ERA ERP

Privacy Policy

ERA ERP · Last updated: 21 October 2026

This policy explains what data ERA ERP (the "app", available at eraerp.com) stores, why, how it is protected, and how Google user data received through the Google Drive backup feature is used.

1. Who operates ERA ERP

ERA ERP is made and operated by Digital Era, the trade name of MUSTAFA ALI INFORMATION TECHNOLOGY (E-Trader licence 1518902, Dubai DED), Al Hamidiya 1, Ajman, United Arab Emirates.
Contact for privacy questions and requests: mustafa.ali.diyab@gmail.com · www.digitalerauae.com

ERA ERP is a business system used by a company and the team members it invites. For the business records entered into it (clients, invoices and so on), the company using the system decides what is entered; Digital Era runs the system that stores it.

2. What data ERA ERP stores and why

  • User accounts — name, e-mail address, password (stored only as a one-way hash), role, interface language and last sign-in time. Used to sign people in and to control what each person may see and do.
  • Clients and contact persons — company and person names, phone numbers, e-mail addresses, addresses, tax registration numbers, notes and CRM activities. Used to run sales and send quotations and invoices.
  • Sales and finance records — sales pipeline deals and follow-ups, quotations, invoices, receipt vouchers, payments, expenses, finance accounts, owner withdrawals, services and products. Used for billing, accounting and the reports in the app.
  • Projects — projects, milestones, tasks, comments and uploaded attachments. Used to deliver work and calculate project profit.
  • Sales Hunter (prospecting) — publicly listed business information (name, category, address, phone, website) found through OpenStreetMap and, when enabled, Google Places or Azure Maps; contact details, messages sent, consent records and opt-out (unsubscribe) records. Used to find and contact potential clients and to honour opt-outs.
  • Website enquiries — enquiries sent from the company's own website contact form (name, phone, e-mail, message), so the sales team can follow them up.
  • E-mail settings — e-mail templates and each user's outgoing mailbox settings. Mailbox passwords and sign-in tokens are stored encrypted.
  • Security and audit records — an audit log of sign-ins and changes (who, what, when, IP address and browser), sessions and error logs. Used to protect accounts and to keep an accurate history of business records.
  • Backups — encrypted copies of the app's database (see section 3), and a record of each backup run.

ERA ERP does not sell data, does not show advertising and does not use tracking or advertising cookies. It uses one session cookie (and a "remember me" cookie when chosen) to keep a user signed in, and a security token for forms.

3. Google user data (Google Drive backups)

A company owner (super administrator) can connect a Google account in Settings → Backups so that the nightly backup is also stored in that account's Google Drive. When connecting, ERA ERP requests one Google permission only (the app is named ERA ERP Backups on Google's consent screen): https://www.googleapis.com/auth/drive.file — access to the files that ERA ERP itself creates or that the user opens with it. It requests no other Google scope.

How the permission is used:

  • To create a folder named ERA ERP Backups and upload the encrypted backup files into it.
  • To list the backup files the app uploaded itself, so it can keep the newest 30 and delete only older backup files it created.
  • To let the owner restore: the backup files stay in that folder, where the owner downloads the one to restore.
  • To show which Google account is connected, the app reads that account's e-mail address once when connecting.

ERA ERP does not read, modify or delete any other file in the user's Google Drive, and with the drive.file permission Google does not allow it to see them at all.

Google user data is not sold, not shared with third parties, not used for advertising, and not used to train artificial intelligence or machine learning models. It is used only to provide the backup feature to the user who connected it.

Backups are encrypted on the ERA ERP server (AES-256, with a passphrase kept only in the server's configuration) before they are uploaded, so the files stored in Google Drive cannot be read without that passphrase.

ERA ERP's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Where the Google tokens are stored and how they are protected

  • After the owner allows access, Google returns a refresh token. ERA ERP stores it in its own database (the company_settings table), encrypted with AES-256 using the application's secret key, which is kept in the server configuration and not in the database. The OAuth client ID and client secret are stored the same way.
  • The short-lived access token is kept only in memory while a backup runs and is never saved.
  • Tokens are never shown on screen, never written to logs or the audit log, and are removed from any error message.
  • Only users with the owner (super administrator) role can open the Backups settings. The connection uses Google's recommended secure sign-in flow (with PKCE and a one-time state check), and all traffic uses HTTPS.

How to disconnect Google Drive

  • Inside ERA ERP: Settings → Backups → Disconnect. The app asks Google to revoke the token and deletes the stored refresh token, the connected account's e-mail address and the saved folder references from its database. No more backups are sent to Google Drive.
  • From your Google account: open myaccount.google.com/permissions, choose ERA ERP Backups and remove its access. Google then stops accepting the stored token; the next backup reports that Drive access was revoked and nothing more is uploaded. Pressing Disconnect in ERA ERP afterwards also deletes the now-useless encrypted token from the database.
  • Backup files already in Google Drive are not deleted when you disconnect, so that you keep your backups. They are your files: you can delete the ERA ERP Backups folder in Google Drive at any time.

4. How data is protected

  • HTTPS for every page, passwords stored only as hashes, and secrets (mailbox passwords, Google tokens, API keys) encrypted at rest.
  • Role-based access checked on every request and on every record, rate limits on sign-in, and an audit log of changes.
  • Nightly encrypted backups, kept on the server (the newest of each of the last 14 days and of the last 8 weeks) and, when connected, in Google Drive (the newest 30). A copy can also be e-mailed to addresses the owner chooses.

5. Who data is shared with

Data is not sold or rented. It is processed only by the service providers needed to run the app: the hosting provider that runs the server and database, the e-mail providers used to send the company's e-mails, Google Drive when the owner connects it for backups, and the map/business-listing services used by Sales Hunter (which receive search areas and categories or the name of the business being looked up, not your business records). Data may be disclosed when UAE law or a competent authority requires it.

6. Data retention and deletion

  • Business and financial records are kept while the company uses ERA ERP, because accounting history must stay complete. When the company stops using the service, its data is deleted on request, or after the period required by applicable law.
  • Some technical records are deleted automatically: integration logs after 180 days, raw prospect-search responses after 30 days, "PDF viewed" audit entries after 365 days, backup-run records after one year.
  • Server backups rotate automatically as described in section 4; Google Drive backups are limited to the newest 30 and are deleted by you when you no longer want them.
  • To ask for a copy, correction or deletion of personal data, e-mail mustafa.ali.diyab@gmail.com. We answer within 30 days. Someone contacted through Sales Hunter can also use the unsubscribe link in any message to stop further messages.

7. Children

ERA ERP is a business tool for companies and is not intended for children.

8. Changes and governing location

This policy is governed by the laws of the United Arab Emirates. If the policy changes, the new version is published on this page with a new "Last updated" date.

9. Contact

Digital Era — MUSTAFA ALI INFORMATION TECHNOLOGY, Al Hamidiya 1, Ajman, United Arab Emirates · mustafa.ali.diyab@gmail.com