Who we are
Naarvin is provided by Naarvin Technologies (Pvt) Limited, a company incorporated in Pakistan (registration number 0362762), Abbottabad, Pakistan ("Naarvin", "we").
For this website and for the people who use their organization's Naarvin account, we decide why and how personal data is processed, so we are the controller. For the books, documents and other data an organization puts into Naarvin, the organization is the controller and we process that data only on its instructions; our data processing agreement covers that part.
What we collect
- Demo requests from this website: your name, work email, company, job title, country, number of companies, current system and your message.
- Account data: name, email address, role, language and number settings, the companies you may see, sign-in method and two-factor settings.
- Security and usage records: sign-in times, IP address, browser, the actions you take in Naarvin (kept in a tamper-evident audit log) and errors.
- Messages you send us, for example to [email protected].
- Data inside your organization's workspace, such as ledgers, invoices, employee and customer names and bank details, which we process for your organization as described in the data processing agreement.
Why we use it
- To answer demo requests and talk to you about Naarvin, on the basis of your consent given in the form.
- To provide the service your organization signed up for, keep it secure and support you, as part of our contract with your organization.
- To keep records the law requires, such as invoices and tax records, and to protect our legal rights.
- We do not sell personal data, show advertising or use your organization's data to train AI models.
Cookies
This website uses no analytics, advertising or tracking cookies. The Naarvin app uses only the cookies it needs to work: your signed-in session, your language and the short-lived cookie that plays the sign-in animation. You cannot switch these off and still sign in.
Where your data is kept
Naarvin is hosted today by Railway in the United States (US West). Some services, such as email delivery and AI, are run by other companies (our sub-processors); we send the current list on request to [email protected]. This means personal data is transferred outside the Kingdom of Saudi Arabia.
We make these transfers under the PDPL and its regulation on transferring personal data outside the Kingdom: with contractual safeguards from each provider, only the data each service needs, encryption in transit and at rest, and, where an organization switches it on, names and identifiers masked before anything reaches the AI. An organization can also switch external AI off entirely. Hosting inside the Kingdom is on our roadmap for organizations whose data must stay there.
Who we share it with
Only the companies that run parts of the service for us (our sub-processors, listed on request), the systems your organization chooses to connect, and authorities where the law requires it. Each sub-processor may use the data only to provide its service to us.
How long we keep it
- Demo requests: until the conversation ends, and no longer than 24 months.
- Account data: while the account is open. When an organization asks for deletion, its workspace and everything in it is deleted within 2 working days, and backups are overwritten within 90 days.
- The audit log and the record of a deletion are kept as long as legal and audit duties require.
- Invoices and tax records are kept for the periods tax law sets.
How we protect it
Each organization's data is separated at the database level, access is limited to the companies a person may see, connection credentials are encrypted and never shown again, sign-in can require a second factor and single sign-on, sensitive actions ask you to confirm again, and every change is recorded. Our security page explains these controls and what is not built yet.
Your rights
Under the PDPL you may ask to be told how your personal data is processed, to get a copy of it, to have it corrected or completed, to have it destroyed when it is no longer needed, and to withdraw consent you gave. Email [email protected]; we answer within 30 days.
If your personal data sits in an organization's workspace, that organization decides on it: we will pass your request to them and help them answer. You may also complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).
If something goes wrong
If a security incident affects personal data, we tell the affected organizations without undue delay and give them what they need to meet their own duties, including notifying SDAIA within 72 hours where the PDPL requires it.
Changes and contact
We will change this page when how we handle personal data changes, and say so at the top. Questions: [email protected].