Privacy Policy

This policy explains what Al-Haytham collects when you use the platform, why, and the choices you have. Al-Haytham is operated from Pakistan. By using the service you agree to this policy alongside our Terms of Service.

We keep collection to what we need to run the service:

• Your email address — to create your account, sign you in, and send essential service messages (like a verification link).
• Your password — stored only as a salted, hashed value. We never store, and cannot see, your actual password.
• The business data you enter — orders, hostel records, payroll, medical & dental billing records, HR records, ledger entries, partners, and the rest of the books you build inside your workspace.
• Basic technical data — minimal information needed to keep the service secure and working, such as the IP address a request comes from (used, for example, to limit abuse of the signup form).

Some engines are designed to hold sensitive personal data about other people. The Payroll and HR engines handle employee information — such as names, CNIC or other ID numbers, contact details, and pay — and the Medical & Dental Billing engine handles medical and dental billing records. So the data you enter may include sensitive information about your own employees, patients, or customers.

When you enter that data, your business is the controller of it: you decide what to collect and why, and you are responsible for having a lawful basis and any consents you need. Al-Haytham acts as a processor — we store and process that data only to provide the service to you, on your instructions, and we do not use it for our own purposes.

Health-related data can carry extra legal obligations (for example, rules such as HIPAA in some jurisdictions). How health data is handled is an area to review with a qualified lawyer, and where such rules apply we would put a separate written agreement in place. This starter policy is not a substitute for that review.

Al-Haytham is multi-tenant, and tenant isolation is built into the foundation — not bolted on. Each organisation’s data lives behind row-level security in the database, so one business can never see another business’s records. Your books are yours alone. This isolation is a core design principle of the platform, and one of the reasons we built it the way we did.

We use what we collect only to:

• provide, secure, and improve the service;
• sign you in and keep your session active;
• send essential account and service messages;
• prevent fraud and abuse, and meet our legal obligations.

We do not sell your data. We do not sell or rent your personal information or your business records to anyone.

We use cookies only for the essentials — chiefly to keep you signed in and to keep your session secure. These are required for the app to work, so we do not need a separate consent banner for them. We do not use advertising or cross-site tracking cookies.

To run the platform we rely on a small set of trusted subprocessors — providers that process data only on our instructions and only to help us deliver the service. They fall into a few categories: cloud database hosting, application hosting and content delivery (CDN), and transactional email (for example, to deliver a verification link). A current list of the subprocessors we use is available on request at support@alhaytham.app.

Al-Haytham is operated from Pakistan. To run the service, your data may be processed and stored on infrastructure located in other countries, through the providers described above. Wherever your data is processed, this policy and the protections it describes continue to apply.

We take reasonable measures to protect your data, including hashed passwords, tenant isolation, and access controls. No system is perfectly secure, but security is a first-class concern in how Al-Haytham is built and operated.

We keep your data for as long as your account is active, or as long as we need it to provide the service and to meet our legal, accounting, and tax obligations. We do not keep personal data for longer than we need it. When you ask us to delete your account (see “Accessing or deleting your data” below), we remove or anonymise your data, except for limited records the law requires us to keep — and only for as long as those obligations last.

Your data is yours. You can export or request a copy of the records in your workspace, and you can ask us to delete your account and its data. To make a request, email support@alhaytham.app from the address on your account, and we will help. We may keep limited records where the law requires it.

We may update this policy as the product and the law evolve. When we make a material change, we will update the date at the top of this page. Continuing to use Al-Haytham after a change means you accept the updated policy.

Questions about your privacy, or want to make a request? Email us at support@alhaytham.app.