What Madriat holds,
and who can reach it.

You are handing over passport and visa numbers for your staff. That deserves a straight answer rather than four pages of clauses, so this is written in plain English and describes what the software actually does.

The records you enter or import

• For each person, vehicle or company record: the name, a role or reference, nationality, and whether they are a GCC national.
• For each document: its type, number, issue and expiry dates, renewal status, your notes, and the history of past renewals with their cost.
• Any scan you attach — a PDF or photograph of the document itself.
• For each login: name, work email address, and a password that is stored only as a one-way hash. Nobody at Madriat can read it, and neither can we recover it for you.

Only the establishment it belongs to

• Every record is tied to one establishment. Each request is filtered by that before the database is even asked, so a login from one company cannot read, edit or download another company's records — including by guessing a web address.
• Attached scans are kept outside the public part of the server and are only ever handed back after the same check, always as a download rather than as a page in the browser.
• Everyone you invite onto your own account can see that account's records. Madriat has no per-record permissions yet, so invite the people who should see the whole picture.

Reminder emails, and nothing else

• Reminders go to the person named as the owner of the record, and to the second address they have set if any — one email each morning holding everything due that day, and up to three a day in the final few days. Inside the last ten days, and for the weekly summary, they go to everyone on the account.
• Those emails contain the holder's name and role, the document type, its number, the expiry date and the estimated penalty. Treat them as you would the document.
• Email is delivered through an email provider, which handles the message while it is in transit. Nothing else is sent anywhere.

No selling, no sharing, no advertising

• Your data is not sold, rented or shared with anyone.
• There is no advertising and no third-party tracking in the application.
• Your records are not used to train anything or to build a dataset.

Yours to take back

• Any document can be archived from its own page. It stops being counted and stops sending reminders, and the record and its history stay in place in case you need them again.
• To have an establishment's data deleted outright, write to us from an address on the account and say so. It is removed, including any attached scans.
• Ask and you get an export of everything held for your establishment.

Where that is the requirement

• Madriat can be installed on a server you control, on your own premises or with your own hosting provider. In that arrangement the data never reaches us at all, and everything above about who can see what is enforced by the same software running inside your network.