Privacy policy

Last updated: 29 October 2026

Last updated: [2026/10/29]

This policy explains how [company legal name] (Naqd Flow, we, us) collects, uses and protects personal data when you use the website and the Platform, in line with the Saudi Personal Data Protection Law and its regulations.

1. Our role

Your account and subscription data (the owner, users, billing): we are the controller.
Data about a Business's customers and employees that the Business enters: the Business is the controller; we process it on its behalf and only to provide the service. Requests about this data go to the Business first, and we help it answer them.

2. What we collect

At sign-up: name, e-mail, mobile (optional), business name, country, currency and activity.
When you subscribe and pay: billing details and VAT number if any. Card details are entered with the payment provider directly; we do not store them.
While you use the Platform: sign-in records, devices and browsers used, IP address and an activity log, for security and audit.
When you contact us: what you send through support tickets or the "Contact us" form (name, contact details, message).
Data the Business enters: products, sales, invoices, customers, suppliers, employees and payroll, and so on, depending on what it uses.

3. Why we use it

To provide and run the service: accounts, selling, e-invoicing, reports, offline sync.
To manage subscriptions and issue and collect invoices.
To keep accounts secure: verification, detecting suspicious sign-ins, preventing fraud.
To provide support and answer your questions.
To send necessary notices: invoices, subscription ending, maintenance, changes to terms.
To meet legal obligations, such as ZATCA's requirements.

We do not sell your data, and we never use a Business's customer data for our own marketing.

4. Who we share it with

Only as far as needed, with:

Payment providers (such as NeoLeap, Tabby, Tamara) when you pay through them.
ZATCA: the e-invoices a Business sends through the Fatoora platform.
Technical service providers: hosting and storage, e-mail delivery, and the official WhatsApp service when enabled. They are bound to protect the data and use it for nothing else.
Authorities: when a binding legal request requires it.

5. Where the data is kept

Data is kept on servers in [the Kingdom of Saudi Arabia / your actual hosting location]. We do not transfer it outside the Kingdom except as the law allows.

6. How long we keep it

A Business's data is kept for as long as it subscribes.
After a subscription ends or is cancelled, the data stays readable and exportable for [90] days, after which we may delete it. We keep what the law requires us to keep, such as subscription invoices.
Security and audit logs are kept for [a set period, e.g. 12 months].
Backups are replaced on a rolling basis; deleted data leaves them as their cycle ends.

7. How we protect it

Encrypted connections (HTTPS), and encryption of sensitive stored data such as integration keys and Fatoora credentials.
Each Business's data is isolated from every other Business's at the database level.
Fine-grained permissions within each Business, optional two-factor authentication, and an audit log of actions.
Our support team enters a Business's account only with its permission, and its actions are logged.

If a breach affects your data, we notify the competent authority and the affected people within the periods the law sets.

8. Your rights

Under the law you have the right:

to be informed how and why your data is collected (this policy);
to access your data and receive a copy in a clear, readable format;
to correct inaccurate data or update it;
to have it destroyed once it is no longer needed, subject to what the law requires us to keep;
to withdraw consent where processing relies on it.

To exercise your rights, contact [privacy@…]. We answer within [30] days. You may also complain to the Saudi Data & AI Authority (SDAIA).

9. Cookies

We use only essential cookies to run the website and the Platform: the session and sign-in, protection against forged requests, language and theme. We use no advertising or tracking cookies.

10. Children

The Platform is meant for businesses; we do not knowingly collect data from anyone under 18.

11. Changes to this policy

We may update this policy and will notify you of material changes by e-mail or in the system before they apply.

12. Contact

Data protection officer: [name]
E-mail: [privacy@…]
Address: [national address]