Legal
Privacy policy
Last updated: 2 November 2026
This is a preliminary version under legal review, including against the Saudi Personal Data Protection Law, and will be finalised before public launch.
Who we are
MIRSAD is an inventory and warehouse management platform provided by NOVANEX. This policy explains how we handle personal data when you use the website, the platform and the mobile app.
Data we collect
- Account data: name, email, password (stored hashed by the authentication provider; we never see it) and preferred interface language.
- Organization data entered by users: products, warehouses, stock movements, suppliers and purchase orders. It belongs to the organization.
- Contact and demo requests: name, email, mobile number, organization and message, with a hashed fingerprint of the network address (the address itself is not stored) to limit spam.
- The in-platform audit log: who changed what and when, for security and accountability.
- Subscription and billing data: subscription status, trial dates, paid periods, and the record of payment attempts and their results.
Free trial
To prevent repeated free trials we keep a hashed fingerprint (SHA-256) of the normalised email address, not the address itself, for this purpose. The fingerprint is kept after an account is deleted, because its purpose is to prevent repeated trials.
Payments
When online payment is enabled, card details are entered directly on the payment provider’s page; card numbers and security codes never reach MIRSAD and are never stored by it. We keep only the transaction reference, amount and result.
The camera in the mobile app
The app uses the camera only to scan barcodes. It does not store or send images. Codes can be entered manually without camera access.
Cookies
We use essential cookies only: the sign-in session and the language preference. We use no advertising cookies or third-party trackers.
How we use data
To provide and operate the platform, secure accounts, respond to enquiries and meet legal obligations. We do not sell personal data or use organization data for advertising.
Isolation and permissions
Each organization’s data is isolated at the database level and is accessible only to its members, according to their roles. Costs and values are limited to those permitted to see them.
Service providers
We rely on a cloud provider for databases, authentication and storage. Providers and hosting locations will be disclosed in the approved version of this policy.
Retention
Account and organization data are kept for the subscription period and as required by law afterwards. The stock movement ledger is never edited by design, as it is an accounting and audit record.
Your rights
You may ask to access, correct or delete your personal data, within what the law allows, through the contact page.
Contact
For any privacy question, please use the form on the Contact page.