Privacy Policy
Last updated 23 October 2026
How Watchtower collects, uses and protects personal data in the admin portal and the Watchtower mobile app.
1. Who we are
Watchtower (“we”, “us”) is operated by Wykmor Technology FZE LLC, Amber Gem Tower, Ajman, United Arab Emirates. We provide workforce-management software to security companies: scheduling, attendance with location check at clock-in, patrol checkpoints and incident reporting. This policy covers the admin portal at app.watchtower.ae and the Watchtower mobile app used by guards and supervisors.
Contact for anything in this policy: privacy@watchtower.ae.
2. Two roles: controller and processor
Our customers are security companies (“Customers”). Their guards and supervisors are usually the Customer’s employees, not ours.
- Guard and staff data (profiles, shifts, attendance, patrol scans, incident reports, photos, location at clock-in): the Customer is the controller and we are its processor, acting only on the Customer’s instructions. If you are a guard, your first point of contact for a privacy question is your employer.
- Portal administrators’ own account data and anyone who contacts us: we are the controller.
3. What we collect
From administrators and supervisors who use the portal
- Name, work email, phone number and role.
- A password, stored only as a one-way hash. We cannot see or recover it.
- A record of changes made in the portal (who did what, and when) in an audit log that your company’s managers can view.
From guards and supervisors who use the mobile app
- Name, phone number, employee ID and company code.
- A 4-digit PIN, stored only as a one-way hash. We cannot see or recover it.
- Location: the device’s position at the moment of clock-in and clock-out, when filing an incident report, and when scanning a patrol checkpoint, to confirm presence at the assigned site. The app does not track location at any other time.
- Shift and attendance records: scheduled and actual clock-in/out times, site and shift.
- Patrol checkpoint scans (NFC tag), with time and location.
- Incident reports: description, severity, people involved, action taken, and any photos you attach.
- A push-notification token, if you allow notifications, so shift and incident alerts reach your phone.
- App version and basic device information, used to keep the service working and secure.
What we do not collect: payment card details, contacts, or photos other than those you attach to an incident report. We do not run advertising trackers and we never sell personal data.
4. Why we use it
| Purpose | Data used |
|---|---|
| Run scheduling, attendance, patrol and incident reporting for a Customer | Staff records, shifts, clock events, scans, incidents |
| Confirm a guard was at the right site | Location at clock-in/out, scans and incident reports |
| Keep accounts secure (sign-in, lockout after repeated wrong PINs, audit log) | Credentials hashes, sign-in and attempt history, audit log |
| Send service emails (invitations, password resets, security notices) | Name, email |
| Deliver alerts to the mobile app | Push token, notification content |
| Respond to questions and meet legal obligations | Contact details, as needed |
5. Who we share it with
Only the service providers (“sub-processors”) that help us run Watchtower, and only as much as they need. They may not use the data for their own purposes.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage and backend functions | Singapore |
| Cloudflare | Hosts the portal and our website; DNS | Global network |
| Resend | Delivers service emails (invitations, password resets) | Japan (Tokyo) |
| Expo (and Google Firebase Cloud Messaging) | Delivers push notifications and app updates to Android | United States (Expo); Google’s global network (Firebase) |
We may also disclose data if the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of the business (with notice to Customers where practical). We never sell personal data.
6. Where data is stored and international transfers
Our primary database and file storage are hosted in Singapore. Data from users in the United Arab Emirates, or anywhere else, is therefore transferred to and stored in Singapore, and may be handled by the other providers above in the places they operate. We bind our providers by contract to protect personal data, and we will tell Customers before moving the primary database to another region.
When we transfer personal data outside the United Arab Emirates we rely on the data protection terms each provider agrees to with us, which require it to keep the data confidential and secure, use it only to provide its service to us, and delete or return it when that service ends, as Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data allows.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and operational data (shifts, attendance, patrols, incidents) | While the Customer’s account is active, then 90 days after it closes so the Customer can export it, then deleted |
| Incident photos | As long as the incident report they belong to |
| Audit log | While the Customer’s account is active, then deleted 90 days after it closes |
| Questions sent to us | Up to 2 years after our last reply, then deleted |
A Customer can ask us to export or delete its data at any time (see Your rights).
8. How we protect it
- Each Customer’s data is separated at the database level, and the database itself refuses access to another company’s records.
- Data is encrypted in transit, and encrypted at rest by our hosting provider.
- PINs and passwords are stored only as one-way hashes. Repeated wrong PINs lock the account for a time.
- Incident photos are kept in private storage and shown only through short-lived links.
- People can only do what their role allows (guard, supervisor, admin, manager).
More detail, including what we do not yet have, is on our Security page.
9. Your rights
Depending on where you live, you may be able to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent where we rely on it.
- Guards and other staff: please ask your employer first. They control your employment data and we will help them respond to you. If you cannot reach them, email privacy@watchtower.ae and we will do what we reasonably can.
- Portal administrators and anyone who has contacted us: email privacy@watchtower.ae.
- Deleting a company’s data: the company’s administrator can ask us at privacy@watchtower.ae.
We reply within 30 days. If you are not satisfied, you may complain to your local data protection authority.
10. Cookies and local storage
The portal stores only what it needs to keep you signed in, in your browser’s local storage. It uses no advertising or tracking cookies and no analytics. The mobile app does not use cookies.
11. Children
Watchtower is a workplace tool for adults employed by security companies. It is not directed at children and we do not knowingly collect their data.
12. Changes to this policy
We will post changes here and update the date at the top. For material changes we will also tell Customer administrators by email.
13. Contact
Wykmor Technology FZE LLC, Amber Gem Tower, Ajman, United Arab Emirates
privacy@watchtower.ae