1. General information
This Privacy Policy explains how data is processed when you use the mobile app and related website services provided by Alkin Group MMC under the Salam Sesame brand. The Company processes personal data for the purposes of providing the service, ensuring security and fulfilling its legal obligations.
2. Data collected
Depending on the nature of the service, the following data may be processed:
- First name, last name, e-mail address and phone number;
- Information about registration, account verification and user role;
- Residential complex, connected devices, access permissions and invitations;
- History of device commands, access attempts and related security events;
- Records related to subscriptions, payment status and requests;
- Technical identifiers required to deliver notifications;
- Organization details and facility location provided in requests from legal entities.
3. Location data
Salam Sesame does not continuously track the live location of users. However, when a distance-based security restriction is enabled on certain access devices, the current location of the user may be required at the moment an access command is sent. This data is used only with permission and within the scope of the relevant feature.
4. Purposes of data use
- Creating the account and verifying it by e-mail;
- Managing access rights, devices, invitations and subscriptions;
- Receiving and processing commands and performing security checks;
- Recording payment transactions and investigating requests and complaints;
- Delivering in-app and push notifications;
- Detecting technical faults and improving the service.
5. Payment data
Payments for Salam Sesame are made through the mobile app. Payments may be processed using the infrastructure of a bank or payment provider. Card saving and auto-renewal apply only when the relevant integration is active and with the consent of the user. Full card details are not intended to be stored on Salam Sesame servers.
6. Retention and data security
The main servers are located in the Republic of Azerbaijan. Data is retained for as long as necessary to provide the service, verify user permissions, ensure security and fulfil legal obligations. The retention period and deletion rules for activity history are to be governed by a separate internal policy.
Access to data is restricted according to authorization, and appropriate technical security measures are applied.
7. Third-party services
Google Firebase is intended to be used for delivering push notifications. In this connection, notification tokens and technical data may be processed through Google infrastructure. Data necessary for executing payments is shared with the integrated bank and payment provider.
To keep the app stable, Google Firebase Crashlytics collects crash reports: app crashes, the device model, the operating system version and an internal user number. Firebase Analytics measures how the app is used (screens opened and key actions) as statistics. This data is not used for advertising and is not sold; usage statistics can be turned off in the app under Settings → Privacy. Address search and the map use the GoMap.az service through our servers: the searched address and the point picked on the map are sent to GoMap, never the user's name or contact details.
8. Information shown to other users
Administrators authorized for the relevant device and complex may see the first name, last name and e-mail address of users for the purpose of managing access permissions. The extent of user data that is visible depends on the relevant role and permissions.
9. Notifications and usage history
The app may send push and in-app notifications about subscription, invitation, device and other service events. Whether notifications are displayed also depends on the operating system settings of the device. Access and activity events may be recorded for service security and for the investigation of disputes.
10. Account deactivation and data deletion
Deactivating an account and fully deleting personal data are separate operations. When an account is deactivated, the account data and any active subscription may be retained and notifications may be stopped; the user can restore use of the account by signing in again.
A separate request may be submitted for the deletion of personal data. Such requests are carried out in accordance with legal requirements and with regard to data that must be retained by law. A change in the technical status of an account is not presented as the automatic deletion of all data.
11. User rights
In accordance with the law, the user has the right to obtain information about their data, to have inaccurate data corrected, to request its deletion where applicable, and to submit requests.
12. Changes and contact
This Privacy Policy may be updated when the service or the law changes. For requests, you may use the Contact section of the official website.