Al-Nargis Resident — Privacy Policy

Last updated: 31 May 2026

This Privacy Policy explains what personal information the Al-Nargis Resident mobile app (the "App") collects, how that information is used, and the rights you have over it. The App is published by Al-Nargis Group ("we", "us") for residents of properties managed by Al-Nargis Group in Iraq.

1. What we collect

The App handles only information that is required to operate the resident services you use. We do not collect anything beyond that.

Category	What	Source
Identifiers	Your phone number, full name, customer code, the unit you live in.	Set by property management staff.
Account credentials	The 6-digit PIN you set during activation (stored only as a one-way hash).	Set by you.
Device identifiers	A Firebase Cloud Messaging (FCM) token assigned by Google to your device.	Generated by Firebase on first launch.
Activity & content	Guest passes you issue, service requests you file, and any messages within those.	Created by you in-app.
Gate scan records	Time, gate location, and result of each scan of a guest pass you issued.	Generated by the guard tablet on entry.
Verification codes (OTP)	A short numeric code sent to your WhatsApp/SMS only when you reset your PIN.	Generated server-side, sent via OTPIQ.

We do not collect: contacts, photos, microphone audio, calendar, SMS history, biometric data (fingerprint / face matches happen on your device — the App never sees the biometric itself), or precise location coordinates.

2. How we use it

Only for the App's purpose:

• Authenticate you — phone + PIN login, optional biometric unlock, and PIN-reset OTP delivery.
• Operate the features — show your unit's information, deliver push notifications, render the QR/PIN for guests at the gate, and route service requests to the right staff member.
• Audit gate entries — keep a record of who entered your compound and when, so anomalies (e.g., a pass used after you cancelled it) are detectable.
• Improve reliability — diagnostic logs of failed pushes / failed verifications are kept server-side; these never include your PIN.

We do not sell your data, do not show ads, and do not share your information with third parties except the operational processors listed below.

3. Processors we use

Service	Purpose	Where data is processed
Firebase Cloud Messaging	Delivering push notifications (Google LLC).	Google's global infrastructure.
OTPIQ	Sending PIN-reset verification codes via WhatsApp / SMS.	Iraq.
Our own server (Hetzner)	Storing your account, units, and gate-entry records.	Hetzner Online GmbH data centres in Germany.

We sign contractual agreements with these processors that limit them to acting on our instructions.

4. Where data lives

Your records live in our database hosted on Hetzner in Germany. We retain them for as long as your unit remains active in the property-management system, plus a reasonable archive period after move-out so we can respond to disputes (typically 36 months).

Backups are encrypted at rest.

5. Children

The App is intended for adult residents (18+). We do not knowingly collect information from children. If you believe a child has activated the App, contact us at the address in §8 and we will remove the account.

6. Your rights

You have the right to:

• Access — request a copy of the information we hold about you.
• Correct — fix anything inaccurate. Most fields are correctable by contacting property management; the others require us to act manually.
• Delete — request your account and history be erased. Active gate-entry records may be retained in pseudonymised form for audit purposes.
• Withdraw consent — log out and uninstall the App to stop further data collection. Push notifications stop the next time the system tries to deliver to your device.

Contact us using the address in §8 to exercise any of these. We will respond within 30 days.

7. Security

• All API traffic uses HTTPS (TLS 1.2+).
• PINs are stored using bcrypt. We cannot recover your PIN — only reset it.
• Sanctum bearer tokens are issued per device. Logging out, deactivating your account, or moving out invalidates the token on the next request.
• The guard tablets authenticate per device with operator credentials and validate scans server-side; a tablet by itself cannot decide an entry.

We do not promise that no breach can ever occur, but we apply standard industry practices to make one unlikely and detectable.

8. Contacting us

For any privacy-related question or request:

• Email: privacy@al-nargis.app
• WhatsApp: +964 780 100 2276

We will reply within 30 days.

9. Changes to this policy

If we change this policy, we will update the date at the top and — for material changes — notify you in the App. Your continued use after a material change means you accept it.