Scope and responsibilities
HEXLuma operates Marafek and processes account, contact and subscription data to deliver the service and manage customer relationships. Each organization determines the purposes and permissions for its workplace reports; we process workspace content on its behalf to operate the platform.
This policy covers the website, organization workspaces and associated app. Your organization may provide an additional workplace privacy notice explaining its responsibilities. This policy does not replace that notice.
Data and its sources
You or your workspace administrator provide names, email addresses, account and invitation information, memberships, roles and permissions.
Report data includes building, department, described location, category, priority, description, photos and custom-field answers, as well as assignments, statuses, comments, timestamps and activity history. Reports may be submitted without an account when the organization permits it.
Technical data includes session, browser and device information, request logs and diagnostics. Hosting and security providers may process network addresses to protect the service. When payments become available, we process order, plan, amount, payment status and references needed for accounting and support.
Purposes and grounds for processing
We use data to create accounts, verify access, operate and route reports, track progress, send account invitations and service messages, provide support, protect the platform and process subscriptions when available.
Depending on the circumstances, processing relies on performance of agreements, legal obligations, permitted legitimate interests or consent where required. Using the platform is not blanket consent to additional purposes; separate consent is requested when necessary.
Access and recipients
Workspace users see information according to their roles and permissions. A tracking link provides limited report information and should be kept private. Authorized support personnel may access information needed for a support request or security incident.
Service providers include Vercel for hosting, Supabase for authentication, database and file storage, and Resend for operational email when enabled. When payments are activated, Moyasar processes payment data under its own privacy policy. The maintenance report form does not request card details or security codes.
We may disclose information on a lawful basis, such as a competent authority’s request. We do not sell personal data or use workspace report content for advertising.
Processing locations and providers
Data may be processed outside Saudi Arabia depending on provider hosting locations. We do not promise that all data is hosted within Saudi Arabia. Cross-border transfers are subject to applicable requirements and safeguards appropriate to the data.
Workspace administrators can request information about providers, processing locations and data-protection arrangements before uploading information with special requirements.
Cookies and device storage
We use cookies for sessions, authentication, workspace selection and language preference, and local storage for appearance preferences. Disabling necessary storage may affect sign-in and preference persistence.
When enabled, anti-bot protections may use technical data to verify requests. Accepting this policy alone does not authorize advertising tools or other purposes requiring additional consent.
Retention and deletion
Account and report information is retained while needed to provide the organization’s service. When a workspace closes or deletion is requested, we review what can be deleted and what must be retained for a legitimate purpose, legal obligation or ongoing dispute.
Retention of payment, correspondence and security records depends on their purpose and applicable requirements. Backup copies may remain within provider retention cycles until deleted or replaced. Cancelling a subscription does not immediately delete every record.
Your rights and privacy requests
Subject to applicable laws and their limits, you may request information about processing, access to or a copy of your data, correction or completion, destruction, and withdrawal of consent where consent is the basis for processing.
Send requests to the email below. We may proportionately verify your identity and authority and coordinate with your organization for workspace-content requests. Do not send passwords or unnecessary sensitive information.
You may raise a personal-data protection complaint with the Saudi Data & AI Authority (SDAIA) through its official channels.
Security and changes
We use access controls, separation between workspaces and encrypted connections in transit. No technical measure eliminates every risk. Notify us promptly of a suspected incident or unintended disclosure.
We update this policy when processing purposes or service practices change, explain material changes and request additional consent when required.