1. Who we are
Wurxa (“Wurxa”, “we”, “us”, “our”) is a software service operated by The Accountants Factory FZE LLC, based in Dubai, United Arab Emirates. We provide attendance, leave, document, payroll-preparation and related HR tools to businesses (“Customers”). This policy applies to wurxa.com, app.wurxa.com, and the Wurxa apps and APIs (together, the “Service”).
2. The two roles we play
For data about our Customers’ own staff that a Customer uploads or generates in the Service (for example employee records, attendance punches, leave requests and documents), the Customer is the data controller and Wurxa is the data processor acting on the Customer’s instructions.
For data we collect directly, such as the account details of the person who signs up, billing information, and website analytics, Wurxa is the data controller.
3. Information we collect
Account & contact data
Name, work email, phone number, company name, role, and login credentials of the people who register and administer a workspace.
Customer workforce data
Information our Customers enter or import about their employees, for example names, job titles, salaries, attendance and shift records, leave balances, and uploaded documents such as visas or contracts. Customers decide what to store.
Identity document scans (Wurxa PRO)
Typing centres using Wurxa PRO can scan or photograph a customer’s passport or Emirates ID to fill in a file faster. The image is read on Wurxa’s own servers and is not sent to an AI service provider. Location metadata is removed from the page images saved to a case, and the original upload is kept only until the scan is deleted. Scans are cleared on a short timetable: images and read values from a scan that is not confirmed are deleted one day after its last activity, and from a confirmed scan one week after confirmation. A document attached to a case, including one the typing centre’s customer uploads through a tracking link, stays until the typing centre removes it, and each time staff open one is recorded. Copies in routine backups are removed as those backups expire. The typing centre is the controller of its customers’ documents and is responsible for informing them and for having a lawful basis, including consent where the law requires it; Wurxa processes them on the typing centre’s instructions.
Biometric & device data
Wurxa connects to biometric attendance devices (e.g. ZKTeco) that a Customer already operates. Fingerprints and faces are enrolled on the Customer’s terminal or, for some terminals, from a photo the Customer uploads (see below). Wurxa receives the resulting punch events (an identifier plus a timestamp). So that a person enrolled once can be sent to the Customer’s other terminals, Wurxa also stores a copy of the terminal’s biometric template (the vendor’s encoded data, not a fingerprint or face image), kept within the Customer’s workspace, used only to send that person to the Customer’s own terminals, and deleted when the employee is deleted.
Face photos for face-recognition terminals
Some face-recognition terminals (for example Hikvision) enrol a person from a photo. If a Customer uploads one, Wurxa keeps it on the Customer’s behalf so it can be sent to the Customer’s own terminals, and does not use it for any other purpose. Because this is an ordinary photo of the person’s face rather than an encoded template, access is tighter: only the Customer’s owner, HR administrators and IT administrators can open it, and each time it is opened is recorded. It is removed when the Customer removes it, when the employee is deleted, or 90 days after the person is deactivated, whichever happens first; copies in routine backups are removed as those backups expire. The Customer, as controller, is responsible for telling the employee and for having a lawful basis, including consent where the law requires it. A copy already sent to a terminal stays under the Customer’s control on that terminal.
Clock-in photos
When a Customer’s employees clock in or out from the Wurxa app, the app can attach a photo to the punch so the Customer can confirm attendance. The Customer decides whether the photo is optional or required and, as controller, is responsible for informing its employees and for having a lawful basis to collect it. Wurxa does not use clock-in photos for face recognition or to identify people, and processes them only to provide the service to the Customer. Photos can be seen only by the Customer’s owners, administrators and managers, and each view is recorded. The image is removed from the live system 90 days after the punch, while the punch record itself stays; copies held in routine backups are removed as those backups expire.
Billing data
Subscription plan, billing cycle, and transaction records. Card payments are processed by our payment provider, Nomod. We do not store full card numbers.
Chat with Sara
Sara is an AI assistant on wurxa.com that answers questions about Wurxa. If you chat with Sara, we save the conversation, plus any name, email address, phone number or company details you choose to give, so our team can follow up and so we can improve the service. Messages are processed by service providers acting for us, under contract. Please do not type ID numbers, bank or card details or salary figures into the chat; Sara removes the most common ones before saving, but the safest course is not to share them. You can ask us to delete a conversation at hi@wurxa.com.
