatar (primary – Mannai Energy headquarters, Odoo backend)
- United States (Firebase/Google Cloud servers)
Transfers rely on Standard Contractual Clauses (SCCs) and adequacy decisions where applicable. Firebase/Google participates in the EU-U.S. Data Privacy Framework.
__________________________________________________
12. Changes to This Policy
We may update this policy to reflect:
- Changes in app functionality
- Legal/regulatory updates
- Corporate policy changes
Notification: Material changes will be communicated via:
- In-app notification
- Email to registered address
- Updated "Last Updated" date above
Continued use after changes constitutes acceptance.
__________________________________________________
13. Legal Basis & Consent
By using Nova: Self Service as part of your employment with Mannai Energy, your data is processed under contractual necessity (employment agreement) and legitimate interest (service delivery, security, improvement). Consent is obtained for optional features where required (e.g., push notifications, camera access).
__________________________________________________
14. Contact Us
Privacy Inquiries / Data Requests:
📧 `ecm.digital.mannai@gmail.com`
Postal Address:
Mannai Energy
11th Floor Al Jassim Tower,
Near Ramada Signal, C-Ring Road,
Doha, Qatar
__________________________________________________
15. Platform-Specific Disclosures
iOS (App Store)
- App Tracking Transparency: This app does not use IDFA for cross-app tracking. Firebase Analytics uses IDFV (vendor identifier) only.
- App Privacy Report: Data categories declared in App Store Connect match this policy.
- Sign in with Apple: Not used (corporate authentication via Odoo).
- Deployment Target: iOS 15.0+
Android (Google Play)
- Data Safety Section: Declared in Play Console matching this policy.
- Permissions: Runtime permissions requested for Camera, Location, Photos – all with in-app justification dialogs.
- Target API Level: 34 (Android 14) with scoped storage compliance.
__________________________________________________
__________________________________________________
This policy replaces the previous version hosted at FlyCricket (effective 2025-11-17). It incorporates iOS App Store and Google Play Store requirements for Nova: Self Service v2.2.1+.