سياسة الخصوصية

• Effective date: 20 April 2026
• Version: 1.0
• Data Controller: Dashcam Road Est.
• Commercial Registration: 1010877945
• National Data Governance (NDG) registration number: 3260006040
• Data Protection Officer: dpo@dashcamrd.com

1. Who we are

Dashcam Road ("Dashcam Road", "we", "the Establishment") is a Saudi establishment that operates the Road app ("the App"), a platform for managing vehicle cameras (dashcams). We are the data controller for all personal data collected through the App.

You can contact the Data Protection Officer at any time by email: dpo@dashcamrd.com, who is committed to responding to all data subject requests within 30 days.

2. What data we collect

• Account data: name, email, mobile number, invoice number, and encrypted password. (Source: you, at registration.)
• Device or vehicle data: dashcam IMEI, vehicle plate, and SIM number. (Source: you.)
• Location data: GPS coordinates, speed, heading, engine status (ACC), and trip history. (Source: the dashcam.)
• Video and audio: live streaming, event clips, and two-way (intercom) audio — only when the end user permits us to access them. (Source: the dashcam.)
• Events and alerts: harsh braking, acceleration, speeding, and geofence entry or exit. (Source: the dashcam.)
• App usage data: screen views and feature usage (anonymous and optional). (Source: the App.)
• Firebase (FCM) notification tokens: device token for notifications. (Source: the operating system.)
• Consent and audit logs: what you consented to, when, and from which IP address. (Source: the App and the server.)

Note: We do not collect contacts, messages, call logs, photos beyond what you upload, or any biometric data other than what naturally appears in the camera video.

3. Why we process this data

• Operating the core service (viewing the vehicle, replaying trips).
• Security logging, fraud or abuse detection.
• Live streaming and two-way audio: explicit consent collected inside the App.
• Precise location tracking: explicit consent together with contract performance.
• Push notifications: user consent at the operating-system level.

Sensitive data (live streaming, two-way audio) is not processed until you tap "Agree" in the consent dialog the App shows on first use. You can withdraw your consent at any time via: Account, then the Privacy & Data section. Withdrawal does not affect the lawfulness of what was accepted beforehand.

Important notice regarding access to the live stream, two-way audio, or recorded clips: No Road employee — including administrators — has any means to access the live stream from your cameras, open the two-way audio channel, or view recorded video clips by default. The only way is for you to explicitly grant us temporary permission from inside the App via: Account, then Privacy & Data, then grant maintenance permission (e.g., to troubleshoot a technical issue you reported).

This permission is:

• Limited to the duration you set (from a few minutes up to a maximum of 24 hours).
• Restricted to authorized support staff only.
• Recorded in the security audit log with the date, time, and employee identity.
• Automatically revoked when the period ends, or immediately when you withdraw it manually.

An administrator in the admin dashboard can view device status (online or offline), its location on the map, and the alert log, because that is necessary to operate the platform and perform routine maintenance.

4. Data retention periods

• Account data: for the lifetime of the account plus 30 days after a deletion request.
• GPS coordinates: for the lifetime of the account.
• Events and alerts: 365 days.
• Live streaming and two-way audio: not stored; passed through RAM only and destroyed when the stream ends.
• Uploaded video clips: 90 days.
• FCM notification tokens: for the lifetime of the account.
• Consent logs: for the lifetime of the account plus 3 years.
• Security audit logs: 3 years.
• Account deletion logs: 7 years (regulatory requirement).
• Orders and invoices: 10 years (ZATCA requirements).
• Operational app logs: 30 days.
• Database backups: rolling 14 days.

5. Who we share data with

We do not sell your personal data. We only share it with:

• Infrastructure providers (sub-processors) under written agreements that bind them to protection comparable to the Personal Data Protection Law, namely:
  • Google Cloud within the me-central2 region (Dammam, Saudi Arabia).
  • Firebase Cloud for notifications only.
• Saudi government authorities when there is a court order or a lawful enforcement request.
• The vehicle owner or fleet manager: if you are registered in the Road app and have devices belonging to you, the owner can view the vehicle data.

We do not transfer personal data outside the Kingdom of Saudi Arabia; live streaming and audio also pass through our servers in the Kingdom of Saudi Arabia.

6. Your rights

At any time, and free of charge, you have the right to:

• Access your data: via Account, then Privacy & Data, then Export my data to download a JSON file.
• Correction: via account settings.
• Withdraw any consent: via Account, then Privacy & Data, then Consents.
• Delete your account: via Account, then the Delete Account option.
• Restrict or object to certain processing: by contacting dpo@dashcamrd.com.

We respond to all requests within 30 days.

7. Security

The App uses TLS 1.2 or higher with a mandatory HSTS policy. Passwords are stored encrypted using the bcrypt algorithm. Session tokens (JWT) are signed with a rotating key. Our infrastructure complies with the Essential Cybersecurity Controls issued by the National Cybersecurity Authority. Every sensitive action is recorded in an immutable audit log for three years. Backups are encrypted at rest.

We continuously scan for secrets in the source code and scan production containers for vulnerabilities. Any confirmed personal data breach is reported to the competent authorities within 72 hours, and to affected users in clear Arabic and English.

8. Changes

We will notify you inside the App and by email at least 30 days before any material change to the Privacy Policy takes effect. Your continued use of the App after this period constitutes your acceptance of the new version of the policy.

9. Contact

Data Protection Officer — email: dpo@dashcamrd.com

Support: wa.me/966501283161

Address: Riyadh, Al-Aqiq, Aws bin Awf Street, Nawal.