Privacy Policy

01

Who we are and what this policy covers

Gulf Technical Services (GTS) provides the GTS Operation Suite Android application and its Head Office web and backend services. The production application is available at https://mobile.gts-sa.com/v2/. This policy covers data processed when an authorized user signs in and uses those services. The service is intended for approved business users; it does not offer public self-registration and is not directed to children.

02

Information we process

Account and authentication information

We receive the username or email address entered at sign-in. The account record may also contain a display name, business email, language, account type, company memberships, roles, permissions, and authorized site or station scope.

The password is transmitted to GTS over HTTPS only to verify the account. The service stores a one-way password hash, not the readable password. The Android application does not store the password on the device, and the web client does not place it in URLs, local storage, logs, or analytics.

Session, device-context, and security information

After successful authentication, the service creates a random server-side session. The client receives a host-only session cookie marked Secure, HttpOnly, SameSite=Strict, and Path=/; JavaScript cannot read it. Session identifiers are rotated after sign-in and company selection. The browser also holds a short request-proof value in memory only. No access token, membership record, tenant identifier, or database name is stored in a URL or local storage.

For fraud prevention, authorization, rate limiting, incident response, and session revocation, GTS processes the IP address, a browser or WebView user-agent label, a cryptographic network-prefix binding, session and login timestamps, login success or failure, requested endpoint, HTTP method and result status, company/realm context, and a non-reversible hash of the session identifier. We do not use an Android advertising ID, IMEI, MAC address, or similar hardware identifier in the audited Head Office web/backend authentication flow.

Authorized operational and business data

Depending on the user's company, permissions, and station scope, the service may display and process station identity and status, sales and transaction totals, payment and shift records, tank levels and deliveries, alarms, maintenance tickets and attachments, product and price data, reports and exports, fiscal/ZATCA status, integration status, map coordinates, configuration records, users and roles, and security audit events. Some business modules may contain names or identifiers of attendants, employees, drivers, vehicles, customers, or business contacts. Users may also submit filters, notes, comments, configuration changes, report requests, maintenance content, and Ask AI questions when their role permits those actions.

Preferences stored on the device and server

The web client may store non-secret preferences on the device, including language, theme, collapsed navigation state, saved workspace links, recent in-app paths, and dashboard layout choices. Dashboard preferences may also be synchronized to the GTS server for the signed-in user. These stores do not contain passwords, session tokens, database credentials, or unrestricted company data.

03

Analytics, diagnostics, device IDs, and IP logs

• The audited Head Office web client does not include an advertising SDK, advertising identifier collection, or a dedicated Android crash-reporting SDK such as Firebase Crashlytics or Sentry.
• GTS server and security logs record technical events, request outcomes, and errors needed to operate, protect, and troubleshoot the service. Passwords and readable session tokens are not intentionally logged.
• Cloudflare provides delivery and security services and currently supplies a web-performance/analytics beacon. It may process IP address, user agent, requested page, approximate region inferred from network information, and performance or interaction measurements for security, availability, and service analytics. This is not used for targeted advertising.
• POS or station hardware identifiers visible in operational screens are business records already held by the authorized company environment; they are not collected from the reviewer's Android device for advertising or cross-app tracking.

04

Why we process information

GTS processes the information described above to:

• authenticate users, select an authorized company, and manage accounts and sessions;
• provide operational dashboards, reports, alerts, maintenance, payments, maps, integrations, and permitted administrative features;
• apply company, role, permission, and station-level access controls on every protected request;
• remember user preferences and improve usability;
• detect abuse, enforce rate limits, investigate incidents, revoke sessions, and maintain audit evidence;
• monitor availability and performance, diagnose errors, and protect the service; and
• meet contractual, accounting, fiscal, security, and legal obligations.

05

Service providers and data disclosure

GTS does not sell personal data and does not share it with advertising networks or data brokers. Data may be processed by the following service providers or recipients only as needed for the service:

• Cloudflare: delivery, web security, traffic protection, and performance analytics.
• Google Maps: only when an authorized user opens a map feature. Google may receive normal network/browser information and the station coordinates needed to render the requested map. Opening an external Google Maps link is a user-initiated action governed by Google's own privacy terms.
• OpenAI: only when an authorized user submits an Ask AI request. The request may include the question, short recent conversation, current page context, and the minimum authorized operational summary needed to answer it. The integration requests no provider-side response storage (store: false). GTS records a hash of the question and limited usage/audit metadata rather than the question text in its AI audit record.
• The user's organization and its authorized administrators: for account administration, operational work, audit, and support.

We may also disclose information when required by law, to protect users or the service, or during a legitimate corporate transaction subject to appropriate safeguards. Providers may process data in countries other than the user's country under their applicable contractual and security terms.

06

Retention

• A normal session cookie lasts for the browser/WebView session. If “Remember me” is selected, the current maximum cookie and server-session lifetime is 30 days. Security changes, logout, account disablement, or administrator revocation may end it sooner.
• Temporary report-export downloads normally expire after five minutes.
• Account, membership, preference, operational, and configuration data is retained while needed to provide the contracted service and maintain the authorized business record.
• Session inventory, security events, audit records, server logs, and backups are retained for security, contractual, recovery, fiscal, and legal purposes under GTS and customer retention requirements. The code does not apply one universal deletion period to all of these records.

When retention is no longer required, data is deleted, anonymized, or made inaccessible in accordance with the applicable operational and legal process.

07

Access, correction, and deletion requests

Users may ask to access, correct, disable, or delete their account or personal data by emailing [email protected]. Please include the app name, your username or business email, your company, and the type of request, but never send your password. GTS will verify the requester's identity and authority before acting.

Accounts are provisioned by GTS or the user's organization rather than created publicly in the app. GTS can disable the account and revoke active sessions. Some operational, financial, fiscal, security, backup, and audit records may need to be retained or may be controlled by the user's employer or customer organization. In those cases, GTS will delete or restrict data to the extent permitted and explain any required retention.

08

Security

GTS uses HTTPS, one-way password hashing, Secure and HttpOnly host-only cookies, CSRF protection, same-origin request checks, short-lived request proofs, login rate limiting, session rotation, server-side company and database selection, current-membership validation, permission and station scope enforcement, audit logging, and session revocation controls. No system can guarantee absolute security, but GTS maintains layered controls designed to prevent unauthorized cross-company access.

09

Google Play review environment

The Google Play reviewer account is routed to an isolated, intentionally empty environment. It contains no production, customer, station, sales, payment, alarm, or operational data. It has no access to Operations, global administration, tenant provisioning, production companies, customers, or stations.

10

Changes and contact

We may update this policy when the service, providers, or legal requirements change. The effective date above identifies the current version. Questions about privacy or deletion requests may be sent to [email protected].