Privacy Policy
Operator and service coverage
Sa3tak is an hourly-services and reservations application operated by HATEC. Egypt is the initial service market. International download availability does not mean that services are available in every country.
Account information and eligibility
We collect name, an automatically generated username, phone number, password hash, language and role. New registration uses a phone number and does not require email; email is retained for existing accounts that supplied it. New registrations require a full birthday for the minimum age of 18, and versioned Terms acceptance and Privacy acknowledgement. This is a self-declared age check, not government identity or legal-capacity verification. Birthdays are not included in public professional profiles. Optional email updates are available only for accounts with an email address and are separate from service access.
Necessary data use and your choices
When you create an account and request a feature, you authorize HATEC to collect and use the account/contact, address, booking, communication and transaction data actually needed for that feature, as described in this policy. This is a limited request for the service, not blanket consent to advertising, unrelated profiling, sale of data or every future use. For EU processing, information genuinely necessary for the requested contract/service must have the applicable lawful basis; acknowledging this policy is not itself the legal basis for all processing. Where a separate consent is required, it must be specific, informed and withdrawable. Marketing remains optional; device permissions are requested separately. You may stop using a feature, change device permissions, withdraw marketing in Settings, or use Privacy and preferences in Settings for access, objection, restriction, consent withdrawal or deletion. Stopping necessary processing may prevent the corresponding feature, and records may remain where another applicable lawful ground requires it. Do not enter unnecessary health/child data; regulated services and sensitive-data use require additional assessment.
Service and location data
Addresses, property type, descriptions, category, booking times, status history, arrival/return verification and elapsed work time support service delivery and billing. Location is used for map selection, nearby matching and arrival checks. Online professionals or those on active jobs can share background location with phone permission and platform indicators; clients do not receive that professional background-tracking behavior. Turning off availability stops new matching; active task tracking may continue until the task ends. For GPS-based professional applications, the submitted coordinates, reported accuracy and submission time are saved privately for admin review. Reviewers can choose to open the location in Google Maps.
Profiles, communications and uploads
Public professional profiles may show name, username, photo, biography, qualifications/experience entered by the professional, services, hourly rates, ratings and brief completed-job history. Reviews include reviewer display name/photo. Chat, support, professional identity documents/face photos, materials and payment evidence are used for the relevant workflow. Do not submit unnecessary medical, child or identity details in free text or images. Adult accounts do not mean that incidental information about children can never be received; tuition/care/medical workflows require additional legal review.
Payments and purposes
Cash service receipts and manually reviewed InstaPay/Vodafone Cash deposits and withdrawals use amounts, references, sender/recipient details and screenshots. No real card collection or recurring subscriptions are implemented. We use data for accounts, matching, performing and recording services, safety/verification, support, accounting, fraud prevention and operation of the app. Marketing email requires a separate choice and email confirmation; transactional service/security messages remain separate. The operator must finalize the applicable legal bases for each purpose before launch.
Sharing and international processing
Booking participants receive the details needed for their task. Authorized staff review verification, support and financial requests. Map features use configured OpenStreetMap tiles and Nominatim geocoding. The browser build requests rendering/font assets from Google static services, exposing connection/request details. Native FCM/APNs push is prepared but not configured locally. Hosting and message providers are not selected for production. Provider roles, contracts, regions and appropriate international-transfer arrangements must be assessed before activation or expansion. No advertising pixels or data-sale program are implemented.
Retention and deletion
Account access is disabled when deletion is requested and personal-profile erasure is scheduled after 30 days. Minimal transaction/booking records may remain pseudonymized where needed for reconciliation, disputes or legal obligations; the exact approved financial/support/backup schedule is not yet set and is a launch blocker. Operational logs rotate by size (10 MB, five archives), not a guaranteed day limit. Completed jobs are retained seven days and failed jobs thirty days; resolved error issues thirty days and inactive issues ninety days. Device tokens expire after ninety days of inactivity, and push outbox/receipt metadata after thirty days. Cached public snapshots are brief. Backups and remote providers require their own documented deletion/retention arrangements. Open services or an explicit retention hold can delay erasure and require human review. The thirty-day period is not a guarantee of immediate destruction of all copies.
Choices, rights and security
Settings provides privacy/preferences, available account export and deletion controls. You can request access, correction, deletion, restriction/objection or other rights that apply in your jurisdiction, withdraw marketing permission, or raise a complaint through support or the configured privacy contact. Identity checks may be needed to protect your account. Device location/notification permissions are controlled by your phone. Security controls reduce risk but are not a guarantee. We do not claim universal legal compliance or an appointed data-protection officer.
Regional privacy rights
Applicable rights can differ in Egypt, the EU/EEA and US states. Where applicable, you may request access, correction, deletion, restriction, objection or portability, withdraw a consent and complain to the relevant authority. Current self-service export is a summary; use Privacy and preferences in Settings for a wider verified request. We do not currently operate data sales or sharing for cross-context behavioural advertising. A Global Privacy Control signal does not enable any optional tracking; none is enabled. Do not interpret acceptance of these policies as waiving mandatory rights, authorizing sensitive/medical data processing without its additional requirements, or establishing service availability outside Egypt. Applicability, exemptions, local response duties and international transfer arrangements require assessment of the actual deployment and business.
2026-11-04.1