Privacy policy

1. Who is responsible for your data

foursa.io is the party that decides why and how your personal data is processed (the data controller) for the purposes described in this policy. Where we process data on behalf of a client inside that client's project, we do so under our agreement with that client.

2. Data we collect

Data you give us: your name, your email address or phone number, and the description of your project, when you contact us or use the form on this website.

Account data: name, email address, preferred language, password (stored only as a one-way hash), sign-in times and, for team accounts, role and permissions.

Project data: files, messages, designs, steps, updates, meetings and invoices (with their payment status) that you or our team add to a project on the platform.

Data from Google: when you choose to sign in with Google or connect Google Calendar, the data described in section 4.

Technical data: essential cookies, IP address, browser and device type, and records of requests to our servers, used for security, fraud prevention and fault finding.

3. Why we use it, and on what basis

To provide the Services and perform our agreement with you or your company: managing projects, replying to you, sending the emails the Services rely on (sign-in links, updates, invoices, meeting invitations), and billing.

For our legitimate interests: keeping the Services secure, preventing misuse, improving our work, keeping business records, and establishing or defending legal claims.

To comply with legal obligations, such as accounting, tax and lawful requests from authorities.

With your consent, where the law requires it, for example when you connect a Google account. You can withdraw consent at any time; this does not affect processing that took place before.

We do not sell personal data and we do not use it for advertising.

4. Signing in with Google, Google Calendar and Google Meet

Signing in with Google is optional. If you use it, or link a Google account from My account, Google shares with us your email address and an identifier for your Google account (the openid and email scopes). We use them only to recognise you and sign you in to the account that already exists for you on the platform. We store the identifier and email address while the Google account is linked, and no Google access tokens. You can unlink it at any time from My account.

Connecting Google Calendar is optional and available to team accounts. If you connect it, we ask for permission to manage calendar events (the calendar.events scope). We use that permission only for meetings scheduled on the platform: to create the event in your calendar with a Google Meet link, invite the attendees, update or cancel it when the meeting changes on the platform, and read that same event back so that changes made in Google Calendar (a new time, a cancellation, attendees' replies) appear on the platform. We do not read, list or change any other event in your calendar.

For a connected calendar we store the Google email address and the tokens Google issues, encrypted, and for each meeting the event identifier, time, attendees, their replies and the Meet link. Disconnecting from My account deletes the tokens immediately. You can also remove our access at any time at myaccount.google.com/permissions.

Data received from Google is used only to provide these features to you. It is not sold, not used for advertising, not transferred to others except as necessary to provide the features, to comply with the law, or as part of a merger or acquisition with your notice, not read by people except with your consent, for security purposes, or as required by law, and not used to develop, improve or train artificial intelligence or machine-learning models.

foursa.io's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Who we share it with

Service providers that operate the Services on our behalf, such as hosting and database providers, email delivery providers, and other technology providers that support certain platform features. They receive only the data needed for their task, and are bound to keep it confidential and to use it only on our instructions. Data received from Google is not shared with them, except Google itself.

The people on a project: the members of our team who work on it, and the client it belongs to and the people that client has invited.

Authorities, courts or other parties, where the law requires it or where it is needed to protect our rights, our users or the public.

A buyer or successor, if all or part of our business is merged, sold or transferred; this policy will continue to apply to the data transferred.

6. Transfers outside your country

Some of our service providers may store or process data in countries other than yours. Where that happens, we take reasonable steps so that the data remains protected as described in this policy and as required by applicable law.

7. How long we keep it

We keep personal data for as long as the purposes in this policy require: while you have an account, while we work together, and afterwards for as long as needed to keep business records, resolve disputes, enforce our agreements and meet legal, accounting and tax obligations.

The Company may keep some clients' data for longer periods, including after the business relationship ends, unless the client contacts the Company formally to ask for it to be deleted. We then handle the request in line with applicable law, apart from data we are required or permitted by law to keep.

Google tokens for a connected calendar are deleted as soon as you disconnect it, and a linked Google sign-in is removed as soon as you unlink it.

8. How we protect it

We use reasonable technical and organisational measures to protect personal data, including encrypted connections, hashed passwords, encrypted storage of Google tokens and access limited by role. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Your rights

Subject to applicable law, including Egypt's Personal Data Protection Law No. 151 of 2020 where it applies, you may ask to access your personal data, correct it, delete it, object to or restrict its processing, and withdraw any consent you have given.

Requests must be sent to us formally, using the contact details below. We may need to verify your identity before acting on a request, and we will respond within the period the law requires. Some data may be kept where the law requires or permits it, as set out in section 7.

10. Cookies

We use only cookies that are essential for the Services to work: to keep you signed in, to secure sign-in with Google, and to remember your language. We do not use advertising or tracking cookies.

When you reach our website through a link that carries campaign tags (for example from one of our ads), your browser keeps those tags (the campaign name, the ad and click identifiers, and the site you came from) in its local storage for up to 90 days. They stay on your device unless you send us a project brief, in which case they are sent with it so we can tell which of our campaigns brought it. You can clear them at any time by clearing your browser's site data.

11. Children

The Services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children.

12. Other websites

The Services may link to websites and services we do not control, including Google. Their own privacy policies apply to them, and we are not responsible for their practices.

13. Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. We will tell platform users by email about significant changes. Continuing to use the Services after a change takes effect means you accept the updated policy.

14. Governing law

This policy is governed by the laws of the Arab Republic of Egypt, without prejudice to any rights you have under the mandatory law of the country where you live.

15. Contact

Questions about this policy, and formal requests about your data: Use the form on the home page