Usage & technical data
Like most online services, we keep log data such as IP address, browser type, pages viewed and timestamps. Our own first-party analytics count page views on our servers and use the IP address only to create a daily-rotating, irreversible visitor identifier; the IP address itself is not stored. Our marketing site (wurxa.com) also uses Google Analytics and Microsoft Clarity, which set cookies to measure visits and record how pages are used, with form fields masked. These tools run on the marketing site only. Inside the Wurxa app we do not use analytics or session-recording tools; we collect error reports only, so we can find and fix problems.
4. How we use information
- To provide, operate, secure and improve the Service.
- To authenticate users and protect against fraud and abuse.
- To process subscriptions, billing and renewals.
- To provide support and respond to enquiries.
- To send essential service messages (e.g. security, billing, important changes).
- To comply with legal obligations.
We do not sell personal data, and we do not use Customer workforce data for advertising.
If a workspace owner opts in, we may publish aggregate statistics (for example average overtime hours) combined from at least five workspaces. Nothing identifies a company, site or person. The choice is off unless the owner turns it on in Settings > Company, and the owner can turn it off at any time.
5. Legal bases
Where UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) or other applicable law requires a legal basis, we rely on: performance of a contract; our legitimate interests in running and securing the Service; consent where required; and compliance with legal obligations. Customers are responsible for having a lawful basis and any necessary employee notices or consents for the workforce data they process through Wurxa.
6. Sharing & sub-processors
We share data only as needed to run the Service:
- Hosting, infrastructure and other service providers that help us run the Service, under contract.
- Nomod, our payment provider, for processing card payments.
- Google Analytics and Microsoft Clarity, for aggregate website usage and page-interaction recordings on our marketing site (wurxa.com), with form fields masked.
- A product analytics and error-monitoring provider hosted in the EU: events about how a workspace sets up and uses Wurxa, and error reports from the app with technical details such as the error, the page address, the browser and the IP address, which we use to fix problems and improve the Service. We do not include names or employee records in these reports, and the app does not record sessions or screens.
- AI service providers that help answer questions in the app and read uploaded documents: they receive the questions you ask Rafiq and the workspace information needed to answer them, and, for Wurxa Workshop, images of the manual pages you upload so they can be read. Images of passports and Emirates IDs scanned in Wurxa PRO are not sent to them.
- Messaging services (WhatsApp Business by Meta, and Telegram), to deliver messages and notifications where a Customer or its employees use those channels.
- OpenStreetMap’s place-name service (Nominatim): when staff clock in from the app with location, the browser sends the device’s coordinates to it to show a readable place name.
- Zoho: only where a Customer connects Zoho Books or imports from Zoho Payroll or Zoho People, and only the data that Customer chooses to exchange.
- Professional advisers and authorities where required by law.
A current list of the service providers we use is available on request from hi@wurxa.com.
We do not otherwise disclose personal data to third parties without instruction or legal requirement.
7. International transfers
Where data is transferred outside the UAE, we take steps to ensure an appropriate level of protection consistent with applicable law. Some of the service providers listed in section 6, such as our AI service providers, analytics and error-monitoring providers, messaging services and Zoho, process data outside the UAE.
8. Data retention
We keep account and billing data for as long as a workspace is active and as required for legal, tax and accounting purposes. Customer workforce data is retained while the Customer’s subscription is active and is deleted or returned after termination in line with the Customer’s instructions and our Terms, subject to legal retention requirements. Some items have shorter, fixed periods, described with each item in section 3: clock-in photos are removed 90 days after the punch; a face photo for terminals 90 days after the person is deactivated; identity document scans one day after last activity if not confirmed, or one week after confirmation; and documents attached to a case stay until the Customer removes them.
9. Security
We protect data with encryption in transit, encryption of sensitive items such as stored logins and connection keys, access controls and operational safeguards. Biometric templates are enrolled on the Customer’s own terminals; the copies we store, described in section 3, are kept within the Customer’s workspace and used only to send people to that Customer’s terminals. No system is perfectly secure, but we work to protect personal data against unauthorised access, loss or misuse.
10. Your rights
Subject to applicable law, individuals may request access to, correction of, or deletion of their personal data, and may object to or restrict certain processing. If your data was entered by an employer using Wurxa, please contact that employer (the controller) first; we will support them in responding. For data we control directly, contact hi@wurxa.com.
11. Children
The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from children.
12. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by notice within the Service.
13. Contact
Questions or requests: hi@wurxa.com · The Accountants Factory FZE LLC, Dubai, United Arab Emirates.
