Privacy Policy

At Dara, we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal information when you visit our website thedara.co, use our mobile applications, or use our services. By using our website, you agree to the terms outlined in this policy.

We may collect personal information such as your name, email address, and other contact details, as well as usage data including your IP address, browser type, device information, and pages visited. We also use cookies and other tracking technologies to enhance your experience and analyze how our services are used.

Your information is used to provide and maintain our services, improve user experience, communicate with you, detect and prevent fraud, and comply with legal obligations. We may share your information with trusted service providers who assist us in operating our business, and with legal authorities when required. We do not sell your personal information to third parties.

Depending on your location, you may have certain rights regarding your personal data, such as the right to access, correct, or delete your information, and the right to object to certain types of processing. To exercise any of these rights, you can contact us at info@thedara.co.

We retain your information only as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. While we take reasonable steps to secure your data, please note that no system can be guaranteed 100% secure.

Our services are not intended for children under the age of 13, and we do not knowingly collect personal data from children. Our website may contain links to third-party sites, and we are not responsible for the privacy practices of those websites.

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date. Your continued use of our services after any changes means you accept the revised policy.

If you have any questions or concerns about this Privacy Policy, please contact us at info@thedara.co or by mail at Dubai, UAE.

---

Dara Driver Mobile App

This section applies specifically to the Dara Driver Android app used by our field sales drivers.

Location. When a driver starts a sale, the app checks the device's current location once, in the foreground, to confirm the driver is near the client's registered address. We do not track or store location in the background, and location is not shared with any third party. This check happens only at the moment “Start Sale” is tapped.

Bluetooth. The app uses Bluetooth to connect to the driver's handheld thermal receipt printer for printing invoices and receipts. Bluetooth is used only to discover and connect to this printer hardware — no data is collected about other nearby Bluetooth devices, and no Bluetooth data leaves the device.

Account and business data. Drivers sign in with a phone number and a one-time passcode (OTP). The app stores and syncs the sales, inventory, and client data needed to do the driver's job (invoices, deliveries, stock counts) with Dara's servers at erp-api.thedara.co. This data is used solely to operate the Dara ERP service for the business that employs the driver — it is not sold or shared with unrelated third parties.

Data retention. Business data (invoices, sales records) is retained per the employer organization's own record-keeping needs and applicable law. Location data from the one-time “Start Sale” check is not stored after the check completes.

Contact. Questions about the Dara Driver app's data practices can be sent to info@thedara.co.

Why each permission is requested

---

Dara Mobile App (Android and iOS)

This section applies specifically to the Dara mobile app, used by merchants and buyers to review what they owe. It covers both the Android and the iOS version, which are built from the same source and behave identically except where noted. It is separate from the Dara Driver app described above.

Signing in. Merchants sign in with the username and password issued for their Dara account, and then confirm a one-time code (OTP) sent to the email address or mobile number registered to that account. The app does not create accounts — a Dara account is provisioned for you by Dara or by the organization you work for — and the app has no sign-up flow.

Session security. After sign-in the app holds a short-lived access token in memory only; it is never written to storage. The longer-lived session token is stored in the device's own hardware-backed secure storage — the Android Keystore, or the iOS Keychain — and is marked available only while that specific device is unlocked. On Android it is therefore excluded from Google backup and from device-to-device transfer; on iOS it is excluded from iCloud and from encrypted iTunes or Finder backups. Restoring a backup onto a second phone does not carry a live session with it. Signing out revokes the session on Dara's servers, deletes the stored token from the device, and clears all cached data from memory.

Biometric unlock. If your device has a biometric enrolled, the app asks for it before reopening a session that was saved on the device — a fingerprint or face on Android, Face ID or Touch ID on iOS. The match is performed entirely by the operating system; the app never receives, sees or stores any biometric data. Your device passcode remains available as a fallback. If no biometric is enrolled, or the check is cancelled or fails, the app requires a full sign-in instead.

Device identifier. The app generates a random identifier the first time it runs and stores it in the same secure storage. It is sent with each request so that a session can be tied to the device it was created on. It is not an advertising identifier, it is not the iOS identifierForVendor or an Android advertising ID, it is not derived from any hardware serial or IMEI, and it is not shared with anyone.

Business and financial data. The app reads and displays the account data needed to show a merchant what they owe: outstanding balance and amounts falling due, invoices and their line items, payment history and allocations, transactions and receipts, the buyer or company identity on the account, and any credit or outstanding-balance limit set for it. This data is read from Dara's servers at api.thedara.co over an encrypted connection and is used solely to operate the Dara service for the organization the account belongs to. It is not sold and not shared with unrelated third parties.

The app is read-only. It displays balances and history. It does not initiate payments, does not accept or store card or bank-account details, and contains no payment or checkout flow.

What the app does not collect. The app contains no analytics SDK, no crash-reporting SDK and no advertising SDK, and it uses no cookies or tracking technologies. It does not track you across apps or websites owned by other companies, and it therefore never asks for permission to do so. It does not request or use location, camera, microphone, contacts, calendar, photos, health data, SMS or call logs, and it does not read files on your device. Where the app offers a “copy” action, it copies only a reference or identifier that is already shown on screen, and only when you tap it.

Why each permission is requested

Android

The Android app requests no other permission.

iOS

The iOS app requests no other permission, and does not use App Tracking Transparency because it does not track you.

Data retention. Account and financial records are retained by Dara for as long as the organization the account belongs to requires them for its own record-keeping, and for any longer period required by law. On the device itself, the only data the app keeps between launches is the secure session token and the device identifier described above; both are deleted when you sign out.

Access and deletion. To request access to, correction of, or deletion of your personal data or your Dara account, contact us at info@thedara.co. Because Dara accounts are provisioned rather than self-registered, deletion is handled through this request route; signing out of the app removes the saved session from your device immediately.

Contact. Questions about the Dara mobile app's data handling: info@thedara.co