DOREP is operated by Montrai Labs ("we", "us"). For most data described here, your Employer is the data controller (they decide why your data is processed) and we act as a data processor providing the software. For account, billing and security data we act as controller. Contact: privacy@dorep.app.
| Category | Examples | Why |
|---|---|---|
| Account & identity | Name, username, phone number, email, password (hashed), role, employer/company, profile photo | Create and secure your account; operate the service |
| Location data | GPS coordinates during check-in and while sharing location during working hours; visit/order locations | Verify field visits, show reps on the management map, plan routes. Collected only while you are checked in / sharing. |
| Facial / biometric data | A selfie captured at sign-up and at check-in, processed for face-presence verification | Confirm the right person is checking in and reduce fraud. Face detection runs on your device where possible. |
| Business records | Clients/pharmacies, visits, orders, returns, samples, expenses, payments, plans, tasks, messages | Deliver the core CRM/ERP functionality your Employer uses |
| KYC documents (Management sign-up) | Company registration/incorporation documents, IDs | Verify a legitimate business before activating an account |
| Device & technical | Device push token, app version, platform, IP address, diagnostic logs | Deliver notifications, security, and troubleshooting |
We do not sell your personal data, and we do not use it for advertising.
DOREP collects precise location only while you are checked in / actively sharing location, to let your Employer's management see field activity in real time. You control check-in/out from the app, and you may deny or revoke the location permission in your device settings at any time (some features will then not work). Location is not collected in the background when you are checked out.
The check-in and sign-up selfie is used to confirm a live person is present ("face detection"). Where the platform supports it, this processing happens on your device. Selfies associated with an account are deleted when the account is deleted (see §9). By using facial check-in you consent to this processing; if you do not consent, contact your Employer for an alternative.
Your data is visible to your Employer's authorised Management and administrators, and to us as the software provider. We use a limited set of sub-processors to run the service (secure hosting, map tiles, and push-notification delivery by Apple and Google). We may disclose data if required by law. We do not share your personal data with third parties for their own purposes.
We keep business records for as long as your Employer's account is active and as required by law. Raw GPS location history is retained for a limited operational period and then pruned. When an account is deleted, personal identifiers are removed as described below.
You can request deletion of your account directly in the app — open More → Account → Delete my account. Because DOREP is an employer-managed workforce tool, a deletion request from an Employee is reviewed by their Management, and a request from Management is reviewed by the platform administrator, before it is finalised. Once approved, your personal identifiers (name, phone, email, photo, address, login) and your check-in selfies are removed/anonymised and your sign-in credentials and device tokens are deleted. Business transaction records created for your Employer may be retained in anonymised form where the Employer or the law requires it.
You may also request access to, correction of, or a copy of your data by emailing privacy@dorep.app or contacting your Employer.
Passwords are stored hashed, traffic is encrypted in transit (HTTPS/TLS), access is role-restricted, and we keep encrypted backups. No system is perfectly secure, but we take reasonable measures to protect your data.
DOREP is a workplace tool and is not directed to, or intended for, anyone under 18. We do not knowingly collect data from children.
DOREP is operated primarily for use in Iraq. By using the service you understand your data is processed on servers used to deliver the platform.
We may update this policy; we will change the version and effective date above and, for material changes, ask you to re-accept in the app.
Questions or requests: privacy@dorep.app. You may also reach us via the contact page.